Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
qhos.exe

Overview

General Information

Sample name:qhos.exe
Analysis ID:1574327
MD5:b9e7c2155c65081c5fae1a33bc55efef
SHA1:1d94d24217e44aca4549d67e340e4a79ebb2dc77
SHA256:d3ce2fa0dbe4469c93aef6210dc08771c4f06a77ec09a522f1b3773d55d70eab
Tags:exegithub-com--hombozuser-JAMESWT_MHT
Infos:

Detection

Python Stealer, Muck Stealer
Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Yara detected Muck Stealer
Found pyInstaller with non standard icon
Yara detected Generic Python Stealer
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info

Classification

Process Tree

  • System is w10x64
  • qhos.exe (PID: 4204 cmdline: "C:\Users\user\Desktop\qhos.exe" MD5: B9E7C2155C65081C5FAE1A33BC55EFEF)
    • qhos.exe (PID: 1516 cmdline: "C:\Users\user\Desktop\qhos.exe" MD5: B9E7C2155C65081C5FAE1A33BC55EFEF)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_MuckStealerYara detected Muck StealerJoe Security
    00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_MuckStealerYara detected Muck StealerJoe Security
      00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_MuckStealerYara detected Muck StealerJoe Security
        00000002.00000002.2247890897.000001613A4A4000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_MuckStealerYara detected Muck StealerJoe Security
          00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_MuckStealerYara detected Muck StealerJoe Security
            Click to see the 14 entries

            Sigma Signatures

            ⊘No Sigma rule has matched

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus detection for URL or domain
            Source: https://discord.gift/Avira URL Cloud: Label: malware
            Multi AV Scanner detection for submitted file
            Source: qhos.exeReversingLabs: Detection: 18%
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txtJump to behavior
            Source: qhos.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
            Source: Binary string: D:\a\1\b\bin\amd64\python312.pdb source: qhos.exe, 00000002.00000002.2252037864.00007FF8A8C84000.00000002.00000001.01000000.00000004.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: qhos.exe, 00000000.00000003.2130559311.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2249763026.00007FF8A812F000.00000002.00000001.01000000.0000001A.sdmp
            Source: Binary string: cryptography_rust.pdbc source: qhos.exe, 00000002.00000002.2249210092.00007FF8A74F7000.00000002.00000001.01000000.00000023.sdmp
            Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: qhos.exe, 00000002.00000002.2251380744.00007FF8A8722000.00000002.00000001.01000000.0000000E.sdmp
            Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: qhos.exe, 00000002.00000002.2251380744.00007FF8A8722000.00000002.00000001.01000000.0000000E.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: qhos.exe, 00000000.00000003.2108974639.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2262490595.00007FF8B8CB6000.00000002.00000001.01000000.00000017.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: qhos.exe, 00000000.00000003.2107239336.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2263834683.00007FF8B9F71000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: qhos.exe, 00000000.00000003.2107239336.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2263834683.00007FF8B9F71000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: qhos.exe, 00000002.00000002.2250326995.00007FF8A826E000.00000002.00000001.01000000.00000015.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: qhos.exe, 00000000.00000003.2108889235.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: params.pparams.qparams.gpub_keypriv_keyossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.4.0built on: Wed Nov 27 17:13:13 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/AOSSL_WINCTX: Undefinednot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: qhos.exe, 00000002.00000002.2249210092.00007FF8A74F7000.00000002.00000001.01000000.00000023.sdmp
            Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: qhos.exe, 00000002.00000002.2249210092.00007FF8A74F7000.00000002.00000001.01000000.00000023.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: qhos.exe, 00000000.00000003.2122986513.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2264047776.00007FF8BA4F3000.00000002.00000001.01000000.0000000A.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: qhos.exe, 00000002.00000002.2263170088.00007FF8B93D1000.00000002.00000001.01000000.00000007.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: qhos.exe, 00000000.00000003.2108576620.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\libssl-3.pdbEE source: qhos.exe, 00000002.00000002.2250569649.00007FF8A8335000.00000002.00000001.01000000.00000012.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: qhos.exe, 00000000.00000003.2108716029.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2261427850.00007FF8B8B1C000.00000002.00000001.01000000.0000000C.sdmp
            Source: Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: qhos.exe, 00000002.00000002.2249210092.00007FF8A74F7000.00000002.00000001.01000000.00000023.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: qhos.exe, 00000000.00000003.2107699064.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2256732523.00007FF8B7898000.00000002.00000001.01000000.00000016.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: qhos.exe, 00000000.00000003.2109601690.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2260362388.00007FF8B8832000.00000002.00000001.01000000.00000021.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: qhos.exe, 00000002.00000002.2258742138.00007FF8B7E02000.00000002.00000001.01000000.00000013.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: qhos.exe, 00000000.00000003.2109069201.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2263461700.00007FF8B9843000.00000002.00000001.01000000.0000000F.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: qhos.exe, 00000000.00000003.2108716029.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2261427850.00007FF8B8B1C000.00000002.00000001.01000000.0000000C.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: qhos.exe, 00000000.00000003.2107829884.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: qhos.exe, 00000000.00000003.2109700743.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2262692341.00007FF8B8F74000.00000002.00000001.01000000.00000010.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: qhos.exe, 00000000.00000003.2109179069.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2262955352.00007FF8B8F89000.00000002.00000001.01000000.00000009.sdmp
            Source: Binary string: cryptography_rust.pdb source: qhos.exe, 00000002.00000002.2249210092.00007FF8A74F7000.00000002.00000001.01000000.00000023.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: qhos.exe, 00000000.00000003.2109700743.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2262692341.00007FF8B8F74000.00000002.00000001.01000000.00000010.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: qhos.exe, 00000002.00000002.2257812927.00007FF8B78BF000.00000002.00000001.01000000.00000014.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: qhos.exe, 00000000.00000003.2120505427.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2242436608.00000161365D0000.00000002.00000001.01000000.00000006.sdmp
            Source: Binary string: D:\a\1\b\libssl-3.pdb source: qhos.exe, 00000002.00000002.2250569649.00007FF8A8335000.00000002.00000001.01000000.00000012.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: qhos.exe, 00000002.00000002.2259162108.00007FF8B7E2D000.00000002.00000001.01000000.00000011.sdmp
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AB83B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF646AB83B0
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AB92F0 FindFirstFileExW,FindClose,0_2_00007FF646AB92F0
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AD18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF646AD18E4
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646AB92F0 FindFirstFileExW,FindClose,2_2_00007FF646AB92F0
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646AD18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,2_2_00007FF646AD18E4
            Source: qhos.exe, 00000000.00000003.2130559311.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108377559.0000015AB2841000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.co
            Source: qhos.exe, 00000000.00000003.2108377559.0000015AB2841000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.co=
            Source: qhos.exe, 00000000.00000003.2109700743.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107699064.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120321625.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109069201.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107829884.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108889235.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120505427.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109306532.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2130559311.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109468138.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108377559.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108974639.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109601690.0000015AB284D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB2848000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109601690.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2121472864.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109179069.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108161364.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB284E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108716029.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2129958039.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
            Source: qhos.exe, 00000000.00000003.2109700743.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107699064.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120321625.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109069201.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107829884.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108889235.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120505427.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109306532.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2130559311.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109468138.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108377559.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108974639.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB2848000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109601690.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2121472864.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109179069.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108161364.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB284E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108716029.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2129958039.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2119826313.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
            Source: qhos.exe, 00000000.00000003.2109700743.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107699064.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120321625.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109069201.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107829884.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108889235.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120505427.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109306532.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2130559311.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109468138.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108377559.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108974639.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB2848000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109601690.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2121472864.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109179069.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108161364.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108716029.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2129958039.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2119826313.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
            Source: qhos.exe, 00000000.00000003.2109700743.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107699064.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120321625.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109069201.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107829884.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108889235.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120505427.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109306532.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2130559311.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109468138.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108377559.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108974639.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109601690.0000015AB284D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB2848000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109601690.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2121472864.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109179069.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108161364.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108716029.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2129958039.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2119826313.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
            Source: qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228516271.00000161386BF000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2141563979.00000161386B6000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229294201.0000016138ACB000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227740468.0000016138688000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229349813.00000161386C0000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2170243701.0000016138AA0000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224791154.0000016138AC8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2145260413.000001613867B000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2150905057.0000016138660000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2149534121.000001613857C000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2154456117.0000016138583000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2144553009.00000161386BC000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2148695617.0000016138676000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
            Source: qhos.exe, 00000002.00000003.2232049120.00000161389EF000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2145980469.00000161389EB000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2230494609.00000161389EE000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231367808.00000161389EE000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225347143.00000161389ED000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229948504.00000161389EE000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2141319554.00000161389B9000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2152537058.00000161389E8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2141319554.0000016138A08000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2148434113.00000161389E8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577916/
            Source: qhos.exe, 00000000.00000003.2109700743.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107699064.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120321625.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109069201.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107829884.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108889235.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120505427.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109306532.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2130559311.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109468138.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108377559.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108974639.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109601690.0000015AB284D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB2848000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109601690.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2121472864.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109179069.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108161364.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB284E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108716029.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2129958039.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
            Source: qhos.exe, 00000000.00000003.2109700743.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107699064.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120321625.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109069201.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107829884.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108889235.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120505427.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109306532.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2130559311.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109468138.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108377559.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108974639.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB2848000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109601690.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2121472864.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109179069.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108161364.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB284E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108716029.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2129958039.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2119826313.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
            Source: qhos.exe, 00000000.00000003.2109700743.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107699064.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120321625.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109069201.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107829884.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108889235.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120505427.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109306532.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2130559311.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109468138.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108377559.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108974639.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB2848000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109601690.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2121472864.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109179069.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108161364.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108716029.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2129958039.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2119826313.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
            Source: qhos.exe, 00000000.00000003.2108576620.0000015AB2841000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
            Source: qhos.exe, 00000000.00000003.2109700743.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107699064.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120321625.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109069201.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107829884.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108889235.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120505427.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109306532.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2130559311.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109468138.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108377559.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108974639.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB2848000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109601690.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2121472864.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109179069.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108161364.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB284E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108716029.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2129958039.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2119826313.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
            Source: qhos.exe, 00000002.00000002.2246269615.0000016139270000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
            Source: qhos.exe, 00000002.00000002.2246269615.0000016139270000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
            Source: qhos.exe, 00000002.00000002.2246452336.0000016139370000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
            Source: qhos.exe, 00000002.00000003.2145980469.00000161389FC000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2148434113.00000161389E8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2245836032.0000016138D70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/itertools.html#recipes
            Source: qhos.exe, 00000002.00000003.2148434113.000001613897D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2245955266.0000016138E70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://foo/bar.tar.gz
            Source: qhos.exe, 00000002.00000003.2148434113.000001613897D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2245955266.0000016138E70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://foo/bar.tgz
            Source: qhos.exe, 00000002.00000003.2225020695.0000016138C3D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227027725.0000016138C59000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229329228.0000016138C5D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2168553683.0000016138C33000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224089402.0000016138C03000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2226265552.0000016138C3E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://httpbin.org/post
            Source: qhos.exe, 00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2247890897.000001613A460000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://i.instagram.com/api/v1/users/web_profile_info/?username=
            Source: qhos.exe, 00000002.00000002.2247890897.000001613A460000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://i.instagram.com/api/v1/users/web_profile_info/?username=P
            Source: qhos.exe, 00000000.00000003.2109700743.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107699064.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120321625.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109069201.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107829884.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108889235.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120505427.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109306532.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2130559311.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109468138.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108377559.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108974639.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB2848000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109601690.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2121472864.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109179069.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108161364.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB284E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108716029.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2129958039.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2119826313.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
            Source: qhos.exe, 00000000.00000003.2109700743.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107699064.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120321625.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109069201.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107829884.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108889235.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120505427.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109306532.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2130559311.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109468138.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108377559.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108974639.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109601690.0000015AB284D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB2848000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109601690.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2121472864.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109179069.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108161364.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108716029.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2129958039.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2119826313.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
            Source: qhos.exe, 00000000.00000003.2109700743.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107699064.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120321625.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109069201.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107829884.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108889235.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120505427.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109306532.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2130559311.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109468138.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108377559.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108974639.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109601690.0000015AB284D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB2848000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109601690.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2121472864.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109179069.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108161364.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB284E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108716029.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2129958039.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
            Source: qhos.exe, 00000000.00000003.2109700743.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107699064.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120321625.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109069201.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107829884.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108889235.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120505427.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109306532.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2130559311.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109468138.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108377559.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108974639.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB2848000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109601690.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2121472864.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109179069.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108161364.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108716029.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2129958039.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2119826313.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
            Source: qhos.exe, 00000002.00000002.2246184492.0000016139170000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2246109714.0000016139070000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
            Source: qhos.exe, 00000002.00000003.2160777549.0000016138B81000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2160719792.0000016138D13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://python.org
            Source: qhos.exe, 00000002.00000003.2227466821.00000161386F3000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225474655.00000161386ED000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2160218075.0000016138CE6000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229580844.00000161386F5000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2244511519.00000161386F6000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227052513.00000161386EE000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://python.org/
            Source: qhos.exe, 00000002.00000003.2160777549.0000016138B81000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2160719792.0000016138D13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://python.org:80
            Source: qhos.exe, 00000000.00000003.2123294840.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/
            Source: qhos.exe, 00000000.00000003.2123294840.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2128119605.0000015AB2850000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2123294840.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
            Source: qhos.exe, 00000002.00000002.2246109714.0000016139070000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
            Source: qhos.exe, 00000000.00000003.2109700743.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107699064.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120321625.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109069201.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2107829884.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108889235.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2120505427.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109306532.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2130559311.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109468138.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108377559.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108974639.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB2848000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109601690.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2121472864.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2109179069.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108161364.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2117268018.0000015AB284E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108716029.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2129958039.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2119826313.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
            Source: qhos.exe, 00000002.00000003.2152106234.0000016138765000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2158818231.0000016138765000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2149534121.0000016138766000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2155848066.0000016138B0F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2150645663.0000016138B0F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2162011246.0000016138765000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229467868.0000016138767000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224689003.0000016138767000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
            Source: qhos.exe, 00000002.00000003.2160719792.0000016138D13000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228429343.00000161385BC000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://127.0.0.1:8443
            Source: qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227740468.0000016138688000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://aliexpress.com)
            Source: qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227740468.0000016138688000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://amazon.com)
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.gofile.io/getServer
            Source: qhos.exe, 00000002.00000002.2247890897.000001613A4A4000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org
            Source: qhos.exe, 00000002.00000002.2247890897.000001613A460000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api19-va.tiktokv.com/aweme/v1/user/profile/self/?
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://binance.com)
            Source: qhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blog.jaraco.com/skeleton
            Source: qhos.exe, 00000002.00000003.2228747088.0000016138D52000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224921144.0000016138D52000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2226265552.0000016138D52000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2245751959.0000016138D5B000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229406726.0000016138D57000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2168553683.0000016138D52000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2246634870.0000016139600000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue37179
            Source: qhos.exe, 00000002.00000002.2244777664.0000016138870000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2245836032.0000016138D70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue44497.
            Source: qhos.exe, 00000002.00000002.2247890897.000001613A494000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/1086668425797058691/1113770559688413245/app.asar
            Source: qhos.exe, 00000002.00000002.2247890897.000001613A494000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/1086668425797058691/1113770559688413245/app.asar0
            Source: qhos.exe, 00000002.00000002.2247890897.000001613A494000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/1135684724585681039/1143224080603037827/app.asar
            Source: qhos.exe, 00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com/avatars/
            Source: qhos.exe, qhos.exe, 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpString found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
            Source: qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://coinbase.com)
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crunchyroll.com)
            Source: qhos.exe, 00000000.00000003.2112574641.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io
            Source: qhos.exe, 00000000.00000003.2112574641.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/
            Source: qhos.exe, 00000000.00000003.2112574641.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/changelog/
            Source: qhos.exe, 00000002.00000002.2249210092.00007FF8A74F7000.00000002.00000001.01000000.00000023.sdmpString found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
            Source: qhos.exe, 00000000.00000003.2112574641.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/installation/
            Source: qhos.exe, 00000000.00000003.2112574641.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/security/
            Source: qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231729190.0000016138607000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2160777549.0000016138B81000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229128890.00000161385BD000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229224187.00000161385D0000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2160719792.0000016138D13000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228429343.00000161385BC000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2
            Source: qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231729190.0000016138607000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2160777549.0000016138B81000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229128890.00000161385BD000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229224187.00000161385D0000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2160719792.0000016138D13000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228429343.00000161385BC000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.3
            Source: qhos.exe, 00000002.00000002.2247890897.000001613A4A4000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com
            Source: qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227740468.0000016138688000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com)
            Source: qhos.exe, 00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/users/
            Source: qhos.exe, 00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v6/guilds/
            Source: qhos.exe, 00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2247890897.000001613A460000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v6/users/
            Source: qhos.exe, 00000002.00000002.2247890897.000001613A494000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v9/users/
            Source: qhos.exe, 00000002.00000002.2246269615.0000016139270000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/webhooks/1267176433306829014/YhEVi7QXrkO9uMJodvR8Fp2e6uTZlqxB6sVXodhGTQI4MPs
            Source: qhos.exe, 00000002.00000002.2247890897.000001613A4A4000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.gg/
            Source: qhos.exe, 00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.gift/
            Source: qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discordapp.com/api/v6/users/
            Source: qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discordapp.com/j
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://disney.com)
            Source: qhos.exe, 00000002.00000003.2228747088.0000016138D52000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224921144.0000016138D52000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2226265552.0000016138D52000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2245751959.0000016138D5B000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229406726.0000016138D57000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2168553683.0000016138D52000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2246634870.0000016139600000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/customizi
            Source: qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2243944971.00000161385C1000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229128890.00000161385BD000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2151869646.00000161385B2000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2149534121.000001613857C000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2154456117.0000016138583000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228429343.00000161385BC000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
            Source: qhos.exe, 00000002.00000003.2227425811.0000016138C21000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2226265552.0000016138C03000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224089402.0000016138C03000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2168553683.0000016138BF4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2160880937.0000016138C20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/howto/mro.html
            Source: qhos.exe, 00000002.00000003.2227425811.0000016138C21000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2168553683.0000016138C33000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2226265552.0000016138C03000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224089402.0000016138C03000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2245463764.0000016138C23000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/asyncio-eventloop.html
            Source: qhos.exe, 00000002.00000003.2224838760.00000161366C0000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225900899.00000161366CD000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2242981654.00000161366CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
            Source: qhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.metadata.html
            Source: qhos.exe, 00000002.00000003.2140563814.0000016138434000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224410745.0000016138439000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227125083.0000016138468000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2137761125.0000016138434000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224775605.0000016138466000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227844773.000001613846B000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2243629688.000001613846D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
            Source: qhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/reference/import.html#finders-and-loaders
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebay.com)
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://epicgames.com)
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://expressvpn.com)
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://filepreviews.io/
            Source: qhos.exe, 00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://geolocation-db.com/jsonp/
            Source: qhos.exe, 00000002.00000002.2245955266.0000016138E70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com)
            Source: qhos.exe, 00000002.00000002.2243263904.0000016138370000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224838760.00000161366C0000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225900899.00000161366CD000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2242981654.00000161366CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
            Source: qhos.exe, 00000002.00000003.2228747088.0000016138D52000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224921144.0000016138D52000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2226265552.0000016138D52000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2245751959.0000016138D5B000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229406726.0000016138D57000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2168553683.0000016138D52000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2246634870.0000016139600000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/aio-libs/aiohttp/discussions/6044
            Source: qhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/astral-sh/ruff
            Source: qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/frankxrs
            Source: qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227740468.0000016138688000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/frankxrs/
            Source: qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/frn
            Source: qhos.exe, 00000002.00000002.2245836032.0000016138D70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
            Source: qhos.exe, 00000002.00000002.2246109714.0000016139070000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/platformdirs/platformdirs
            Source: qhos.exe, 00000000.00000003.2112574641.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography
            Source: qhos.exe, 00000000.00000003.2112574641.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/
            Source: qhos.exe, 00000000.00000003.2112574641.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
            Source: qhos.exe, 00000000.00000003.2112574641.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2249210092.00007FF8A74F7000.00000002.00000001.01000000.00000023.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues
            Source: qhos.exe, 00000002.00000002.2249210092.00007FF8A74F7000.00000002.00000001.01000000.00000023.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues/8996
            Source: qhos.exe, 00000002.00000002.2249210092.00007FF8A74F7000.00000002.00000001.01000000.00000023.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues/9253
            Source: qhos.exe, 00000000.00000003.2112574641.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
            Source: qhos.exe, 00000000.00000003.2127807235.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md
            Source: qhos.exe, 00000002.00000002.2245955266.0000016138E70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packaging
            Source: qhos.exe, 00000002.00000002.2244777664.0000016138870000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
            Source: qhos.exe, 00000002.00000002.2244777664.0000016138870000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
            Source: qhos.exe, 00000002.00000002.2244692409.0000016138770000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml
            Source: qhos.exe, 00000000.00000003.2127807235.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/wheel
            Source: qhos.exe, 00000000.00000003.2127807235.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/wheel/issues
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs
            Source: qhos.exe, 00000000.00000003.2110680460.0000015AB2850000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs)
            Source: qhos.exe, 00000000.00000003.2110680460.0000015AB2850000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/blob/main/.github/CONTRIBUTING.md)
            Source: qhos.exe, 00000000.00000003.2110680460.0000015AB2850000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1328)
            Source: qhos.exe, 00000000.00000003.2110680460.0000015AB2850000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1329)
            Source: qhos.exe, 00000000.00000003.2110680460.0000015AB2850000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1330)
            Source: qhos.exe, 00000002.00000003.2227425811.0000016138C21000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2226265552.0000016138C03000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224089402.0000016138C03000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2168553683.0000016138BF4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2160880937.0000016138C20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/136
            Source: qhos.exe, 00000002.00000003.2230165900.0000016138982000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231473672.0000016138983000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2244882796.0000016138983000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/251
            Source: qhos.exe, 00000002.00000003.2227425811.0000016138C21000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2226265552.0000016138C03000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224089402.0000016138C03000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2168553683.0000016138BF4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2160880937.0000016138C20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/428
            Source: qhos.exe, 00000000.00000003.2110680460.0000015AB2850000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/wiki/Extensions-to-attrs)
            Source: qhos.exe, 00000002.00000002.2242981654.00000161366CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
            Source: qhos.exe, 00000002.00000002.2243263904.0000016138370000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224838760.00000161366C0000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225900899.00000161366CD000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2242981654.00000161366CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
            Source: qhos.exe, 00000002.00000003.2140563814.0000016138434000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224410745.0000016138439000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2243582686.0000016138446000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2137761125.0000016138434000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2135342024.0000016138685000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227006505.0000016138445000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231110123.0000016138446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86361.
            Source: qhos.exe, 00000002.00000002.2247642998.000001613A020000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/pull/118960
            Source: qhos.exe, 00000002.00000003.2228747088.0000016138D52000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224921144.0000016138D52000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2226265552.0000016138D52000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2245751959.0000016138D5B000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229406726.0000016138D57000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2168553683.0000016138D52000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2246634870.0000016139600000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/pull/28073
            Source: qhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata
            Source: qhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg
            Source: qhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22
            Source: qhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata/issues
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/hynek
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/hynek).
            Source: qhos.exe, 00000002.00000002.2243263904.0000016138370000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224838760.00000161366C0000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225900899.00000161366CD000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2242981654.00000161366CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gmail.com)
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://hbo.com)
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://hotmail.com)
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://hynek.me/articles/import-attrs/)
            Source: qhos.exe, 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://i.imgur.com/Npe8QuD.png
            Source: qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://i.o
            Source: qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://i.o%o/
            Source: qhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/badge/skeleton-2024-informational
            Source: qhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets
            Source: qhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_metadata.svg
            Source: qhos.exe, 00000000.00000003.2112574641.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
            Source: qhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/importlib_metadata.svg
            Source: qhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://importlib-metadata.readthedocs.io/
            Source: qhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://importlib-metadata.readthedocs.io/en/latest/?badge=latest
            Source: qhos.exe, 00000002.00000002.2245836032.0000016138D70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://instagram.com)
            Source: qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224984259.000001613876A000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2160248585.0000016138B76000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2245077420.0000016138AB2000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224689003.0000016138767000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://klaviyo.com/
            Source: qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228005090.000001613865C000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228168076.0000016138676000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2148168716.0000016138B17000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2150905057.0000016138660000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2149534121.000001613857C000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2154456117.0000016138583000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
            Source: qhos.exe, 00000000.00000003.2112574641.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://minecraft.net)
            Source: qhos.exe, 00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nationsglory.fr/profile/
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://netflix.com)
            Source: qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227740468.0000016138688000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://origin.com)
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://outlook.com)
            Source: qhos.exe, 00000002.00000002.2246184492.0000016139170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.
            Source: qhos.exe, 00000002.00000002.2246184492.0000016139170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/
            Source: qhos.exe, 00000002.00000002.2246035228.0000016138F70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/
            Source: qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227740468.0000016138688000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229383601.00000161386AB000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231146364.00000161386B2000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2233409874.00000161386B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the
            Source: qhos.exe, 00000002.00000002.2246109714.0000016139070000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2246035228.0000016138F70000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2159231381.0000016138B28000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/specifications/entry-points/
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://paypal.com)
            Source: qhos.exe, 00000002.00000002.2243687617.0000016138470000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0205/
            Source: qhos.exe, 00000002.00000002.2252037864.00007FF8A8C84000.00000002.00000001.01000000.00000004.sdmpString found in binary or memory: https://peps.python.org/pep-0263/
            Source: qhos.exe, 00000000.00000003.2110680460.0000015AB2850000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0649/)
            Source: qhos.exe, 00000002.00000002.2246184492.0000016139170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0685/
            Source: qhos.exe, 00000000.00000003.2110680460.0000015AB2850000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0749/)-implementing
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://playstation.com)
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pornhub.com)
            Source: qhos.exe, 00000000.00000003.2110680460.0000015AB2850000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/attrs/)
            Source: qhos.exe, 00000002.00000002.2246184492.0000016139170000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2246109714.0000016139070000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2246035228.0000016138F70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/build/).
            Source: qhos.exe, 00000000.00000003.2112574641.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/cryptography/
            Source: qhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/importlib_metadata
            Source: qhos.exe, 00000000.00000003.2127807235.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/setuptools/
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg
            Source: qhos.exe, 00000000.00000003.2112574641.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
            Source: qhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://readthedocs.org/projects/importlib-metadata/badge/?version=latest
            Source: qhos.exe, 00000002.00000002.2245955266.0000016138E70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://riotgames.com)
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://roblox.com)
            Source: qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sellix.io)
            Source: qhos.exe, 00000002.00000002.2246184492.0000016139170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/
            Source: qhos.exe, 00000002.00000003.2225000256.0000016138BE4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228900472.0000016138BE5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html
            Source: qhos.exe, 00000002.00000003.2231557294.0000016138A2C000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2244977860.0000016138A30000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225347143.00000161389ED000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231197726.0000016138A25000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228210646.0000016138A24000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
            Source: qhos.exe, 00000002.00000002.2246184492.0000016139170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages
            Source: qhos.exe, 00000002.00000002.2246184492.0000016139170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages0d
            Source: qhos.exe, 00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://skins.nationsglory.fr/face/
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://spotify.com)
            Source: qhos.exe, 00000000.00000003.2110680460.0000015AB2850000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/tagged/python-attrs)
            Source: qhos.exe, 00000002.00000003.2172109744.0000016139B5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stake.com)
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stake.com)p
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steam.com)
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://telegram.com)
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek
            Source: qhos.exe, 00000000.00000003.2110680460.0000015AB2850000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).
            Source: qhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/badges/package/pypi/importlib-metadata
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi
            Source: qhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm
            Source: qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227740468.0000016138688000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiktok.com)
            Source: qhos.exe, 00000002.00000002.2247890897.000001613A4A4000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiktok.com/
            Source: qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228516271.00000161386BF000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2150645663.0000016138AFF000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227740468.0000016138688000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229349813.00000161386C0000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386C5000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2157392945.0000016138AFF000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2155848066.0000016138B0F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2150645663.0000016138B0F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2150905057.0000016138660000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2149534121.000001613857C000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2154456117.0000016138583000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://twitch.com)
            Source: qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227740468.0000016138688000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com)
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://uber.com)
            Source: qhos.exe, 00000000.00000003.2127807235.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wheel.readthedocs.io/
            Source: qhos.exe, 00000000.00000003.2127807235.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wheel.readthedocs.io/en/stable/news.html
            Source: qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2143735844.00000161385D8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231164029.000001613864B000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228403002.0000016138625000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2141319554.00000161389B9000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2151869646.00000161385B2000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2149534121.000001613857C000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2154456117.0000016138583000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2141319554.0000016138A08000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228591557.0000016138628000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
            Source: qhos.exe, 00000000.00000003.2113154731.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/
            Source: qhos.exe, 00000000.00000003.2113154731.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2113154731.0000015AB284F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2113231807.0000015AB2850000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/
            Source: qhos.exe, 00000000.00000003.2110680460.0000015AB2850000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/)
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/FilePreviews.svg
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Klaviyo.svg
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Tidelift.svg
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Variomedia.svg
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/latest/names.html)
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/stable/changelog.html
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/stable/changelog.html)
            Source: qhos.exe, 00000000.00000003.2110680460.0000015AB2850000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/stable/comparison.html#customization)
            Source: qhos.exe, 00000000.00000003.2110680460.0000015AB2850000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)
            Source: qhos.exe, 00000000.00000003.2110680460.0000015AB2850000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/stable/why.html#data-classes)
            Source: qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.instagram.com/
            Source: qhos.exe, 00000000.00000003.2119826313.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2250660913.00007FF8A8370000.00000002.00000001.01000000.00000012.sdmp, qhos.exe, 00000002.00000002.2251719356.00007FF8A8863000.00000002.00000001.01000000.0000000E.sdmpString found in binary or memory: https://www.openssl.org/H
            Source: qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228005090.000001613865C000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2148434113.000001613897D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228168076.0000016138676000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2148168716.0000016138B17000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2150905057.0000016138660000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2149534121.000001613857C000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2154456117.0000016138583000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
            Source: qhos.exe, 00000000.00000003.2127807235.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/dev/peps/pep-0427/
            Source: qhos.exe, 00000002.00000002.2252614358.00007FF8A8DF4000.00000008.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.python.org/psf/license/
            Source: qhos.exe, 00000002.00000002.2252037864.00007FF8A8C84000.00000002.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.python.org/psf/license/)
            Source: qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.variomedia.de/
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://xbox.com)
            Source: qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com)
            Source: qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227740468.0000016138688000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://youtube.com)
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AB10000_2_00007FF646AB1000
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AB8BD00_2_00007FF646AB8BD0
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AD5C700_2_00007FF646AD5C70
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AD69D40_2_00007FF646AD69D4
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AD09380_2_00007FF646AD0938
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AC1FD00_2_00007FF646AC1FD0
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AC88040_2_00007FF646AC8804
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646ACDF600_2_00007FF646ACDF60
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AC17B00_2_00007FF646AC17B0
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AD97980_2_00007FF646AD9798
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AD18E40_2_00007FF646AD18E4
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AD411C0_2_00007FF646AD411C
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AB98700_2_00007FF646AB9870
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646ACE5E00_2_00007FF646ACE5E0
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AC1DC40_2_00007FF646AC1DC4
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AC36100_2_00007FF646AC3610
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AC5DA00_2_00007FF646AC5DA0
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AD5EEC0_2_00007FF646AD5EEC
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AC9F100_2_00007FF646AC9F10
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AC1BC00_2_00007FF646AC1BC0
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646ABA34B0_2_00007FF646ABA34B
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646ABA4E40_2_00007FF646ABA4E4
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646ABAD1D0_2_00007FF646ABAD1D
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AD09380_2_00007FF646AD0938
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AD64880_2_00007FF646AD6488
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AC2C800_2_00007FF646AC2C80
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AD3C800_2_00007FF646AD3C80
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AC21D40_2_00007FF646AC21D4
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AC3A140_2_00007FF646AC3A14
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AC81540_2_00007FF646AC8154
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AC19B40_2_00007FF646AC19B4
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646ACDACC0_2_00007FF646ACDACC
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646AB10002_2_00007FF646AB1000
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646ABA34B2_2_00007FF646ABA34B
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646AD69D42_2_00007FF646AD69D4
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646AC1FD02_2_00007FF646AC1FD0
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646AC88042_2_00007FF646AC8804
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646ACDF602_2_00007FF646ACDF60
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646AC17B02_2_00007FF646AC17B0
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646AD97982_2_00007FF646AD9798
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646AD18E42_2_00007FF646AD18E4
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646AD411C2_2_00007FF646AD411C
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646AB98702_2_00007FF646AB9870
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646ACE5E02_2_00007FF646ACE5E0
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646AC1DC42_2_00007FF646AC1DC4
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646AC36102_2_00007FF646AC3610
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646AC5DA02_2_00007FF646AC5DA0
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646AD5EEC2_2_00007FF646AD5EEC
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646AC9F102_2_00007FF646AC9F10
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646AB8BD02_2_00007FF646AB8BD0
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646AC1BC02_2_00007FF646AC1BC0
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF8A7FEB6D02_2_00007FF8A7FEB6D0
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF8A7FE9F902_2_00007FF8A7FE9F90
            Source: C:\Users\user\Desktop\qhos.exeCode function: String function: 00007FF646AB2910 appears 34 times
            Source: C:\Users\user\Desktop\qhos.exeCode function: String function: 00007FF646AB2710 appears 92 times
            Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
            Source: _overlapped.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
            Source: python3.dll.0.drStatic PE information: No import functions for PE file found
            Source: qhos.exe, 00000000.00000003.2109700743.0000015AB2841000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_wmi.pyd. vs qhos.exe
            Source: qhos.exe, 00000000.00000003.2107699064.0000015AB2841000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs qhos.exe
            Source: qhos.exe, 00000000.00000003.2120321625.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs qhos.exe
            Source: qhos.exe, 00000000.00000003.2109069201.0000015AB2841000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs qhos.exe
            Source: qhos.exe, 00000000.00000003.2107829884.0000015AB2841000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs qhos.exe
            Source: qhos.exe, 00000000.00000003.2108889235.0000015AB2841000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_multiprocessing.pyd. vs qhos.exe
            Source: qhos.exe, 00000000.00000003.2120505427.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs qhos.exe
            Source: qhos.exe, 00000000.00000003.2109306532.0000015AB2841000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs qhos.exe
            Source: qhos.exe, 00000000.00000003.2130559311.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs qhos.exe
            Source: qhos.exe, 00000000.00000003.2109468138.0000015AB2841000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs qhos.exe
            Source: qhos.exe, 00000000.00000003.2108377559.0000015AB2841000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs qhos.exe
            Source: qhos.exe, 00000000.00000003.2108974639.0000015AB2841000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs qhos.exe
            Source: qhos.exe, 00000000.00000003.2109601690.0000015AB2841000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs qhos.exe
            Source: qhos.exe, 00000000.00000003.2109179069.0000015AB2841000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs qhos.exe
            Source: qhos.exe, 00000000.00000003.2108161364.0000015AB2841000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs qhos.exe
            Source: qhos.exe, 00000000.00000003.2108716029.0000015AB2841000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs qhos.exe
            Source: qhos.exe, 00000000.00000003.2129958039.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs qhos.exe
            Source: qhos.exe, 00000000.00000003.2119826313.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs qhos.exe
            Source: qhos.exe, 00000000.00000003.2107239336.0000015AB2841000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs qhos.exe
            Source: qhos.exe, 00000000.00000003.2122986513.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs qhos.exe
            Source: qhos.exe, 00000000.00000003.2108576620.0000015AB2841000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs qhos.exe
            Source: qhos.exeBinary or memory string: OriginalFilename vs qhos.exe
            Source: qhos.exe, 00000002.00000002.2250660913.00007FF8A8370000.00000002.00000001.01000000.00000012.sdmpBinary or memory string: OriginalFilenamelibsslH vs qhos.exe
            Source: qhos.exe, 00000002.00000002.2263579687.00007FF8B9846000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs qhos.exe
            Source: qhos.exe, 00000002.00000002.2263905697.00007FF8B9F77000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs qhos.exe
            Source: qhos.exe, 00000002.00000002.2262574880.00007FF8B8CBB000.00000002.00000001.01000000.00000017.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs qhos.exe
            Source: qhos.exe, 00000002.00000002.2263246283.00007FF8B93DC000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs qhos.exe
            Source: qhos.exe, 00000002.00000002.2254416985.00007FF8A8F1D000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamepython312.dll. vs qhos.exe
            Source: qhos.exe, 00000002.00000002.2256823232.00007FF8B789F000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs qhos.exe
            Source: qhos.exe, 00000002.00000002.2258259050.00007FF8B78CB000.00000002.00000001.01000000.00000014.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs qhos.exe
            Source: qhos.exe, 00000002.00000002.2261649018.00007FF8B8B25000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs qhos.exe
            Source: qhos.exe, 00000002.00000002.2263049469.00007FF8B8F93000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs qhos.exe
            Source: qhos.exe, 00000002.00000002.2259445618.00007FF8B7E49000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs qhos.exe
            Source: qhos.exe, 00000002.00000002.2242436608.00000161365D0000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs qhos.exe
            Source: qhos.exe, 00000002.00000002.2250151622.00007FF8A8134000.00000002.00000001.01000000.0000001A.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs qhos.exe
            Source: qhos.exe, 00000002.00000002.2259955518.00007FF8B7E5E000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs qhos.exe
            Source: qhos.exe, 00000002.00000002.2260554717.00007FF8B8834000.00000002.00000001.01000000.00000021.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs qhos.exe
            Source: qhos.exe, 00000002.00000002.2251719356.00007FF8A8863000.00000002.00000001.01000000.0000000E.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs qhos.exe
            Source: qhos.exe, 00000002.00000002.2262784212.00007FF8B8F77000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: OriginalFilename_wmi.pyd. vs qhos.exe
            Source: classification engineClassification label: mal72.troj.winEXE@3/60@0/0
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042Jump to behavior
            Source: qhos.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\qhos.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor
            Source: C:\Users\user\Desktop\qhos.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: qhos.exe, 00000002.00000002.2250326995.00007FF8A826E000.00000002.00000001.01000000.00000015.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
            Source: qhos.exe, 00000002.00000002.2250326995.00007FF8A826E000.00000002.00000001.01000000.00000015.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
            Source: qhos.exe, 00000002.00000002.2250326995.00007FF8A826E000.00000002.00000001.01000000.00000015.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
            Source: qhos.exe, 00000002.00000002.2250326995.00007FF8A826E000.00000002.00000001.01000000.00000015.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
            Source: qhos.exe, qhos.exe, 00000002.00000002.2250326995.00007FF8A826E000.00000002.00000001.01000000.00000015.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
            Source: qhos.exe, 00000002.00000002.2250326995.00007FF8A826E000.00000002.00000001.01000000.00000015.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
            Source: qhos.exe, 00000002.00000002.2250326995.00007FF8A826E000.00000002.00000001.01000000.00000015.sdmpBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
            Source: qhos.exeReversingLabs: Detection: 18%
            Source: C:\Users\user\Desktop\qhos.exeFile read: C:\Users\user\Desktop\qhos.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\qhos.exe "C:\Users\user\Desktop\qhos.exe"
            Source: C:\Users\user\Desktop\qhos.exeProcess created: C:\Users\user\Desktop\qhos.exe "C:\Users\user\Desktop\qhos.exe"
            Source: C:\Users\user\Desktop\qhos.exeProcess created: C:\Users\user\Desktop\qhos.exe "C:\Users\user\Desktop\qhos.exe"Jump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: libffi-8.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: libcrypto-3.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: libssl-3.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: sqlite3.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: textshaping.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: textinputframework.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: coreuicomponents.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
            Source: qhos.exeStatic PE information: Image base 0x140000000 > 0x60000000
            Source: qhos.exeStatic file information: File size 15717053 > 1048576
            Source: qhos.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
            Source: qhos.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
            Source: qhos.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
            Source: qhos.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: qhos.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
            Source: qhos.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
            Source: qhos.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
            Source: qhos.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: Binary string: D:\a\1\b\bin\amd64\python312.pdb source: qhos.exe, 00000002.00000002.2252037864.00007FF8A8C84000.00000002.00000001.01000000.00000004.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: qhos.exe, 00000000.00000003.2130559311.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2249763026.00007FF8A812F000.00000002.00000001.01000000.0000001A.sdmp
            Source: Binary string: cryptography_rust.pdbc source: qhos.exe, 00000002.00000002.2249210092.00007FF8A74F7000.00000002.00000001.01000000.00000023.sdmp
            Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: qhos.exe, 00000002.00000002.2251380744.00007FF8A8722000.00000002.00000001.01000000.0000000E.sdmp
            Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: qhos.exe, 00000002.00000002.2251380744.00007FF8A8722000.00000002.00000001.01000000.0000000E.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: qhos.exe, 00000000.00000003.2108974639.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2262490595.00007FF8B8CB6000.00000002.00000001.01000000.00000017.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: qhos.exe, 00000000.00000003.2107239336.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2263834683.00007FF8B9F71000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: qhos.exe, 00000000.00000003.2107239336.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2263834683.00007FF8B9F71000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: qhos.exe, 00000002.00000002.2250326995.00007FF8A826E000.00000002.00000001.01000000.00000015.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: qhos.exe, 00000000.00000003.2108889235.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: params.pparams.qparams.gpub_keypriv_keyossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.4.0built on: Wed Nov 27 17:13:13 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/AOSSL_WINCTX: Undefinednot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: qhos.exe, 00000002.00000002.2249210092.00007FF8A74F7000.00000002.00000001.01000000.00000023.sdmp
            Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: qhos.exe, 00000002.00000002.2249210092.00007FF8A74F7000.00000002.00000001.01000000.00000023.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: qhos.exe, 00000000.00000003.2122986513.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2264047776.00007FF8BA4F3000.00000002.00000001.01000000.0000000A.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: qhos.exe, 00000002.00000002.2263170088.00007FF8B93D1000.00000002.00000001.01000000.00000007.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: qhos.exe, 00000000.00000003.2108576620.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\libssl-3.pdbEE source: qhos.exe, 00000002.00000002.2250569649.00007FF8A8335000.00000002.00000001.01000000.00000012.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: qhos.exe, 00000000.00000003.2108716029.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2261427850.00007FF8B8B1C000.00000002.00000001.01000000.0000000C.sdmp
            Source: Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: qhos.exe, 00000002.00000002.2249210092.00007FF8A74F7000.00000002.00000001.01000000.00000023.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: qhos.exe, 00000000.00000003.2107699064.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2256732523.00007FF8B7898000.00000002.00000001.01000000.00000016.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: qhos.exe, 00000000.00000003.2109601690.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2260362388.00007FF8B8832000.00000002.00000001.01000000.00000021.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: qhos.exe, 00000002.00000002.2258742138.00007FF8B7E02000.00000002.00000001.01000000.00000013.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: qhos.exe, 00000000.00000003.2109069201.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2263461700.00007FF8B9843000.00000002.00000001.01000000.0000000F.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: qhos.exe, 00000000.00000003.2108716029.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2261427850.00007FF8B8B1C000.00000002.00000001.01000000.0000000C.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: qhos.exe, 00000000.00000003.2107829884.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: qhos.exe, 00000000.00000003.2109700743.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2262692341.00007FF8B8F74000.00000002.00000001.01000000.00000010.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: qhos.exe, 00000000.00000003.2109179069.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2262955352.00007FF8B8F89000.00000002.00000001.01000000.00000009.sdmp
            Source: Binary string: cryptography_rust.pdb source: qhos.exe, 00000002.00000002.2249210092.00007FF8A74F7000.00000002.00000001.01000000.00000023.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: qhos.exe, 00000000.00000003.2109700743.0000015AB2841000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2262692341.00007FF8B8F74000.00000002.00000001.01000000.00000010.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: qhos.exe, 00000002.00000002.2257812927.00007FF8B78BF000.00000002.00000001.01000000.00000014.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: qhos.exe, 00000000.00000003.2120505427.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2242436608.00000161365D0000.00000002.00000001.01000000.00000006.sdmp
            Source: Binary string: D:\a\1\b\libssl-3.pdb source: qhos.exe, 00000002.00000002.2250569649.00007FF8A8335000.00000002.00000001.01000000.00000012.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: qhos.exe, 00000002.00000002.2259162108.00007FF8B7E2D000.00000002.00000001.01000000.00000011.sdmp
            Source: qhos.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
            Source: qhos.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
            Source: qhos.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
            Source: qhos.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
            Source: qhos.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
            Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
            Source: libcrypto-3.dll.0.drStatic PE information: section name: .00cfg
            Source: libssl-3.dll.0.drStatic PE information: section name: .00cfg
            Source: python312.dll.0.drStatic PE information: section name: PyRuntim

            Persistence and Installation Behavior

            barindex
            Found pyInstaller with non standard icon
            Source: C:\Users\user\Desktop\qhos.exeProcess created: "C:\Users\user\Desktop\qhos.exe"
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\_hashlib.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\_asyncio.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\cryptography\hazmat\bindings\_rust.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\python312.dllJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\unicodedata.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\_multiprocessing.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\frozenlist\_frozenlist.cp312-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\libffi-8.dllJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\_lzma.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\python3.dllJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\multidict\_multidict.cp312-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\_bz2.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\_socket.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\libssl-3.dllJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\_sqlite3.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\_cffi_backend.cp312-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\_decimal.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\_queue.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\pyexpat.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\_uuid.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\sqlite3.dllJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\VCRUNTIME140.dllJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\libcrypto-3.dllJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\_wmi.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\_ssl.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp\_websocket\mask.cp312-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\yarl\_quoting_c.cp312-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp\_http_parser.cp312-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp\_websocket\reader_c.cp312-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\_ctypes.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\select.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp\_http_writer.cp312-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\propcache\_helpers_c.cp312-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\_overlapped.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txtJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AB5820 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,0_2_00007FF646AB5820
            Source: C:\Users\user\Desktop\qhos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\_hashlib.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\_asyncio.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\cryptography\hazmat\bindings\_rust.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\python312.dllJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\unicodedata.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\frozenlist\_frozenlist.cp312-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\_multiprocessing.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\python3.dllJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\_lzma.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\multidict\_multidict.cp312-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\_bz2.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\_socket.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\_sqlite3.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\_cffi_backend.cp312-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\_decimal.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\_queue.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\pyexpat.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\_uuid.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\_wmi.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\_ssl.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp\_websocket\mask.cp312-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp\_websocket\reader_c.cp312-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\_ctypes.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp\_http_parser.cp312-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\yarl\_quoting_c.cp312-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\select.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp\_http_writer.cp312-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\propcache\_helpers_c.cp312-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42042\_overlapped.pydJump to dropped file
            Source: C:\Users\user\Desktop\qhos.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-17639
            Source: C:\Users\user\Desktop\qhos.exeAPI coverage: 1.9 %
            Source: C:\Users\user\Desktop\qhos.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AB83B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF646AB83B0
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AB92F0 FindFirstFileExW,FindClose,0_2_00007FF646AB92F0
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AD18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF646AD18E4
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646AB92F0 FindFirstFileExW,FindClose,2_2_00007FF646AB92F0
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646AD18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,2_2_00007FF646AD18E4
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF8A7FEBED0 _Py_NoneStruct,_PyArg_ParseTuple_SizeT,GetSystemInfo,VirtualAlloc,_Py_Dealloc,PyExc_MemoryError,PyErr_SetString,_PyObject_GC_New,PyExc_NotImplementedError,PyErr_Format,Py_FatalError,PyObject_GC_Track,PyExc_SystemError,PyErr_SetString,_Py_Dealloc,_Py_Dealloc,2_2_00007FF8A7FEBED0
            Source: qhos.exe, 00000002.00000002.2249532941.00007FF8A76CF000.00000002.00000001.01000000.00000023.sdmpBinary or memory string: vmCimC
            Source: qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227740468.0000016138688000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2230341663.0000016138692000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2136425848.0000016138688000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2144553009.0000016138678000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2143735844.0000016138673000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229676249.000001613868A000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2142884462.0000016138679000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2145260413.000001613867B000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2137968668.0000016138679000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlleric version of r
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646ACA684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF646ACA684
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AD34F0 GetProcessHeap,0_2_00007FF646AD34F0
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646ABC910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF646ABC910
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646ACA684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF646ACA684
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646ABD37C SetUnhandledExceptionFilter,0_2_00007FF646ABD37C
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646ABD19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF646ABD19C
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646ABC910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FF646ABC910
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF646ACA684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FF646ACA684
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF8A7FFADB8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FF8A7FFADB8
            Source: C:\Users\user\Desktop\qhos.exeCode function: 2_2_00007FF8A7FFA470 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FF8A7FFA470
            Source: C:\Users\user\Desktop\qhos.exeProcess created: C:\Users\user\Desktop\qhos.exe "C:\Users\user\Desktop\qhos.exe"Jump to behavior
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AD95E0 cpuid 0_2_00007FF646AD95E0
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp\_websocket VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\attrs-24.2.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\attrs-24.2.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\attrs-24.2.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\attrs-24.2.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\cryptography-44.0.0.dist-info\licenses VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\_socket.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\_bz2.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\jaraco VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\_ssl.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\multidict VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\multidict VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\multidict VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\multidict\_multidict.cp312-win_amd64.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\multidict VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\yarl VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\yarl VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\yarl\_quoting_c.cp312-win_amd64.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\propcache VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42042\propcache VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeQueries volume information: C:\Users\user\Desktop\qhos.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646ABD080 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF646ABD080
            Source: C:\Users\user\Desktop\qhos.exeCode function: 0_2_00007FF646AD5C70 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF646AD5C70

            Stealing of Sensitive Information

            barindex
            Yara detected Muck Stealer
            Source: Yara matchFile source: 00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2247890897.000001613A4A4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2227740468.0000016138688000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2231782577.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2229704914.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2228048852.00000161386D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2244466649.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2227792101.00000161386CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2247145926.00000161398E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2226223735.00000161398D2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: qhos.exe PID: 1516, type: MEMORYSTR
            Yara detected Generic Python Stealer
            Source: Yara matchFile source: Process Memory Space: qhos.exe PID: 1516, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Yara detected Muck Stealer
            Source: Yara matchFile source: 00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2247890897.000001613A4A4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2227740468.0000016138688000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2231782577.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2229704914.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2228048852.00000161386D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2244466649.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2227792101.00000161386CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2247145926.00000161398E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.2226223735.00000161398D2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: qhos.exe PID: 1516, type: MEMORYSTR
            Yara detected Generic Python Stealer
            Source: Yara matchFile source: Process Memory Space: qhos.exe PID: 1516, type: MEMORYSTR

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid Accounts11
            Windows Management Instrumentation            		1
            DLL Side-Loading            		11
            Process Injection            		1
            Virtualization/Sandbox Evasion            		OS Credential Dumping2
            System Time Discovery            		Remote Services1
            Archive Collected Data            		1
            Encrypted Channel            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault Accounts1
            Native API            		Boot or Logon Initialization Scripts1
            DLL Side-Loading            		11
            Process Injection            		LSASS Memory31
            Security Software Discovery            		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
            Deobfuscate/Decode Files or Information            		Security Account Manager1
            Virtualization/Sandbox Evasion            		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
            Obfuscated Files or Information            		NTDS1
            File and Directory Discovery            		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            DLL Side-Loading            		LSA Secrets24
            System Information Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            qhos.exe18%ReversingLabsWin64.Infostealer.Generic

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Users\user\AppData\Local\Temp\_MEI42042\VCRUNTIME140.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\_asyncio.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\_bz2.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\_cffi_backend.cp312-win_amd64.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\_ctypes.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\_decimal.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\_hashlib.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\_lzma.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\_multiprocessing.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\_overlapped.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\_queue.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\_socket.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\_sqlite3.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\_ssl.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\_uuid.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\_wmi.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp\_http_parser.cp312-win_amd64.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp\_http_writer.cp312-win_amd64.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp\_websocket\mask.cp312-win_amd64.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp\_websocket\reader_c.cp312-win_amd64.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\cryptography\hazmat\bindings\_rust.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\frozenlist\_frozenlist.cp312-win_amd64.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\libcrypto-3.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\libffi-8.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\libssl-3.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\multidict\_multidict.cp312-win_amd64.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\propcache\_helpers_c.cp312-win_amd64.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\pyexpat.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\python3.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\python312.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\select.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\sqlite3.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\unicodedata.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI42042\yarl\_quoting_c.cp312-win_amd64.pyd0%ReversingLabs

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            https://discord.gift/100%Avira URL Cloudmalware
            https://nationsglory.fr/profile/0%Avira URL Cloudsafe
            https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages0d0%Avira URL Cloudsafe
            https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages0%Avira URL Cloudsafe
            https://filepreviews.io/0%Avira URL Cloudsafe
            https://www.attrs.org/en/stable/why.html#data-classes)0%Avira URL Cloudsafe
            https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).0%Avira URL Cloudsafe
            https://i.o0%Avira URL Cloudsafe
            https://www.variomedia.de/0%Avira URL Cloudsafe
            https://www.attrs.org/en/stable/changelog.html0%Avira URL Cloudsafe
            https://www.attrs.org/0%Avira URL Cloudsafe
            https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).0%Avira URL Cloudsafe
            https://i.o%o/0%Avira URL Cloudsafe
            https://stake.com)p0%Avira URL Cloudsafe
            https://www.attrs.org/en/stable/comparison.html#customization)0%Avira URL Cloudsafe
            https://www.attrs.org/en/stable/changelog.html)0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            ⊘No contacted domains info

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            https://nationsglory.fr/profile/qhos.exe, 00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://github.com/pyca/cryptography/issues/8996qhos.exe, 00000002.00000002.2249210092.00007FF8A74F7000.00000002.00000001.01000000.00000023.sdmpfalse
              		high
              https://github.com/astral-sh/ruffqhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                https://discord.gift/qhos.exe, 00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: malware
                		unknown
                https://github.com/python-attrs/attrs/issues/251qhos.exe, 00000002.00000003.2230165900.0000016138982000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231473672.0000016138983000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2244882796.0000016138983000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesqhos.exe, 00000002.00000002.2246184492.0000016139170000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages0dqhos.exe, 00000002.00000002.2246184492.0000016139170000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svgqhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://coinbase.com)qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://tiktok.com/qhos.exe, 00000002.00000002.2247890897.000001613A4A4000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://github.com/aio-libs/aiohttp/discussions/6044qhos.exe, 00000002.00000003.2228747088.0000016138D52000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224921144.0000016138D52000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2226265552.0000016138D52000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2245751959.0000016138D5B000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229406726.0000016138D57000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2168553683.0000016138D52000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2246634870.0000016139600000.00000004.00001000.00020000.00000000.sdmpfalse
                          		high
                          https://github.com/python/importlib_metadata/issuesqhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://tiktok.com)qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227740468.0000016138688000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              http://python.orgqhos.exe, 00000002.00000003.2160777549.0000016138B81000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2160719792.0000016138D13000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://discord.com)qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227740468.0000016138688000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#qhos.exe, 00000002.00000002.2243263904.0000016138370000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224838760.00000161366C0000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225900899.00000161366CD000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2242981654.00000161366CE000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://wheel.readthedocs.io/en/stable/news.htmlqhos.exe, 00000000.00000003.2127807235.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://github.com/sponsors/hynekqhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://api19-va.tiktokv.com/aweme/v1/user/profile/self/?qhos.exe, 00000002.00000002.2247890897.000001613A460000.00000004.00001000.00020000.00000000.sdmpfalse
                                          		high
                                          https://importlib-metadata.readthedocs.io/qhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://www.apache.org/licenses/LICENSE-2.0qhos.exe, 00000000.00000003.2113154731.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2113154731.0000015AB284F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2113231807.0000015AB2850000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://packaging.python.org/en/latest/specifications/core-metadata/qhos.exe, 00000002.00000002.2246184492.0000016139170000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		high
                                                https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2243944971.00000161385C1000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229128890.00000161385BD000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2151869646.00000161385B2000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2149534121.000001613857C000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2154456117.0000016138583000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228429343.00000161385BC000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://paypal.com)qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://github.com/pypa/packagingqhos.exe, 00000002.00000002.2245955266.0000016138E70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).qhos.exe, 00000000.00000003.2110680460.0000015AB2850000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://i.instagram.com/api/v1/users/web_profile_info/?username=qhos.exe, 00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2247890897.000001613A460000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://readthedocs.org/projects/importlib-metadata/badge/?version=latestqhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://refspecs.linuxfoundation.org/elf/gabi4qhos.exe, 00000002.00000002.2245955266.0000016138E70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://discord.com/api/webhooks/1267176433306829014/YhEVi7QXrkO9uMJodvR8Fp2e6uTZlqxB6sVXodhGTQI4MPsqhos.exe, 00000002.00000002.2246269615.0000016139270000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://discord.com/api/v9/users/qhos.exe, 00000002.00000002.2247890897.000001613A494000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://xbox.com)qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://cdn.discordapp.com/attachments/1086668425797058691/1113770559688413245/app.asar0qhos.exe, 00000002.00000002.2247890897.000001613A494000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://youtube.com)qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227740468.0000016138688000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://blog.jaraco.com/skeletonqhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://github.com/python-attrs/attrs/issues/136qhos.exe, 00000002.00000003.2227425811.0000016138C21000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2226265552.0000016138C03000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224089402.0000016138C03000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2168553683.0000016138BF4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2160880937.0000016138C20000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://i.instagram.com/api/v1/users/web_profile_info/?username=Pqhos.exe, 00000002.00000002.2247890897.000001613A460000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://i.oqhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://github.com/platformdirs/platformdirsqhos.exe, 00000002.00000002.2246109714.0000016139070000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://docs.python.org/3/library/subprocess#subprocess.Popen.returncodeqhos.exe, 00000002.00000002.2246269615.0000016139270000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.mdqhos.exe, 00000000.00000003.2127807235.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://crunchyroll.com)qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://discord.comqhos.exe, 00000002.00000002.2247890897.000001613A4A4000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://github.com/python-attrs/attrs/issues/1330)qhos.exe, 00000000.00000003.2110680460.0000015AB2850000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://www.instagram.com/qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://pypi.org/project/build/).qhos.exe, 00000002.00000002.2246184492.0000016139170000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2246109714.0000016139070000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2246035228.0000016138F70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.3qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231729190.0000016138607000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2160777549.0000016138B81000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229128890.00000161385BD000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229224187.00000161385D0000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2160719792.0000016138D13000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228429343.00000161385BC000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231729190.0000016138607000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2160777549.0000016138B81000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229128890.00000161385BD000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229224187.00000161385D0000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2160719792.0000016138D13000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228429343.00000161385BC000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://github.com/pypa/wheelqhos.exe, 00000000.00000003.2127807235.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://www.python.org/dev/peps/pep-0427/qhos.exe, 00000000.00000003.2127807235.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerqhos.exe, 00000002.00000002.2243263904.0000016138370000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224838760.00000161366C0000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225900899.00000161366CD000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2242981654.00000161366CE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://github.com/python/cpython/issues/86361.qhos.exe, 00000002.00000003.2140563814.0000016138434000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2224410745.0000016138439000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2243582686.0000016138446000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2137761125.0000016138434000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2135342024.0000016138685000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227006505.0000016138445000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231110123.0000016138446000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://ebay.com)qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://www.apache.org/licenses/qhos.exe, 00000000.00000003.2113154731.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=mainqhos.exe, 00000000.00000003.2112574641.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-fileqhos.exe, 00000002.00000002.2249210092.00007FF8A74F7000.00000002.00000001.01000000.00000023.sdmpfalse
                                                                                                                		high
                                                                                                                https://filepreviews.io/qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                • Avira URL Cloud: safe
                                                                                                                		unknown
                                                                                                                https://www.attrs.org/en/stable/why.html#data-classes)qhos.exe, 00000000.00000003.2110680460.0000015AB2850000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                • Avira URL Cloud: safe
                                                                                                                		unknown
                                                                                                                https://playstation.com)qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://img.shields.io/badge/skeleton-2024-informationalqhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-theqhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227740468.0000016138688000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229383601.00000161386AB000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231146364.00000161386B2000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2233409874.00000161386B9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://cryptography.io/en/latest/installation/qhos.exe, 00000000.00000003.2112574641.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://sellix.io)qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613998D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://github.com/pypa/setuptools/issues/417#issuecomment-392298401qhos.exe, 00000002.00000002.2244777664.0000016138870000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://cdn.discordapp.com/attachments/1086668425797058691/1113770559688413245/app.asarqhos.exe, 00000002.00000002.2247890897.000001613A494000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://www.attrs.org/en/stable/changelog.htmlqhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              • Avira URL Cloud: safe
                                                                                                                              		unknown
                                                                                                                              https://discord.com/api/v6/guilds/qhos.exe, 00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://www.variomedia.de/qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                		unknown
                                                                                                                                https://img.shields.io/pypi/v/importlib_metadata.svgqhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://github.com/jaraco/jaraco.functools/issues/5qhos.exe, 00000002.00000002.2245836032.0000016138D70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://discordapp.com/jqhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://github.com/pyca/cryptography/issuesqhos.exe, 00000000.00000003.2112574641.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2249210092.00007FF8A74F7000.00000002.00000001.01000000.00000023.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://www.attrs.org/qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                        		unknown
                                                                                                                                        https://mahler:8092/site-updates.pyqhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228005090.000001613865C000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228168076.0000016138676000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2148168716.0000016138B17000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2150905057.0000016138660000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2149534121.000001613857C000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2154456117.0000016138583000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://tools.ietf.org/html/rfc7231#section-4.3.6)qhos.exe, 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228516271.00000161386BF000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2150645663.0000016138AFF000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227740468.0000016138688000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2229349813.00000161386C0000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2231057854.00000161386C5000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2157392945.0000016138AFF000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2155848066.0000016138B0F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2150645663.0000016138B0F000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2150905057.0000016138660000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2149534121.000001613857C000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2154456117.0000016138583000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://cryptography.io/qhos.exe, 00000000.00000003.2112574641.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://discord.gg/qhos.exe, 00000002.00000002.2247890897.000001613A4A4000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                                		unknown
                                                                                                                                                https://127.0.0.1:8443qhos.exe, 00000002.00000003.2160719792.0000016138D13000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2228429343.00000161385BC000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://netflix.com)qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://gmail.com)qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_dataqhos.exe, 00000002.00000003.2224838760.00000161366C0000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2225900899.00000161366CD000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2242981654.00000161366CE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://outlook.com)qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22qhos.exe, 00000000.00000003.2123938778.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://i.o%o/qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                                            		unknown
                                                                                                                                                            https://github.com)qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              http://cacerts.digicert.coqhos.exe, 00000000.00000003.2130559311.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2108377559.0000015AB2841000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://stake.com)pqhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                                                		unknown
                                                                                                                                                                https://binance.com)qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://cryptography.io/en/latest/changelog/qhos.exe, 00000000.00000003.2112574641.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://spotify.com)qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://github.com/pyca/cryptography/issues/9253qhos.exe, 00000002.00000002.2249210092.00007FF8A74F7000.00000002.00000001.01000000.00000023.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://www.attrs.org/en/stable/changelog.html)qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                                                        		unknown
                                                                                                                                                                        https://mail.python.org/mailman/listinfo/cryptography-devqhos.exe, 00000000.00000003.2112574641.0000015AB2842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.ymlqhos.exe, 00000002.00000002.2244692409.0000016138770000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            http://docs.python.org/library/itertools.html#recipesqhos.exe, 00000002.00000003.2145980469.00000161389FC000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2148434113.00000161389E8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000002.2245836032.0000016138D70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://www.attrs.org/en/stable/comparison.html#customization)qhos.exe, 00000000.00000003.2110680460.0000015AB2850000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB2842000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000000.00000003.2110600157.0000015AB284F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                                                              		unknown
                                                                                                                                                                              https://discord.com/api/users/qhos.exe, 00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://api.gofile.io/getServerqhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://steam.com)qhos.exe, 00000002.00000002.2248095326.000001613A560000.00000004.00001000.00020000.00000000.sdmp, qhos.exe, 00000002.00000003.2223814087.000001613998D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high

                                                                                                                                                                                    World Map of Contacted IPs

                                                                                                                                                                                    ⊘No contacted IP infos

                                                                                                                                                                                    General Information

                                                                                                                                                                                    Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                    Analysis ID:1574327
                                                                                                                                                                                    Start date and time:2024-12-13 08:41:58 +01:00
                                                                                                                                                                                    Joe Sandbox product:CloudBasic
                                                                                                                                                                                    Overall analysis duration:0h 8m 15s
                                                                                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                                                                                    Report type:full
                                                                                                                                                                                    Cookbook file name:default.jbs
                                                                                                                                                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                    Number of analysed new started processes analysed:5
                                                                                                                                                                                    Number of new started drivers analysed:0
                                                                                                                                                                                    Number of existing processes analysed:0
                                                                                                                                                                                    Number of existing drivers analysed:0
                                                                                                                                                                                    Number of injected processes analysed:0
                                                                                                                                                                                    Technologies:
                                                                                                                                                                                    • HCA enabled
                                                                                                                                                                                    • EGA enabled
                                                                                                                                                                                    • AMSI enabled
                                                                                                                                                                                    Analysis Mode:default
                                                                                                                                                                                    Analysis stop reason:Timeout
                                                                                                                                                                                    Sample name:qhos.exe
                                                                                                                                                                                    Detection:MAL
                                                                                                                                                                                    Classification:mal72.troj.winEXE@3/60@0/0
                                                                                                                                                                                    EGA Information:
                                                                                                                                                                                    • Successful, ratio: 100%
                                                                                                                                                                                    HCA Information:
                                                                                                                                                                                    • Successful, ratio: 73%
                                                                                                                                                                                    • Number of executed functions: 67
                                                                                                                                                                                    • Number of non-executed functions: 253
                                                                                                                                                                                    Cookbook Comments:
                                                                                                                                                                                    • Found application associated with file extension: .exe

                                                                                                                                                                                    Warnings

                                                                                                                                                                                    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                                                                                                                                    • Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.109.210.53
                                                                                                                                                                                    • Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                    • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                    • VT rate limit hit for: qhos.exe

                                                                                                                                                                                    Simulations

                                                                                                                                                                                    Behavior and APIs

                                                                                                                                                                                    ⊘No simulations

                                                                                                                                                                                    Joe Sandbox View / Context

                                                                                                                                                                                    IPs

                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                    Domains

                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                    ASNs

                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                    Dropped Files

                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI42042\VCRUNTIME140.dlllz4wnSavmK.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                      WVuXCNNYG0.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                        dipwo1iToJ.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                          Counseling_Services_Overview.docmGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            uOsIQqfgiT.exeGet hashmaliciousCharity, TrojanRansomBrowse
                                                                                                                                                                                              saiya.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                                                                                                                RuntimeusererVers.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                  OBS-Studio-30.2.3-Windows-Installer.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    BrowserUpdate.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      file.exeGet hashmaliciousCStealerBrowse

                                                                                                                                                                                                        Created / dropped Files

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\VCRUNTIME140.dll

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):109392
                                                                                                                                                                                                        Entropy (8bit):6.641929675972235
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
                                                                                                                                                                                                        MD5:4585A96CC4EEF6AAFD5E27EA09147DC6
                                                                                                                                                                                                        SHA1:489CFFF1B19ABBEC98FDA26AC8958005E88DD0CB
                                                                                                                                                                                                        SHA-256:A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
                                                                                                                                                                                                        SHA-512:D78260C66331FE3029D2CC1B41A5D002EC651F2E3BBF55076D65839B5E3C6297955AFD4D9AB8951FBDC9F929DBC65EB18B14B59BCE1F2994318564EB4920F286
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Joe Sandbox View:
                                                                                                                                                                                                        • Filename: lz4wnSavmK.exe, Detection: malicious, Browse
                                                                                                                                                                                                        • Filename: WVuXCNNYG0.exe, Detection: malicious, Browse
                                                                                                                                                                                                        • Filename: dipwo1iToJ.exe, Detection: malicious, Browse
                                                                                                                                                                                                        • Filename: Counseling_Services_Overview.docm, Detection: malicious, Browse
                                                                                                                                                                                                        • Filename: uOsIQqfgiT.exe, Detection: malicious, Browse
                                                                                                                                                                                                        • Filename: saiya.exe, Detection: malicious, Browse
                                                                                                                                                                                                        • Filename: RuntimeusererVers.exe, Detection: malicious, Browse
                                                                                                                                                                                                        • Filename: OBS-Studio-30.2.3-Windows-Installer.exe, Detection: malicious, Browse
                                                                                                                                                                                                        • Filename: BrowserUpdate.exe, Detection: malicious, Browse
                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                        Reputation:moderate, very likely benign file
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d..._#;..........." ...".....`......................................................=.....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\_asyncio.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):71448
                                                                                                                                                                                                        Entropy (8bit):6.243013214204417
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:1536:nhaPPkvDcBlqCTFFQ/ObfW11swNIGOnL7SyaeCxT:hanCDcnqCJFOObfW11swNIGOnLoeE
                                                                                                                                                                                                        MD5:2CD68FF636394D3019411611E27D0A3B
                                                                                                                                                                                                        SHA1:DA369C5D1A32F68639170D8A265A9EA49C2C8EBD
                                                                                                                                                                                                        SHA-256:0D4FBD46F922E548060EA74C95E99DC5F19B1DF69BE17706806760515C1C64FE
                                                                                                                                                                                                        SHA-512:37388D137454F52057B2376D95ABCC955FA1EDC3E20B96445FA45D1860544E811DF0C547F221C8671DC1A4D90262BB20F3B9F114252F3C47A8C3829951A2CE51
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Reputation:moderate, very likely benign file
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:.T.[...[...[...#*..[...'...[...'...[...'...[...'...[...&...[..M#...[...[...[...&...[...&...[...&F..[...&...[..Rich.[..........................PE..d...Q..e.........." ...#.f................................................... ......A&....`.............................................P......d......................../..............T...........................@...@............................................text...)d.......f.................. ..`.rdata..`O.......P...j..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\_bz2.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):84760
                                                                                                                                                                                                        Entropy (8bit):6.584507188180646
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:1536:FFzZz757cav+IuK66nlxX8W8LsANVIGCV87SyixL7:DzZzq6n3MhLsMVIGCV8O7
                                                                                                                                                                                                        MD5:C7CE973F261F698E3DB148CCAD057C96
                                                                                                                                                                                                        SHA1:59809FD48E8597A73211C5DF64C7292C5D120A10
                                                                                                                                                                                                        SHA-256:02D772C03704FE243C8DE2672C210A5804D075C1F75E738D6130A173D08DFCDE
                                                                                                                                                                                                        SHA-512:A924750B1825747A622EEF93331FD764D824C954297E37E8DC93A450C11AA7AB3AD7C3B823B11656B86E64DE3CD5D409FDA15DB472488DFAA4BB50341F0B29D1
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Reputation:moderate, very likely benign file
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.l.3...3...3...:...9......1......0......>......;......7.......0...x...1...3...l.......;.......2.......2.......2...Rich3...................PE..d...f..e.........." ...#.....^...............................................P.......@....`.............................................H............0....... ..,......../...@..........T...........................p...@............................................text............................... ..`.rdata..p>.......@..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\_cffi_backend.cp312-win_amd64.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):179712
                                                                                                                                                                                                        Entropy (8bit):6.180800197956408
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3072:IULjhBCx8qImKrUltSfGzdMcbb9CF8OS7jkSTLkKWlgeml:IgCeqImzSfIMcNCvOkSTLLWWem
                                                                                                                                                                                                        MD5:FCB71CE882F99EC085D5875E1228BDC1
                                                                                                                                                                                                        SHA1:763D9AFA909C15FEA8E016D321F32856EC722094
                                                                                                                                                                                                        SHA-256:86F136553BA301C70E7BADA8416B77EB4A07F76CCB02F7D73C2999A38FA5FA5B
                                                                                                                                                                                                        SHA-512:4A0E98AB450453FD930EDC04F0F30976ABB9214B693DB4B6742D784247FB062C57FAFAFB51EB04B7B4230039AB3B07D2FFD3454D6E261811F34749F2E35F04D6
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Reputation:moderate, very likely benign file
                                                                                                                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......a..#%p.p%p.p%p.p,..p)p.p5.q'p.p5.zp!p.p5.q!p.p5.q-p.p5.q)p.pn..q!p.p6.q&p.p%p.p.p.pm..q!p.p,..p$p.pm..q$p.pm.xp$p.pm..q$p.pRich%p.p........................PE..d...W..f.........." ...).....B......`........................................0............`..........................................h..l....i..................T............ .......O...............................M..@............................................text............................... ..`.rdata..............................@..@.data....].......0...p..............@....pdata..T...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\_ctypes.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):124696
                                                                                                                                                                                                        Entropy (8bit):6.1345016966871455
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3072:kuiS11BYNd+5AWdu41qOqJ/f/EX4lCPIWu1ptpIGLP+z:Pl1U+Ke/16f/ExWI
                                                                                                                                                                                                        MD5:10FDCF63D1C3C3B7E5861FBB04D64557
                                                                                                                                                                                                        SHA1:1AA153EFEC4F583643046618B60E495B6E03B3D7
                                                                                                                                                                                                        SHA-256:BC3B83D2DC9E2F0E6386ED952384C6CF48F6EED51129A50DFD5EF6CBBC0A8FB3
                                                                                                                                                                                                        SHA-512:DC702F4100ED835E198507CD06FA5389A063D4600FC08BE780690D729AB62114FD5E5B201D511B5832C14E90A5975ED574FC96EDB5A9AB9EB83F607C7A712C7F
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>...z.z.z.s...|....x....v....r....~.....x.1...{.1...|.....y.z.......|.....{...o.{.....{.Richz.................PE..d...c..e.........." ...#............p^..............................................".....`..........................................`.......a.........................../......p.......T...............................@............................................text............................... ..`.rdata...l.......n..................@..@.data....4.......0...h..............@....pdata..............................@..@.rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\_decimal.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):253208
                                                                                                                                                                                                        Entropy (8bit):6.567915765795386
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:6144:DV0lmIvcruIDCiryrjqPBTn9qWM53pLW1AuDRRRctULoT3TdTx:SN0rQiryr8TaV+QTdTx
                                                                                                                                                                                                        MD5:21C73E7E0D7DAD7A1FE728E3B80CE073
                                                                                                                                                                                                        SHA1:7B363AF01E83C05D0EA75299B39C31D948BBFE01
                                                                                                                                                                                                        SHA-256:A28C543976AA4B6D37DA6F94A280D72124B429F458D0D57B7DBCF71B4BEA8F73
                                                                                                                                                                                                        SHA-512:0357102BFFC2EC2BC6FF4D9956D6B8E77ED8558402609E558F1C1EBC1BACA6AEAA5220A7781A69B783A54F3E76362D1F74D817E4EE22AAC16C7F8C86B6122390
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.R.!...!...!...Y=..!..+]...!..+]...!..+]...!..+]...!..M\...!...Y...!...!...!..M\...!..M\...!..M\...!..M\Q..!..M\...!..Rich.!..........PE..d...T..e.........." ...#.v...<......|.....................................................`..........................................T..P....T...................'......./......P...`...T........................... ...@............................................text....t.......v.................. ..`.rdata...............z..............@..@.data....*...p...$...R..............@....pdata...'.......(...v..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\_hashlib.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):64792
                                                                                                                                                                                                        Entropy (8bit):6.219813461442214
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:1536:CQGllrIdcGuzZc94cVM7gDX4NIGOI67Sy+xzn1:I6cvz+9IgDX4NIGOI6Sn1
                                                                                                                                                                                                        MD5:F495D1897A1B52A2B15C20DCECB84B47
                                                                                                                                                                                                        SHA1:8CB65590A8815BDA58C86613B6386B5982D9EC3F
                                                                                                                                                                                                        SHA-256:E47E76D70D508B62924FE480F30E615B12FDD7745C0AAC68A2CDDABD07B692AE
                                                                                                                                                                                                        SHA-512:725D408892887BEBD5BCF040A0ECC6A4E4B608815B9DEA5B6F7B95C812715F82079896DF33B0830C9F787FFE149B8182E529BB1F78AADD89DF264CF8853EE4C4
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........u...&...&...&.U&...&u..'...&u..'...&u..'...&u..'...&...'...&...'...&...&M..&...'...&...'...&..9&...&...'...&Rich...&........PE..d......e.........." ...#.R...~.......>..............................................'.....`.............................................P.............................../......X....|..T............................{..@............p..(............................text...7P.......R.................. ..`.rdata...N...p...P...V..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\_lzma.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):159512
                                                                                                                                                                                                        Entropy (8bit):6.841828996170163
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3072:RmuEE9tZBoI+1hINrznfB9mNoNSn2Vh/VDxuVIGZ1L6E:RmuFPobkNpYONnvfuCE
                                                                                                                                                                                                        MD5:4E2239ECE266230ECB231B306ADDE070
                                                                                                                                                                                                        SHA1:E807A078B71C660DB10A27315E761872FFD01443
                                                                                                                                                                                                        SHA-256:34130D8ABE27586EE315262D69AF4E27429B7EAB1F3131EA375C2BB62CF094BE
                                                                                                                                                                                                        SHA-512:86E6A1EAB3529E600DD5CAAB6103E34B0F618D67322A5ECF1B80839FAA028150C492A5CF865A2292CC8584FBA008955DA81A50B92301583424401D249C5F1401
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........TB#.5,p.5,p.5,p.M.p.5,p.I-q.5,p.I)q.5,p.I(q.5,p.I/q.5,pnH-q.5,p.M-q.5,p.5-p.5,pnH!q.5,pnH,q.5,pnH.p.5,pnH.q.5,pRich.5,p........PE..d......e.........." ...#.d..........06....................................................`......................................... %..L...l%..x....p.......P.......@.../......4.......T...........................p...@............................................text...:b.......d.................. ..`.rdata..............h..............@..@.data...(....@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..4............>..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\_multiprocessing.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):35096
                                                                                                                                                                                                        Entropy (8bit):6.456173627081832
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:768:VAIvrenSE0PkA9c0ji+m9IGWte5YiSyv2pAAMxkEn:6ITQSH9c0jlm9IGWtU7SyOOxj
                                                                                                                                                                                                        MD5:811BCEE2F4246265898167B103FC699B
                                                                                                                                                                                                        SHA1:AE3DE8ACBA56CDE71001D3796A48730E1B9C7CCE
                                                                                                                                                                                                        SHA-256:FB69005B972DC3703F9EF42E8E0FDDF8C835CB91F57EF9B6C66BBDF978C00A8C
                                                                                                                                                                                                        SHA-512:1F71E23CE4B6BC35FE772542D7845DCBEA2A34522BA0468B61CB05F9ABAB7732CBF524BCFF498D1BD0B13B5E8A45C373CCA19AD20E5370F17259E281EDF344BE
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........)*.wGy.wGy.wGy...y.wGy'.Fx.wGy'.Bx.wGy'.Cx.wGy'.Dx.wGyA.Fx.wGy.wFy.wGy..Fx.wGyA.Jx.wGyA.Gx.wGyA..y.wGyA.Ex.wGyRich.wGy........................PE..d...W..e.........." ...#.....>......P.....................................................`.........................................0E..`....E..x............p.......Z.../...........4..T............................3..@............0...............................text............................... ..`.rdata..r ...0..."..."..............@..@.data........`.......D..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc...............X..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\_overlapped.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):55576
                                                                                                                                                                                                        Entropy (8bit):6.3454178187323755
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:1536:2ND3ua5sIRL9EiqXxpNdtrtBIGXtz7SyNxM:2NjOiUpNdPBIGXtzi
                                                                                                                                                                                                        MD5:F9C67280538408411BE9A7341B93B5B0
                                                                                                                                                                                                        SHA1:CCF776CD2483BC83B48B1DB322D7B6FCAB48356E
                                                                                                                                                                                                        SHA-256:5D298BB811037B583CFF6C88531F1742FAE5EEE47C290ADB47DDBD0D6126B9CC
                                                                                                                                                                                                        SHA-512:AF2156738893EF504D582ACE6750B25BC42AD1EC8A92E0550CE54810706D854F37A82F38EB965A537CAD5D35C0178C5EB7B4D20DB2A95BEBFECF9A13C0592646
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|!{X.O(X.O(X.O(Qe.(\.O(.aN)Z.O(.aJ)T.O(.aK)P.O(.aL)[.O(.`N)Z.O(X.N(/.O(.eN)].O(.eK)Y.O(.`B)Y.O(.`O)Y.O(.`.(Y.O(.`M)Y.O(RichX.O(................PE..d...V..e.........." ...#.L...`......P...............................................wC....`.............................................X...X............................/......(....f..T...........................`e..@............`...............................text....J.......L.................. ..`.rdata..D8...`...:...P..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\_queue.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):32536
                                                                                                                                                                                                        Entropy (8bit):6.464181935983508
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:768:/k+Ea6rfMkAYY0J/MpIGQUG5YiSyvHAMxkEJ5YSv:8tfHY0JEpIGQU87SyPx/Y+
                                                                                                                                                                                                        MD5:6E00E0821BB519333CCFD4E61A83CB38
                                                                                                                                                                                                        SHA1:3550A41BB2EA54F456940C4D1940ACAB36815949
                                                                                                                                                                                                        SHA-256:2AD02D49691A629F038F48FCDEE46A07C4FCC2CB0620086E7B09AC11915AE6B7
                                                                                                                                                                                                        SHA-512:C3F8332C10B58F30E292676B48ECF1860C5EF9546367B87E90789F960C91EAE4D462DD3EE9CB14F603B9086E81B6701AAB56DA5B635B22DB1E758ED0A983E562
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:W\.[9..[9..[9..#...[9..'8..[9..'<..[9..'=..[9..':..[9..&8..[9.M#8..[9..[8.M[9..&4..[9..&9..[9..&...[9..&;..[9.Rich.[9.........................PE..d...Y..e.........." ...#.....8.......................................................a....`..........................................C..L....C..d....p.......`.......P.../..........p4..T...........................03..@............0..8............................text............................... ..`.rdata.......0......................@..@.data........P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\_socket.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):83224
                                                                                                                                                                                                        Entropy (8bit):6.340320871656589
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:1536:ZUuhzLx79flWrqcqtpjly+uCo9/s+S+pzcHQ6B48/VI9dsSbxntpIGLwIU7SyZxL:ZU6zLRNawRy+uCo9/sT+pzuXxVIbsSde
                                                                                                                                                                                                        MD5:899380B2D48DF53414B974E11BB711E3
                                                                                                                                                                                                        SHA1:F1D11F7E970A7CD476E739243F8F197FCB3AD590
                                                                                                                                                                                                        SHA-256:B38E66E6EE413E5955EF03D619CADD40FCA8BE035B43093D2342B6F3739E883E
                                                                                                                                                                                                        SHA-512:7426CA5E7A404B9628E2966DAE544F3E8310C697145567B361825DC0B5C6CD87F2CAF567DEF8CD19E73D68643F2F38C08FF4FF0BB0A459C853F241B8FDF40024
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J./.+z|.+z|.+z|.S.|.+z|.W{}.+z|.W.}.+z|.W~}.+z|.Wy}.+z|}V{}.+z|.+{|.+z|.S{}.+z|}Vw}.+z|}Vz}.+z|}V.|.+z|}Vx}.+z|Rich.+z|................PE..d......e.........." ...#.v...........-.......................................`...........`.............................................P............@.......0.........../...P..........T...............................@............................................text....u.......v.................. ..`.rdata...x.......z...z..............@..@.data...H...........................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\_sqlite3.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):124696
                                                                                                                                                                                                        Entropy (8bit):6.2652662506859444
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3072:fZIPlR6TxhNO7/9CO4w5yIFGcXcpVNIGOQyl:RjFHO7kC56cXuo
                                                                                                                                                                                                        MD5:CEE93C920951C1169B615CB6330CEDDA
                                                                                                                                                                                                        SHA1:EF2ABF9F760DB2DE0BD92AFE8766A0B798CF8167
                                                                                                                                                                                                        SHA-256:FF25BDBEEF34D2AA420A79D3666C2660E7E3E96259D1F450F1AF5268553380EC
                                                                                                                                                                                                        SHA-512:999D324448BB39793E4807432C697F01F8922B0ABA4519A21D5DC4F4FC8E9E4737D7E104B205B931AF753EDA65F61D0C744F12BE84446F9C6CB3C2A5B35B773C
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@.g...g...g.......g..../..g......g....+..g....*..g....-..g..q./..g..../..g...g/..f..q.#..g..q....g..q...g..q.,..g..Rich.g..........PE..d......e.........." ...#.............................................................-....`.........................................po..P....o..................8......../.......... ...T...............................@............................................text............................... ..`.rdata..............................@..@.data...8............|..............@....pdata..8...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\_ssl.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):177432
                                                                                                                                                                                                        Entropy (8bit):5.975354635226847
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3072:KXGEr/16/nJxNOJW5NT6X3l44K5WOSCSVRJNI7IM/cbP7RHs3J7VIGC7hN:Y/r/16/nDNPT6X3l1CMVS7i
                                                                                                                                                                                                        MD5:9B4E74FD1DE0F8A197E4AA1E16749186
                                                                                                                                                                                                        SHA1:833179B49EB27C9474B5189F59ED7ECF0E6DC9EA
                                                                                                                                                                                                        SHA-256:A4CE52A9E0DADDBBE7A539D1A7EDA787494F2173DDCC92A3FAF43B7CF597452B
                                                                                                                                                                                                        SHA-512:AE72B39CB47A859D07A1EE3E73DE655678FE809C5C17FFD90797B5985924DDB47CEB5EBE896E50216FB445526C4CBB95E276E5F3810035B50E4604363EB61CD4
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U.k.4.8.4.8.4.8.L)8.4.8.H.9.4.8.H.9.4.8.H.9.4.8.H.9.4.8kI.9.4.8.4.8#5.8.L.9.4.8kI.9.4.8kI.9.4.8kIE8.4.8kI.9.4.8Rich.4.8........................PE..d......e.........." ...#............\,....................................................`......................................... ...d.......................8......../......x...@...T...............................@............................................text.............................. ..`.rdata...!......."..................@..@.data...(...........................@....pdata..8............^..............@..@.rsrc................j..............@..@.reloc..x............t..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\_uuid.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):25368
                                                                                                                                                                                                        Entropy (8bit):6.6272949891352315
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:384:lrfwHnEWGQiAQVIGZwJXHQIYiSy1pCQ4XAM+o/8E9VF0NyqzJSj:dQnEIHQVIGZw95YiSyv8AMxkEqw
                                                                                                                                                                                                        MD5:3C8737723A903B08D5D718336900FD8C
                                                                                                                                                                                                        SHA1:2AD2D0D50F6B52291E59503222B665B1823B0838
                                                                                                                                                                                                        SHA-256:BB418E91E543C998D11F9E65FD2A4899B09407FF386E059A88FE2A16AED2556B
                                                                                                                                                                                                        SHA-512:1D974EC1C96E884F30F4925CC9A03FB5AF78687A267DEC0D1582B5D7561D251FB733CF733E0CC00FAEE86F0FEF6F73D36A348F3461C6D34B0238A75F69320D10
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<p.R#.R#.R#...#.R#i.S".R#i.W".R#i.V".R#i.Q".R#..S".R#..S".R#.S#..R#..Z".R#..R".R#...#.R#..P".R#Rich.R#........................PE..d...]..e.........." ...#.....&...... ........................................p......wz....`.........................................`)..L....)..x....P.......@.......4.../...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\_wmi.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):36632
                                                                                                                                                                                                        Entropy (8bit):6.364173312940401
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:768:PgMwnWGwMtUTA7LlVIGCilx5YiSyvzAMxkEaFy:PgMwWGJtGA7LlVIGCih7Syrx+g
                                                                                                                                                                                                        MD5:EE33F4C8D17D17AD62925E85097B0109
                                                                                                                                                                                                        SHA1:8C4A03531CF3DBFE6F378FDAB9699D51E7888796
                                                                                                                                                                                                        SHA-256:79ADCA5037D9145309D3BD19F7A26F7BB7DA716EE86E01073C6F2A9681E33DAD
                                                                                                                                                                                                        SHA-512:60B0705A371AD2985DB54A91F0E904EEA502108663EA3C3FB18ED54671BE1932F4F03E8E3FD687A857A5E3500545377B036276C69E821A7D6116B327F5B3D5C1
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._\...=.@.=.@.=.@.En@.=.@.A.A.=.@.A.A.=.@.A.A.=.@.@.A.=.@.A.A.=.@PE.A.=.@.=.@A=.@PE.A.=.@.@.A.=.@.@.A.=.@.@.@.=.@.@.A.=.@Rich.=.@........PE..d..._..e.........." ...#.(...:.......&....................................................`..........................................T..H....T...............p..`....`.../......t...DG..T............................C..@............@.......S..@....................text...>&.......(.................. ..`.rdata..D....@... ...,..............@..@.data........`.......L..............@....pdata..`....p.......P..............@..@.rsrc................T..............@..@.reloc..t............^..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp\_http_parser.cp312-win_amd64.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):263168
                                                                                                                                                                                                        Entropy (8bit):6.21627512418483
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:6144:QV35ER7EkqmDenqq2xXqEq5K9CdFdcax:QV32HbDQpH5K9CdF
                                                                                                                                                                                                        MD5:556DA0B3FFC0DED5269CC5EF2B58F515
                                                                                                                                                                                                        SHA1:19D19EED09C6FC4539ABAD6E1B64BAA47FE1A5D0
                                                                                                                                                                                                        SHA-256:2EC92093132694B879A78A02A7751768A8321E49AA7149776F3AA7DC39F34B7B
                                                                                                                                                                                                        SHA-512:EEB15A973AA940BB47A38CE7D6403B57E4C1CADF88A8425B43A4F95D8D0D8AD24C4087283F449880206750BBE0A60C7CE018A764DD903CD2A92306B5CB2E384A
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.zU@.zU@.zUI..UF.zUQ~{TB.zU2y{TB.zU.}{TC.zU@.{U..zUQ~yTD.zUQ~~TH.zUQ~.TL.zU.~rTE.zU.~zTA.zU.~.UA.zU.~xTA.zURich@.zU........PE..d...&1Rg.........." ...*.(...........*....................................................`......................................... ...........x....`.......@...............p..\...0..................................@............@...............................text...h'.......(.................. ..`.rdata.......@.......,..............@..@.data... @..........................@....pdata.......@......................@..@.rsrc........`......................@..@.reloc..\....p......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp\_http_writer.cp312-win_amd64.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):49664
                                                                                                                                                                                                        Entropy (8bit):5.798969146565644
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:768:TPriCeqBiVwVJAQ8mK4fE0UYq0olSXEDmYgRE8tJQ:TprimVJtFxEqq5mYg20JQ
                                                                                                                                                                                                        MD5:2D6B0A6E3DACD8A512C4D7B21C603BEE
                                                                                                                                                                                                        SHA1:6088CB2D767024D2371C34F71EE5FE12C577FF64
                                                                                                                                                                                                        SHA-256:E5B3C4063E9F6AEF5E0DE529B6326816D820BE4C4406B5ABF98E36E25DB47739
                                                                                                                                                                                                        SHA-512:7BA3C9E68667D23DA443FF201A43D17D55AA180E2AB6204C2F1F4899761FD8D1C5F4447F2E27E21C84347E463AC4BB75C00DA14A91C218D62EC9E00745815F03
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........TJ...J...J...C.].H...[d..H...8c..H...[d..I...[d..B...[d..F....g..I...J........d..K....d..K....d1.K....d..K...RichJ...................PE..d...&1Rg.........." ...*.z...........|.......................................P............`............................................h...H...d....0....... ...............@......p...............................0...@...............P............................text....x.......z.................. ..`.rdata..20.......2...~..............@..@.data....N..........................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp\_websocket\mask.cp312-win_amd64.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):36352
                                                                                                                                                                                                        Entropy (8bit):5.653914099651
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:384:+IKmzsyA2+kEyrMxA91WZqJ91cL9U0WJtqpTHl2zwu9L6lBw81eLaZ4p1exetkDI:ZhzcnygxA91bryrczTGbw8kLtsqqTH
                                                                                                                                                                                                        MD5:5DCBFE4E67D270CDAEC74AF070439BB9
                                                                                                                                                                                                        SHA1:013935A24E8F116E921C5D0D2D0D8029F5C0213E
                                                                                                                                                                                                        SHA-256:AE6E0E449AACE7B4DF9327D7470652B17FB17F1A1483DA0FA033483BA6D9953A
                                                                                                                                                                                                        SHA-512:D561168440AFE5983580DFFB37DF2CDB02CD4EB7FB18858866EFE746CD985A03929743B0E387159ED1A4C9805E0C3B4AC66B05FA744DFB9B087CD0FDE81498CB
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........TB...B...B...K.M.@...Sd..@...0c..@...Sd..A...Sd..J...Sd..N....g..A...B........d..C....d..C....d!.C....d..C...RichB...........PE..d..."1Rg.........." ...*.N...B......`P....................................................`......................................... {..X...x{..d...................................0s...............................q..@............`...............................text....L.......N.................. ..`.rdata...)...`...*...R..............@..@.data................|..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\aiohttp\_websocket\reader_c.cp312-win_amd64.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):161792
                                                                                                                                                                                                        Entropy (8bit):6.0916455245461165
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:1536:lWN8oZXh2Y/m2/0+AMvRSDFxNYH/9Iw89qV406AgGkbJT0N6ctLU+XqiasgzvGaR:QGoVwY8M5bFIwoqRkYU0qikOXMNkqB
                                                                                                                                                                                                        MD5:A5C5C9268C5A77651A06CE7802BFD7E0
                                                                                                                                                                                                        SHA1:EED897C9E4A5AEDBACE6AF8D68DF587CFEEBA749
                                                                                                                                                                                                        SHA-256:E650698CDF135F3856ABFD9D4237BD479E670A37CB22C83C0B51D90E8FBC3E98
                                                                                                                                                                                                        SHA-512:F357B76AE8797B8D9D582558E4BD2E9252F0A3F9219FFB6D475C40F7994926D8E4C65EBE1FEB3DA9E34F3621A53E35621DADA6A40179A90322EA594C4FA494D5
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r..E6...6...6...?.G.2...'U..4...DR..4...'U..2...'U..>...'U..:...~V..5...6........U..7....U..7....U+.7....U..7...Rich6...........PE..d...(1Rg.........." ...*..................................................................`......................................... N..`....N..x...............D...................`<.............................. ;..@............................................text............................... ..`.rdata...f.......h..................@..@.data...X$...p.......P..............@....pdata..D............f..............@..@.rsrc................t..............@..@.reloc...............v..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\attrs-24.2.0.dist-info\INSTALLER

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                        Entropy (8bit):1.5
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3:Mn:M
                                                                                                                                                                                                        MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                        SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                        SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                        SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:pip.

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\attrs-24.2.0.dist-info\METADATA

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:Unicode text, UTF-8 text, with very long lines (411)
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):11524
                                                                                                                                                                                                        Entropy (8bit):5.211520136058075
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:192:ERsUfi6bkQk+k/kKkegToJWicnJsPVA1oz2dv7COmoKTACoEJdQ/0G6lWg+JdQV5:ERsXpLs3VoJWRnJsPvz2dDCHoKsLgA6z
                                                                                                                                                                                                        MD5:49CABCB5F8DA14C72C8C3D00ADB3C115
                                                                                                                                                                                                        SHA1:F575BECF993ECDF9C6E43190C1CB74D3556CF912
                                                                                                                                                                                                        SHA-256:DC9824E25AFD635480A8073038B3CDFE6A56D3073A54E1A6FB21EDD4BB0F207C
                                                                                                                                                                                                        SHA-512:923DAEEE0861611D230DF263577B3C382AE26400CA5F1830EE309BD6737EED2AD934010D61CDD4796618BEDB3436CD772D9429A5BED0A106EF7DE60E114E505C
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:Metadata-Version: 2.3.Name: attrs.Version: 24.2.0.Summary: Classes Without Boilerplate.Project-URL: Documentation, https://www.attrs.org/.Project-URL: Changelog, https://www.attrs.org/en/stable/changelog.html.Project-URL: GitHub, https://github.com/python-attrs/attrs.Project-URL: Funding, https://github.com/sponsors/hynek.Project-URL: Tidelift, https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi.Author-email: Hynek Schlawack <hs@ox.cx>.License-Expression: MIT.License-File: LICENSE.Keywords: attribute,boilerplate,class.Classifier: Development Status :: 5 - Production/Stable.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Languag

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\attrs-24.2.0.dist-info\RECORD

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):3556
                                                                                                                                                                                                        Entropy (8bit):5.809424313364516
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:96:Q9ewBtnJT/oPynEddwBbCobXm9qGmR5VXzskcGD+qLtxO:2ewnXJCKXGeR/XzKiO
                                                                                                                                                                                                        MD5:4B6973D2285295CF5E3A45E64EB7A455
                                                                                                                                                                                                        SHA1:1089F2F3C35303D6D5DD19F0C0F707B9609EE3F2
                                                                                                                                                                                                        SHA-256:2B368DFC37283970C33CC8D4EEC129F668EB99EBF9D3AA27F49A1B149658F2B0
                                                                                                                                                                                                        SHA-512:A5150ECB625A3CFDC3F22C60EB7B16FDBED01CD47505BD520491B477AE24E8C59FFAE2334948122E656F6F0A5F2AF0635B6D976241745583A3D7AF9E3781718D
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:attr/__init__.py,sha256=l8Ewh5KZE7CCY0i1iDfSCnFiUTIkBVoqsXjX9EZnIVA,2087..attr/__init__.pyi,sha256=aTVHBPX6krCGvbQvOl_UKqEzmi2HFsaIVm2WKmAiqVs,11434..attr/__pycache__/__init__.cpython-312.pyc,,..attr/__pycache__/_cmp.cpython-312.pyc,,..attr/__pycache__/_compat.cpython-312.pyc,,..attr/__pycache__/_config.cpython-312.pyc,,..attr/__pycache__/_funcs.cpython-312.pyc,,..attr/__pycache__/_make.cpython-312.pyc,,..attr/__pycache__/_next_gen.cpython-312.pyc,,..attr/__pycache__/_version_info.cpython-312.pyc,,..attr/__pycache__/converters.cpython-312.pyc,,..attr/__pycache__/exceptions.cpython-312.pyc,,..attr/__pycache__/filters.cpython-312.pyc,,..attr/__pycache__/setters.cpython-312.pyc,,..attr/__pycache__/validators.cpython-312.pyc,,..attr/_cmp.py,sha256=3umHiBtgsEYtvNP_8XrQwTCdFoZIX4DEur76N-2a3X8,4123..attr/_cmp.pyi,sha256=U-_RU_UZOyPUEQzXE6RMYQQcjkZRY25wTH99sN0s7MM,368..attr/_compat.py,sha256=n2Uk3c-ywv0PkFfGlvqR7SzDXp4NOhWmNV_ZK6YfWoM,2958..attr/_config.py,sha256=z81Vt-GeT_2taxs1XZfmHx9TWlSxjP

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\attrs-24.2.0.dist-info\WHEEL

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):87
                                                                                                                                                                                                        Entropy (8bit):4.730668933656452
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3:RtEeXAaCTQnP+tPCCfA5I:Rt2PcnWBB3
                                                                                                                                                                                                        MD5:52ADFA0C417902EE8F0C3D1CA2372AC3
                                                                                                                                                                                                        SHA1:B67635615EEF7E869D74F4813B5DC576104825DD
                                                                                                                                                                                                        SHA-256:D7215D7625CC9AF60AED0613AAD44DB57EBA589D0CCFC3D8122114A0E514C516
                                                                                                                                                                                                        SHA-512:BFA87E7B0E76E544C2108EF40B9FAC8C5FF4327AB8EDE9FEB2891BD5D38FEA117BD9EEBAF62F6C357B4DEADDAD5A5220E0B4A54078C8C2DE34CB1DD5E00F2D62
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:Wheel-Version: 1.0.Generator: hatchling 1.25.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\attrs-24.2.0.dist-info\licenses\LICENSE

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):1109
                                                                                                                                                                                                        Entropy (8bit):5.104415762129373
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:24:bGf8rUrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bW8rUaJHlxE3dQHOs5exm3ogFh
                                                                                                                                                                                                        MD5:5E55731824CF9205CFABEAB9A0600887
                                                                                                                                                                                                        SHA1:243E9DD038D3D68C67D42C0C4BA80622C2A56246
                                                                                                                                                                                                        SHA-256:882115C95DFC2AF1EEB6714F8EC6D5CBCABF667CAFF8729F42420DA63F714E9F
                                                                                                                                                                                                        SHA-512:21B242BF6DCBAFA16336D77A40E69685D7E64A43CC30E13E484C72A93CD4496A7276E18137DC601B6A8C3C193CB775DB89853ECC6D6EB2956DEEE36826D5EBFE
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:The MIT License (MIT)..Copyright (c) 2015 Hynek Schlawack and the attrs contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\base_library.zip

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):1329520
                                                                                                                                                                                                        Entropy (8bit):5.586655762137983
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:12288:uttcY+b+vOmgRF1+fYNXPh26UZWAzCu7j5D95wdgkVodYOPjwwMJ9gCCaYc2I:uttcY+mHCiCA5TNqodYOPEPEaYc2I
                                                                                                                                                                                                        MD5:898E35281A756640780DBC31A0B78452
                                                                                                                                                                                                        SHA1:845B59CFD9FB152725F250A872E9D1D7A66AF258
                                                                                                                                                                                                        SHA-256:0DAA440C78582A693DABBC2325A06D817131BB170BAD436B126BAD896F1377CD
                                                                                                                                                                                                        SHA-512:421CC4A15E94293E53F1039B8BB5BE7EDCBC8E3E0E4ABC7F34FAF991993F51CB5F51493B58BB341CB9579347EC134B02104454075A8E7E33E45B8E3A66A44D79
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:PK..........!.x[_C............_collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z*..e*........Z*..e.e*........Z+e*jY............................[*d...Z-..e-........

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\cryptography-44.0.0.dist-info\INSTALLER

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                        Entropy (8bit):1.5
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3:Mn:M
                                                                                                                                                                                                        MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                        SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                        SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                        SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:pip.

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\cryptography-44.0.0.dist-info\METADATA

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):5724
                                                                                                                                                                                                        Entropy (8bit):5.120429897887076
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:96:DlkQIUQIhQIKQILbQIRIaMPktjaVMxsxA2ncEvGDfe0HEdwGArNZG0JQTQCQx5Kw:dcPuPwsrcEvGDfe0HENA5w0JQTQ9x59H
                                                                                                                                                                                                        MD5:526D9AC9D8150602EC9ED8B9F4DE7102
                                                                                                                                                                                                        SHA1:DBA2CB32C21C4B0F575E77BBCDD4FA468056F5E3
                                                                                                                                                                                                        SHA-256:D95F491ED418DC302DB03804DAF9335CE21B2DF4704587E6851EF03E1F84D895
                                                                                                                                                                                                        SHA-512:FB13A2F6B64CB7E380A69424D484FC9B8758FA316A7A155FF062BFDACDCA8F2C5D2A03898CD099688B1C16A5A0EDCECFC42BF0D4D330926B10C3FCE9F5238643
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:Metadata-Version: 2.3.Name: cryptography.Version: 44.0.0.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\cryptography-44.0.0.dist-info\RECORD

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):16380
                                                                                                                                                                                                        Entropy (8bit):5.587009861664839
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:192:hXr12s/l45jEVeK+VqhXJZ4WJJ6sf7B0PpzIq+NX6ih5VFUqq8q:hXplMEVdhJrJJ6sf7B0Ppz/+96ihu8q
                                                                                                                                                                                                        MD5:A53742D3EE69CAE1FD8BDEDAC05BB828
                                                                                                                                                                                                        SHA1:02BC360839FEB54E58E14D410266652DCB718353
                                                                                                                                                                                                        SHA-256:9518E7D9DA0F889F568F800E1A4ADC0686234DC9D9934A46F78FFB5E6C351A98
                                                                                                                                                                                                        SHA-512:C69C4D3ECA56D725E90F9F0C4B98071F4F92A3BC06A635CE0D6309976C750B20B3DA353EFED27F07712FF5E0C1A8114300004C8E2D2EE9155F31D856A3C6EE05
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:cryptography-44.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-44.0.0.dist-info/METADATA,sha256=2V9JHtQY3DAtsDgE2vkzXOIbLfRwRYfmhR7wPh-E2JU,5724..cryptography-44.0.0.dist-info/RECORD,,..cryptography-44.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-44.0.0.dist-info/WHEEL,sha256=Hn9bytZpOGoR6M4U5xUTHC1AJpPD9B1xPrM4STxljEU,94..cryptography-44.0.0.dist-info/licenses/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-44.0.0.dist-info/licenses/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-44.0.0.dist-info/licenses/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=fcUqF1IcadxBSH0us1vCvob0OJOrPV3h30yZD8wsHo4,445..cryptography/__init__.py,sha256=XsRL_PxbU6UgoyoglAgJQSrJCP97ovBA8YIEQ2-uI68,762..cryptography/__pycache__/__about__.cpython-312.pyc,,..cryptography/__pycache__/__init__.cpython-312

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\cryptography-44.0.0.dist-info\WHEEL

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):94
                                                                                                                                                                                                        Entropy (8bit):5.0373614967294325
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3:RtEeX5pG6vhP+tkKciH/KQb:RtvoKWKTQb
                                                                                                                                                                                                        MD5:A868F93FCF51C4F1C25658D54F994349
                                                                                                                                                                                                        SHA1:535C88A10911673DEABB7889D365E81729E483A6
                                                                                                                                                                                                        SHA-256:1E7F5BCAD669386A11E8CE14E715131C2D402693C3F41D713EB338493C658C45
                                                                                                                                                                                                        SHA-512:EC13CAC9DF03676640EF5DA033E8C2FAEE63916F27CC27B9C43F0824B98AB4A6ECB4C8D7D039FA6674EF189BDD9265C8ED509C1D80DFF610AEB9E081093AEB3D
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:Wheel-Version: 1.0.Generator: maturin (1.7.5).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\cryptography-44.0.0.dist-info\licenses\LICENSE

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):197
                                                                                                                                                                                                        Entropy (8bit):4.61968998873571
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
                                                                                                                                                                                                        MD5:8C3617DB4FB6FAE01F1D253AB91511E4
                                                                                                                                                                                                        SHA1:E442040C26CD76D1B946822CAF29011A51F75D6D
                                                                                                                                                                                                        SHA-256:3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
                                                                                                                                                                                                        SHA-512:77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:This software is made available under the terms of *either* of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of *both* these licenses..

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\cryptography-44.0.0.dist-info\licenses\LICENSE.APACHE

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):11360
                                                                                                                                                                                                        Entropy (8bit):4.426756947907149
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
                                                                                                                                                                                                        MD5:4E168CCE331E5C827D4C2B68A6200E1B
                                                                                                                                                                                                        SHA1:DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
                                                                                                                                                                                                        SHA-256:AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
                                                                                                                                                                                                        SHA-512:F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\cryptography-44.0.0.dist-info\licenses\LICENSE.BSD

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):1532
                                                                                                                                                                                                        Entropy (8bit):5.058591167088024
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
                                                                                                                                                                                                        MD5:5AE30BA4123BC4F2FA49AA0B0DCE887B
                                                                                                                                                                                                        SHA1:EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
                                                                                                                                                                                                        SHA-256:602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
                                                                                                                                                                                                        SHA-512:DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\cryptography\hazmat\bindings\_rust.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):8292864
                                                                                                                                                                                                        Entropy (8bit):6.493076254122072
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:98304:Y4sf3zg+qUuQdPJMqYLSxuBLZqwt0kDO+5+O:cdeqYLSxuBLZrGjq+
                                                                                                                                                                                                        MD5:34293B976DA366D83C12D8EE05DE7B03
                                                                                                                                                                                                        SHA1:82B8EB434C26FCC3A5D9673C9B93663C0FF9BF15
                                                                                                                                                                                                        SHA-256:A2285C3F2F7E63BA8A17AB5D0A302740E6ADF7E608E0707A7737C1EC3BD8CECC
                                                                                                                                                                                                        SHA-512:0807EC7515186F0A989BB667150A84FF3BEBCC248625597BA0BE3C6F07AD60D70CF8A3F65191436EC16042F446D4248BF92FCD02212E459405948DB10F078B8E
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y.j...j...j....F..j.......j.......j.......j.......j.......j.......j...j...h.......i...j...j.......j.......j..Rich.j..........................PE..d....^Gg.........." ...*.R\..n"......~Z.......................................~...........`...........................................x.X.....x...............y...............~.......o.T.....................o.(...p.o.@............p\.8............................text....Q\......R\................. ..`.rdata..P9...p\..:...V\.............@..@.data... >....x.......x.............@....pdata........y.......y.............@..@.reloc........~.......}.............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\frozenlist\_frozenlist.cp312-win_amd64.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):87040
                                                                                                                                                                                                        Entropy (8bit):5.9471652810047235
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:1536:NIf505ZC316pwJV0Jzn4pyOJ8RMrpLkFb0GZi8fR3px7F:Q66gFlmrpLkFwGTp3pt
                                                                                                                                                                                                        MD5:5A5BD0B8845F5A47ECFC2C55ABE7413C
                                                                                                                                                                                                        SHA1:D4B2E85D30480573FEFBC413C4F7B81FA67115E1
                                                                                                                                                                                                        SHA-256:8BE6E6CC104018C0DC1AE0694330F44B94FABB6C50EEC086373DDF24117D78A7
                                                                                                                                                                                                        SHA-512:B2C24C3C5D59A4987F36DFCF677227C020BB632B7155E99D7405516BD855B03965F3FC3558E8637DA1B4E65E7EF7C5D2EA33B338BAEAE72F62017ED682D19651
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*.5VK.fVK.fVK.f_3DfRK.fF..gTK.f.3.gTK.fF..gUK.fF..g^K.fF..g[K.f...gUK.fVK.f.K.f...gWK.f...gWK.f..(fWK.f...gWK.fRichVK.f........PE..d.....g.........." ...).....v............................................................`..........................................7..h...x7..x............p..(....................&..............................P%..@...............@............................text............................... ..`.rdata...J.......L..................@..@.data...h....P.......6..............@....pdata..(....p.......D..............@..@.rsrc................P..............@..@.reloc...............R..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\libcrypto-3.dll

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):5162776
                                                                                                                                                                                                        Entropy (8bit):5.958207976652471
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
                                                                                                                                                                                                        MD5:51E8A5281C2092E45D8C97FBDBF39560
                                                                                                                                                                                                        SHA1:C499C810ED83AAADCE3B267807E593EC6B121211
                                                                                                                                                                                                        SHA-256:2A234B5AA20C3FAECF725BBB54FB33F3D94543F78FA7045408E905593E49960A
                                                                                                                                                                                                        SHA-512:98B91719B0975CB38D3B3C7B6F820D184EF1B64D38AD8515BE0B8B07730E2272376B9E51631FE9EFD9B8A1709FEA214CF3F77B34EEB9FD282EB09E395120E7CB
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./',.kFB.kFB.kFB.b>..yFB..:C.iFB..:G.gFB..:F.cFB..:A.oFB.kFC..FB. >C.`FB.;A.KFB.;F..EB.;B.jFB.;..jFB.;@.jFB.RichkFB.........................PE..d...x..e.........." ...#..6..*......v.........................................O.......O...`.........................................0.G.0.....M.@....0N.|.....K.\.....N../...@N.....PsC.8............................qC.@.............M..............................text...4.6.......6................. ..`.rdata..`.....6.......6.............@..@.data....n....J..<....J.............@....pdata........K.......J.............@..@.idata...%....M..&....M.............@..@.00cfg..u.... N.......M.............@..@.rsrc...|....0N.......M.............@..@.reloc..k....@N.......M.............@..B................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\libffi-8.dll

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):39696
                                                                                                                                                                                                        Entropy (8bit):6.641880464695502
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
                                                                                                                                                                                                        MD5:0F8E4992CA92BAAF54CC0B43AACCCE21
                                                                                                                                                                                                        SHA1:C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
                                                                                                                                                                                                        SHA-256:EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
                                                                                                                                                                                                        SHA-512:6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\libssl-3.dll

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):790296
                                                                                                                                                                                                        Entropy (8bit):5.607732992846443
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
                                                                                                                                                                                                        MD5:BFC834BB2310DDF01BE9AD9CFF7C2A41
                                                                                                                                                                                                        SHA1:FB1D601B4FCB29FF1B13B0D2ED7119BD0472205C
                                                                                                                                                                                                        SHA-256:41AD1A04CA27A7959579E87FBBDA87C93099616A64A0E66260C983381C5570D1
                                                                                                                                                                                                        SHA-512:6AF473C7C0997F2847EBE7CEE8EF67CD682DEE41720D4F268964330B449BA71398FDA8954524F9A97CC4CDF9893B8BDC7A1CF40E9E45A73F4F35A37F31C6A9C3
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T..T..T..].3.Z....V......V....X....\....P....W..T..I....e....U.._.U....U..RichT..........PE..d......e.........." ...#.6..........K........................................0.......w....`..........................................w...Q..............s.... ..pM......./......`... ...8...............................@............................................text....4.......6.................. ..`.rdata...y...P...z...:..............@..@.data....N.......H..................@....pdata..XV... ...X..................@..@.idata..bc.......d...T..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..?...........................@..B................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\multidict\_multidict.cp312-win_amd64.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):46592
                                                                                                                                                                                                        Entropy (8bit):5.417086235508803
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:768:67CE1/NMVzMoCQVbrw0k6To3OOG/B+jPSrSRNj4bSM2V:QruzMoNrNTo3OOG/eRF4be
                                                                                                                                                                                                        MD5:4EED96BBB1C4B6D63F50C433E9C0A16A
                                                                                                                                                                                                        SHA1:CDE34E8F1DAC7F4E98D2B0AAF1186C6938DE06C3
                                                                                                                                                                                                        SHA-256:B521B7E3B6BED424A0719C36735BC4BF2BB8B0926370B31C221C604E81F8D78B
                                                                                                                                                                                                        SHA-512:1CACB250D867FCBBC5224C3F66CB23A93F818BC1D0524CAD6D1C52295D243AF10F454FDE13FA58671D3EE62281A2A3F71A69F28B08FD942FCEDBA3C9B09A774A
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v`.2...2...2...;y..0..."...0...yy..0..."...1..."...:..."...9...!...1...2...G...z...3...z...3...z.s.3...z...3...Rich2...................PE..d....}.f.........." ...).\...^...... `....................................................`.............................................d...$...d...............x...............,...................................P...@............p...............................text....[.......\.................. ..`.rdata...+...p...,...`..............@..@.data...."..........................@....pdata..x...........................@..@.rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\propcache\_helpers_c.cp312-win_amd64.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):73728
                                                                                                                                                                                                        Entropy (8bit):5.893653938715821
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:768:+s11wjRRndyww3gZ/RDJutFyX1loDPJfgjsfu4Wk9gqNYQ410ij/5eN+wDmde8VO:T1xgPdQyXDoDA4utk9g1EDmde8VbRA
                                                                                                                                                                                                        MD5:99E89078A7B0CC53096EEB29CB6A0F53
                                                                                                                                                                                                        SHA1:C9EA97566B8DBFB6525B7102AE9AB2DA58EC1E2A
                                                                                                                                                                                                        SHA-256:AA09ADFA72070AF1E151AA6CEB01AD510A29514E68AEE703D57398ECA53397D2
                                                                                                                                                                                                        SHA-512:D6FC565F66011D71D94CE7FFD1BE6CC23749B39DBD346140C07783637B48C11D4061809A513D7263D3F712D83398907955998D11B88A61D5766BE9F00D5BDE06
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r..T6...6...6...?.].4...'d..4...Dc..4...'d..5...'d..>...'d..:...~g..5...6........d..7....d..7....d1.7....d..7...Rich6...........PE..d...B.Lg.........." ...*.....l...... ........................................p............`.............................................d...d...d....P.......@...............`..X...................................p...@............................................text...x........................... ..`.rdata...E.......F..................@..@.data........ ......................@....pdata.......@......................@..@.rsrc........P......................@..@.reloc..X....`......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\pyexpat.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):200472
                                                                                                                                                                                                        Entropy (8bit):6.382659996286758
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3072:mhaQEuYCUDWuc7VmkqrgVrLJEKAAKJadAT0nIgjWdopPb/+mVApIGLhSZ:yaJh6v7VRVrLJEKAABiuXKd4GE
                                                                                                                                                                                                        MD5:F554064233C082F98EF01195693D967D
                                                                                                                                                                                                        SHA1:F191D42807867E0174DDC66D04C45250D9F6561E
                                                                                                                                                                                                        SHA-256:E1D56FFBF5E5FAB481D7A14691481B8FF5D2F4C6BF5D1A4664C832756C5942FE
                                                                                                                                                                                                        SHA-512:3573A226305CEC45333FC4D0E6FC0C3357421AD77CD8A1899C90515994351292EE5D1C445412B5563AA02520736E870A9EE879909CD992F5BE32E877792BDB88
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................g.................................h.......................h.......h.......h.......h.......Rich....................PE..d...Z..e.........." ...#............0...............................................2.....`.............................................P...`............................/..........P4..T............................3..@............ ...............................text.../........................... ..`.rdata..4.... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\python3.dll

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):68376
                                                                                                                                                                                                        Entropy (8bit):6.14883904573939
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:768:3V1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/J:3DmF61JFn+/OipIGL0m7Sy0xG
                                                                                                                                                                                                        MD5:77896345D4E1C406EEFF011F7A920873
                                                                                                                                                                                                        SHA1:EE8CDD531418CFD05C1A6792382D895AC347216F
                                                                                                                                                                                                        SHA-256:1E9224BA7190B6301EF47BEFA8E383D0C55700255D04A36F7DAC88EA9573F2FB
                                                                                                                                                                                                        SHA-512:3E98B1B605D70244B42A13A219F9E124944DA199A88AD4302308C801685B0C45A037A76DED319D08DBF55639591404665BEFE2091F0F4206A9472FEE58D55C22
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."e.."e.."e.0_m.."e.0_e.."e.0_..."e.0_g.."e.Rich."e.................PE..d...@..e.........." ...#............................................................q.....`.........................................`...H................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\python312.dll

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):6972184
                                                                                                                                                                                                        Entropy (8bit):5.774196030396665
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:98304:B6vwRS7fYzmSSVlLWyJVT7OQvxHDMiEPlk:8vwRHTSVlfJVmir
                                                                                                                                                                                                        MD5:5C5602CDA7AB8418420F223366FFF5DB
                                                                                                                                                                                                        SHA1:52F81EE0AEF9B6906F7751FD2BBD4953E3F3B798
                                                                                                                                                                                                        SHA-256:E7890E38256F04EE0B55AC5276BBF3AC61392C3A3CE150BB5497B709803E17CE
                                                                                                                                                                                                        SHA-512:51C3B4F29781BB52C137DDB356E1BC5A37F3A25F0ED7D89416B14ED994121F884CB3E40CCDBB211A8989E3BD137B8DF8B28E232F98DE8F35B03965CFCE4B424F
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................m.................x...s...x......x......x......Rich............PE..d...=..e.........." ...#..(..6B.....l........................................@k.......k...`......................................... .O.......O.......i......``..V...4j../....i..X.. I3.T....................7I.(....G3.@.............(..............................text...V.(.......(................. ..`.rdata...A'...(..B'...(.............@..@.data....4... P..x....O.............@....pdata...V...``..X...v_.............@..@PyRuntim......b.......a.............@....rsrc.........i.......h.............@..@.reloc...X....i..Z....h.............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\select.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):31000
                                                                                                                                                                                                        Entropy (8bit):6.531624163477087
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:768:s7ENJKHq1vv38pIGQGE5YiSyvTcAMxkEMrX:s7ENJKK1vv38pIGQGO7Syb6xuX
                                                                                                                                                                                                        MD5:BFFFF83A000BAF559F3EB2B599A1B7E8
                                                                                                                                                                                                        SHA1:7F9238BDA6D0C7CC5399C6B6AB3B42D21053F467
                                                                                                                                                                                                        SHA-256:BC71FBDFD1441D62DD86D33FF41B35DC3CC34875F625D885C58C8DC000064DAB
                                                                                                                                                                                                        SHA-512:3C0BA0CF356A727066AE0D0D6523440A882AAFB3EBDF70117993EFFD61395DEEBF179948F8C7F5222D59D1ED748C71D9D53782E16BD2F2ECCC296F2F8B4FC948
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t.q|'.q|'.q|'...'.q|'q.}&.q|'q.y&.q|'q.x&.q|'q..&.q|'..}&.q|'.q}'.q|'..}&.q|'..q&.q|'..|&.q|'...'.q|'..~&.q|'Rich.q|'........PE..d...Z..e.........." ...#.....2............................................................`..........................................@..L...,A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text...v........................... ..`.rdata.......0......................@..@.data........P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                        Entropy (8bit):1.5
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3:Mn:M
                                                                                                                                                                                                        MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                        SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                        SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                        SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:pip.

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\LICENSE

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):11358
                                                                                                                                                                                                        Entropy (8bit):4.4267168336581415
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
                                                                                                                                                                                                        MD5:3B83EF96387F14655FC854DDC3C6BD57
                                                                                                                                                                                                        SHA1:2B8B815229AA8A61E483FB4BA0588B8B6C491890
                                                                                                                                                                                                        SHA-256:CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
                                                                                                                                                                                                        SHA-512:98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\METADATA

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):4648
                                                                                                                                                                                                        Entropy (8bit):5.006900644756252
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:96:Dx2ZSaCSmS8R902Vpnu386eLQ9Ac+fFZpDN00x2jZ2SBXZJSwTE:9Smzf02Vpnu386mQ9B+TP0vJHJSwTE
                                                                                                                                                                                                        MD5:98ABEAACC0E0E4FC385DFF67B607071A
                                                                                                                                                                                                        SHA1:E8C830D8B0942300C7C87B3B8FD15EA1396E07BD
                                                                                                                                                                                                        SHA-256:6A7B90EFFEE1E09D5B484CDF7232016A43E2D9CC9543BCBB8E494B1EC05E1F59
                                                                                                                                                                                                        SHA-512:F1D59046FFA5B0083A5259CEB03219CCDB8CC6AAC6247250CBD83E70F080784391FCC303F7630E1AD40E5CCF5041A57CB9B68ADEFEC1EBC6C31FCF7FFC65E9B7
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:Metadata-Version: 2.1.Name: importlib_metadata.Version: 8.0.0.Summary: Read metadata from Python packages.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/python/importlib_metadata.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: zipp >=0.5.Requires-Dist: typing-extensions >=3.6.4 ; python_version < "3.8".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: perf.Requires-D

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\RECORD

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):2518
                                                                                                                                                                                                        Entropy (8bit):5.6307766747793275
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:48:UnuXTg06U5J/Vw9l/gfNX7/XzBk9pvJq/fwJOfYrBfnJ/V0XJnzN/3WJV:bXzP/EgdzzBkDJsoIYrBfJ/CXNz9qV
                                                                                                                                                                                                        MD5:EB513CAFA5226DDA7D54AFDCC9AD8A74
                                                                                                                                                                                                        SHA1:B394C7AEC158350BAF676AE3197BEF4D7158B31C
                                                                                                                                                                                                        SHA-256:0D8D3C6EEB9EBBE86CAC7D60861552433C329DA9EA51248B61D02BE2E5E64030
                                                                                                                                                                                                        SHA-512:A0017CFAFF47FDA6067E3C31775FACEE4728C3220C2D4BD70DEF328BD20AA71A343E39DA15CD6B406F62311894C518DFCF5C8A4AE6F853946F26A4B4E767924E
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:importlib_metadata-8.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_metadata-8.0.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_metadata-8.0.0.dist-info/METADATA,sha256=anuQ7_7h4J1bSEzfcjIBakPi2cyVQ7y7jklLHsBeH1k,4648..importlib_metadata-8.0.0.dist-info/RECORD,,..importlib_metadata-8.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_metadata-8.0.0.dist-info/WHEEL,sha256=mguMlWGMX-VHnMpKOjjQidIo1ssRlCFu4a4mBpz1s2M,91..importlib_metadata-8.0.0.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19..importlib_metadata/__init__.py,sha256=tZNB-23h8Bixi9uCrQqj9Yf0aeC--Josdy3IZRIQeB0,33798..importlib_metadata/__pycache__/__init__.cpython-312.pyc,,..importlib_metadata/__pycache__/_adapters.cpython-312.pyc,,..importlib_metadata/__pycache__/_collections.cpython-312.pyc,,..importlib_metadata/__pycache__/_compat.cpython-312.pyc,,..importlib_metadata/__pycac

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\WHEEL

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):91
                                                                                                                                                                                                        Entropy (8bit):4.687870576189661
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3:RtEeXMRYFAVLMvhRRP+tPCCfA5S:RtC1VLMvhjWBBf
                                                                                                                                                                                                        MD5:7D09837492494019EA51F4E97823D79F
                                                                                                                                                                                                        SHA1:7829B4324BB542799494131A270EC3BDAD4DEDEF
                                                                                                                                                                                                        SHA-256:9A0B8C95618C5FE5479CCA4A3A38D089D228D6CB1194216EE1AE26069CF5B363
                                                                                                                                                                                                        SHA-512:A0063220ECDD22C3E735ACFF6DE559ACF3AC4C37B81D37633975A22A28B026F1935CD1957C0FF7D2ECC8B7F83F250310795EECC5273B893FFAB115098F7B9C38
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:Wheel-Version: 1.0.Generator: setuptools (70.1.1).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):19
                                                                                                                                                                                                        Entropy (8bit):3.536886723742169
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3:JSej0EBERG:50o4G
                                                                                                                                                                                                        MD5:A24465F7850BA59507BF86D89165525C
                                                                                                                                                                                                        SHA1:4E61F9264DE74783B5924249BCFE1B06F178B9AD
                                                                                                                                                                                                        SHA-256:08EDDF0FDCB29403625E4ACCA38A872D5FE6A972F6B02E4914A82DD725804FE0
                                                                                                                                                                                                        SHA-512:ECF1F6B777970F5257BDDD353305447083008CEBD8E5A27C3D1DA9C7BDC3F9BF3ABD6881265906D6D5E11992653185C04A522F4DB5655FF75EEDB766F93D5D48
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:importlib_metadata.

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:ASCII text, with very long lines (888)
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):1335
                                                                                                                                                                                                        Entropy (8bit):4.226823573023539
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:24:FP6Hbz+g9RPZ14bJi04L6GEbX4UQF4UkZQhxI2EIhNyu:9E+i6bJmLm43+Uxxnh0u
                                                                                                                                                                                                        MD5:4CE7501F6608F6CE4011D627979E1AE4
                                                                                                                                                                                                        SHA1:78363672264D9CD3F72D5C1D3665E1657B1A5071
                                                                                                                                                                                                        SHA-256:37FEDCFFBF73C4EB9F058F47677CB33203A436FF9390E4D38A8E01C9DAD28E0B
                                                                                                                                                                                                        SHA-512:A4CDF92725E1D740758DA4DD28DF5D1131F70CEF46946B173FE6956CC0341F019D7C4FECC3C9605F354E1308858721DADA825B4C19F59C5AD1CE01AB84C46B24
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum..Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris. Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor. Ut ullamcorper, ligula eu tempor congue, eros est euismod turpis, id tincidunt sapien risus a quam. Maecenas fermentum consequat mi. Donec fermentum. Pellentesque malesuada nulla a mi. Duis sapien sem, aliquet nec, commodo eget, consequat quis, neque.

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                        Entropy (8bit):1.5
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3:Mn:M
                                                                                                                                                                                                        MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                        SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                        SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                        SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:pip.

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):1107
                                                                                                                                                                                                        Entropy (8bit):5.115074330424529
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
                                                                                                                                                                                                        MD5:7FFB0DB04527CFE380E4F2726BD05EBF
                                                                                                                                                                                                        SHA1:5B39C45A91A556E5F1599604F1799E4027FA0E60
                                                                                                                                                                                                        SHA-256:30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
                                                                                                                                                                                                        SHA-512:205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\wheel-0.43.0.dist-info\METADATA

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):2153
                                                                                                                                                                                                        Entropy (8bit):5.088249746074878
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
                                                                                                                                                                                                        MD5:EBEA27DA14E3F453119DC72D84343E8C
                                                                                                                                                                                                        SHA1:7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
                                                                                                                                                                                                        SHA-256:59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
                                                                                                                                                                                                        SHA-512:A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\wheel-0.43.0.dist-info\RECORD

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):4557
                                                                                                                                                                                                        Entropy (8bit):5.714200636114494
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
                                                                                                                                                                                                        MD5:44D352C4997560C7BFB82D9360F5985A
                                                                                                                                                                                                        SHA1:BE58C7B8AB32790384E4E4F20865C4A88414B67A
                                                                                                                                                                                                        SHA-256:783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
                                                                                                                                                                                                        SHA-512:281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\wheel-0.43.0.dist-info\WHEEL

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):81
                                                                                                                                                                                                        Entropy (8bit):4.672346887071811
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
                                                                                                                                                                                                        MD5:24019423EA7C0C2DF41C8272A3791E7B
                                                                                                                                                                                                        SHA1:AAE9ECFB44813B68CA525BA7FA0D988615399C86
                                                                                                                                                                                                        SHA-256:1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
                                                                                                                                                                                                        SHA-512:09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\setuptools\_vendor\wheel-0.43.0.dist-info\entry_points.txt

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):104
                                                                                                                                                                                                        Entropy (8bit):4.271713330022269
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
                                                                                                                                                                                                        MD5:6180E17C30BAE5B30DB371793FCE0085
                                                                                                                                                                                                        SHA1:E3A12C421562A77D90A13D8539A3A0F4D3228359
                                                                                                                                                                                                        SHA-256:AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
                                                                                                                                                                                                        SHA-512:69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\sqlite3.dll

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):1504024
                                                                                                                                                                                                        Entropy (8bit):6.578874733366613
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:24576:95WQyUuqjJVKMXijWRwtHHofIyEcL/2m75i5zxHWc9C08lY8ore60hH:9b0yVKMyjWR6nofQm7U59HWKYY8
                                                                                                                                                                                                        MD5:82EA0259009FF75BBA817BD8C15C7588
                                                                                                                                                                                                        SHA1:04C49687D8241B43AE61A6C59299255EF09A7B39
                                                                                                                                                                                                        SHA-256:8AA8B909A39FCC33D1EC2AD51EAC6714A318C6EFD04F963D21B75D8F64809AD6
                                                                                                                                                                                                        SHA-512:1F8B3343898462E385D25E1820A3D7D971D633933E482EA9FFC596E7E1F902F5657A9F2C104CF320EEEF34CCE814261304E2E1C063BE4C6A807ADC9B75F3E670
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W..W..W..^.P.[....U....Z...._.....S.....T..W........V.....V....<.V......V..RichW..........................PE..d......e.........." ...#..................................................................`.........................................Px...".............................../...........*..T............................(..@...............8............................text............................... ..`.rdata..............................@..@.data...PG.......>..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\unicodedata.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):1137944
                                                                                                                                                                                                        Entropy (8bit):5.462221778372869
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:12288:IFrEHdcM6hbZCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfctZq:IFrEXcCjfk7bPNfv42BN6yzUtZq
                                                                                                                                                                                                        MD5:A1388676824CE6347D31D6C6A7A1D1B5
                                                                                                                                                                                                        SHA1:27DD45A5C9B7E61BB894F13193212C6D5668085B
                                                                                                                                                                                                        SHA-256:2480A78815F619A631210E577E733C9BAFECB7F608042E979423C5850EE390FF
                                                                                                                                                                                                        SHA-512:26EA1B33F14F08BB91027E0D35AC03F6203B4DFEEE602BB592C5292AB089B27FF6922DA2804A9E8A28E47D4351B32CF93445D894F00B4AD6E2D0C35C6C7F1D89
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w...3m..3m..3m..:...5m......1m......>m......;m......0m......0m..x...1m..3m..cm......2m......2m....j.2m......2m..Rich3m..................PE..d...]..e.........." ...#.>..........`*.......................................p.......%....`.........................................p...X............P.......@.........../...`......P^..T............................]..@............P..p............................text....=.......>.................. ..`.rdata..\....P.......B..............@..@.data...X.... ......................@....pdata.......@......................@..@.rsrc........P......."..............@..@.reloc.......`.......,..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI42042\yarl\_quoting_c.cp312-win_amd64.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):97280
                                                                                                                                                                                                        Entropy (8bit):6.009351293579179
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:1536:3A6zeuPEpCbl4DlaAw/AlDNTXBUhF5dYLprRD0PcpgpPmlK:3A6jPEUbOwajI5dsOPcpgpPe
                                                                                                                                                                                                        MD5:EA44DB84EB5858D4579FCB071D4DE2F6
                                                                                                                                                                                                        SHA1:1677D7D95FB7DD34B108787120ADEBE588D24B76
                                                                                                                                                                                                        SHA-256:8011CDA4DD0E7C591C82D91243B6A8EDFC4D95056E99BD123ADE9CF02D76E32D
                                                                                                                                                                                                        SHA-512:E0FE02FDB3A645A232537FCC04427345B2532E489F5AA6AA59BCF03E98A038FABA5A2F2F5F89C3190C6371A4B8D56C52962DA826DF0753CAF875475BFB97AA8E
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........]..............*.........................................................^.....................F.............Rich............................PE..d.....Lg.........." ...*..................................................................`.........................................0X..d....X..x...............................,...0H...............................F..@............ ...............................text............................... ..`.rdata...M... ...N..................@..@.data....6...p.......`..............@....pdata...............l..............@..@.rsrc................x..............@..@.reloc..,............z..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                        Static File Info

                                                                                                                                                                                                        General

                                                                                                                                                                                                        File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Entropy (8bit):7.992725781649403
                                                                                                                                                                                                        TrID:
                                                                                                                                                                                                        • Win64 Executable GUI (202006/5) 92.65%
                                                                                                                                                                                                        • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                        • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                        • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                        File name:qhos.exe
                                                                                                                                                                                                        File size:15'717'053 bytes
                                                                                                                                                                                                        MD5:b9e7c2155c65081c5fae1a33bc55efef
                                                                                                                                                                                                        SHA1:1d94d24217e44aca4549d67e340e4a79ebb2dc77
                                                                                                                                                                                                        SHA256:d3ce2fa0dbe4469c93aef6210dc08771c4f06a77ec09a522f1b3773d55d70eab
                                                                                                                                                                                                        SHA512:eb201810d6b8b6f28dd7ff409b2de5a53eb94f16bcf306bb85b67df231d6ca31e548f18a9e2789b34522d59572a8e276bb0066c7741b6665d3f75ce77adc23b2
                                                                                                                                                                                                        SSDEEP:393216:n4uIwq3Obs2ClIW+eGQRH9joGBGc0L2eQnM:nRIwq3ObRqIW+e5RH9MpQnM
                                                                                                                                                                                                        TLSH:C9F63350E0D4ACD6CBB6563EAEA58141E6A3BF520B3CCA4B5B70B5470AB31C1587EF0D
                                                                                                                                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d..

                                                                                                                                                                                                        File Icon

                                                                                                                                                                                                        Icon Hash:1262a1a0aa92aa8a

                                                                                                                                                                                                        Static PE Info

                                                                                                                                                                                                        General

                                                                                                                                                                                                        Entrypoint:0x14000ce20
                                                                                                                                                                                                        Entrypoint Section:.text
                                                                                                                                                                                                        Digitally signed:false
                                                                                                                                                                                                        Imagebase:0x140000000
                                                                                                                                                                                                        Subsystem:windows gui
                                                                                                                                                                                                        Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                        DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                        Time Stamp:0x6755E55F [Sun Dec 8 18:28:47 2024 UTC]
                                                                                                                                                                                                        TLS Callbacks:
                                                                                                                                                                                                        CLR (.Net) Version:
                                                                                                                                                                                                        OS Version Major:6
                                                                                                                                                                                                        OS Version Minor:0
                                                                                                                                                                                                        File Version Major:6
                                                                                                                                                                                                        File Version Minor:0
                                                                                                                                                                                                        Subsystem Version Major:6
                                                                                                                                                                                                        Subsystem Version Minor:0
                                                                                                                                                                                                        Import Hash:72c4e339b7af8ab1ed2eb3821c98713a

                                                                                                                                                                                                        Entrypoint Preview

                                                                                                                                                                                                        Instruction
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        sub esp, 28h
                                                                                                                                                                                                        call 00007F19807EDABCh
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        add esp, 28h
                                                                                                                                                                                                        jmp 00007F19807ED6DFh
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        sub esp, 28h
                                                                                                                                                                                                        call 00007F19807EDE88h
                                                                                                                                                                                                        test eax, eax
                                                                                                                                                                                                        je 00007F19807ED883h
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        mov eax, dword ptr [00000030h]
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                                        jmp 00007F19807ED867h
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        cmp ecx, eax
                                                                                                                                                                                                        je 00007F19807ED876h
                                                                                                                                                                                                        xor eax, eax
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        cmpxchg dword ptr [0003570Ch], ecx
                                                                                                                                                                                                        jne 00007F19807ED850h
                                                                                                                                                                                                        xor al, al
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        add esp, 28h
                                                                                                                                                                                                        ret
                                                                                                                                                                                                        mov al, 01h
                                                                                                                                                                                                        jmp 00007F19807ED859h
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        sub esp, 28h
                                                                                                                                                                                                        test ecx, ecx
                                                                                                                                                                                                        jne 00007F19807ED869h
                                                                                                                                                                                                        mov byte ptr [000356F5h], 00000001h
                                                                                                                                                                                                        call 00007F19807ECFB5h
                                                                                                                                                                                                        call 00007F19807EE2A0h
                                                                                                                                                                                                        test al, al
                                                                                                                                                                                                        jne 00007F19807ED866h
                                                                                                                                                                                                        xor al, al
                                                                                                                                                                                                        jmp 00007F19807ED876h
                                                                                                                                                                                                        call 00007F19807FADBFh
                                                                                                                                                                                                        test al, al
                                                                                                                                                                                                        jne 00007F19807ED86Bh
                                                                                                                                                                                                        xor ecx, ecx
                                                                                                                                                                                                        call 00007F19807EE2B0h
                                                                                                                                                                                                        jmp 00007F19807ED84Ch
                                                                                                                                                                                                        mov al, 01h
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        add esp, 28h
                                                                                                                                                                                                        ret
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        inc eax
                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        sub esp, 20h
                                                                                                                                                                                                        cmp byte ptr [000356BCh], 00000000h
                                                                                                                                                                                                        mov ebx, ecx
                                                                                                                                                                                                        jne 00007F19807ED8C9h
                                                                                                                                                                                                        cmp ecx, 01h
                                                                                                                                                                                                        jnbe 00007F19807ED8CCh
                                                                                                                                                                                                        call 00007F19807EDDFEh
                                                                                                                                                                                                        test eax, eax
                                                                                                                                                                                                        je 00007F19807ED88Ah
                                                                                                                                                                                                        test ebx, ebx
                                                                                                                                                                                                        jne 00007F19807ED886h
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        lea ecx, dword ptr [000356A6h]
                                                                                                                                                                                                        call 00007F19807FABB2h

                                                                                                                                                                                                        Data Directories

                                                                                                                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x3ca340x78.rdata
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x470000x19a1c.rsrc
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x440000x2238.pdata
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x610000x764.reloc
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x3a0800x1c.rdata
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x39f400x140.rdata
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x2b0000x4a0.rdata
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                        Sections

                                                                                                                                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                        .text0x10000x29f700x2a000b8c3814c5fb0b18492ad4ec2ffe0830aFalse0.5518740699404762data6.489205819736506IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                        .rdata0x2b0000x12a280x12c0078c5cabbf77993daf011adb1fcabcd33False0.5242838541666667data5.750769769311862IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                        .data0x3e0000x53f80xe00dba0caeecab624a0ccc0d577241601d1False0.134765625data1.8392217063172436IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                        .pdata0x440000x22380x24009cd1eac931545f28ab09329f8bfce843False0.4697265625data5.2645170849678795IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                        .rsrc0x470000x19a1c0x19c0035db13bd970349e79d066a52e38a415aFalse0.07967991504854369data3.7032712285528175IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                        .reloc0x610000x7640x800816c68eeb419ee2c08656c31c06a0fffFalse0.5576171875data5.2809528666624175IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                        Resources

                                                                                                                                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                        RT_ICON0x471d80xdcfPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.925035360678925
                                                                                                                                                                                                        RT_ICON0x47fa80x10828Device independent bitmap graphic, 128 x 256 x 32, image size 655360.02200402224062463
                                                                                                                                                                                                        RT_ICON0x587d00x4228Device independent bitmap graphic, 64 x 128 x 32, image size 163840.05402692489371753
                                                                                                                                                                                                        RT_ICON0x5c9f80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 92160.0766597510373444
                                                                                                                                                                                                        RT_ICON0x5efa00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 40960.12781425891181988
                                                                                                                                                                                                        RT_ICON0x600480x468Device independent bitmap graphic, 16 x 32 x 32, image size 10240.28102836879432624
                                                                                                                                                                                                        RT_GROUP_ICON0x604b00x5adata0.7666666666666667
                                                                                                                                                                                                        RT_MANIFEST0x6050c0x50dXML 1.0 document, ASCII text0.4694508894044857

                                                                                                                                                                                                        Imports

                                                                                                                                                                                                        DLLImport
                                                                                                                                                                                                        USER32.dllCreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                                                                                                                                                                                        COMCTL32.dll
                                                                                                                                                                                                        KERNEL32.dllGetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
                                                                                                                                                                                                        ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                                                                                                                                                                                        GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                                                                                                                                                                                                        Network Behavior

                                                                                                                                                                                                        ⊘No network behavior found

                                                                                                                                                                                                        Statistics

                                                                                                                                                                                                        CPU Usage

                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                        Memory Usage

                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                        High Level Behavior Distribution

                                                                                                                                                                                                        Click to dive into process behavior distribution

                                                                                                                                                                                                        Behavior

                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                        System Behavior

                                                                                                                                                                                                        General

                                                                                                                                                                                                        Target ID:0
                                                                                                                                                                                                        Start time:02:42:55
                                                                                                                                                                                                        Start date:13/12/2024
                                                                                                                                                                                                        Path:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\qhos.exe"
                                                                                                                                                                                                        Imagebase:0x7ff646ab0000
                                                                                                                                                                                                        File size:15'717'053 bytes
                                                                                                                                                                                                        MD5 hash:B9E7C2155C65081C5FAE1A33BC55EFEF
                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                        General

                                                                                                                                                                                                        Target ID:2
                                                                                                                                                                                                        Start time:02:42:58
                                                                                                                                                                                                        Start date:13/12/2024
                                                                                                                                                                                                        Path:C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\qhos.exe"
                                                                                                                                                                                                        Imagebase:0x7ff646ab0000
                                                                                                                                                                                                        File size:15'717'053 bytes
                                                                                                                                                                                                        MD5 hash:B9E7C2155C65081C5FAE1A33BC55EFEF
                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                        • Rule: JoeSecurity_MuckStealer, Description: Yara detected Muck Stealer, Source: 00000002.00000003.2224536608.00000161398B8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_MuckStealer, Description: Yara detected Muck Stealer, Source: 00000002.00000003.2225574398.00000161385B4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_MuckStealer, Description: Yara detected Muck Stealer, Source: 00000002.00000003.2167476534.000001613992D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_MuckStealer, Description: Yara detected Muck Stealer, Source: 00000002.00000002.2247890897.000001613A4A4000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_MuckStealer, Description: Yara detected Muck Stealer, Source: 00000002.00000003.2223814087.0000016139961000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_MuckStealer, Description: Yara detected Muck Stealer, Source: 00000002.00000003.2227740468.0000016138688000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_MuckStealer, Description: Yara detected Muck Stealer, Source: 00000002.00000003.2231057854.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_MuckStealer, Description: Yara detected Muck Stealer, Source: 00000002.00000003.2231782577.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_MuckStealer, Description: Yara detected Muck Stealer, Source: 00000002.00000003.2227566885.000001613864E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_MuckStealer, Description: Yara detected Muck Stealer, Source: 00000002.00000003.2229184929.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_MuckStealer, Description: Yara detected Muck Stealer, Source: 00000002.00000003.2229704914.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_MuckStealer, Description: Yara detected Muck Stealer, Source: 00000002.00000003.2228048852.00000161386D7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_MuckStealer, Description: Yara detected Muck Stealer, Source: 00000002.00000002.2244466649.00000161386D8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_MuckStealer, Description: Yara detected Muck Stealer, Source: 00000002.00000003.2227792101.00000161386CA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_MuckStealer, Description: Yara detected Muck Stealer, Source: 00000002.00000002.2247145926.00000161398E3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_MuckStealer, Description: Yara detected Muck Stealer, Source: 00000002.00000003.2225094216.000001613858F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_MuckStealer, Description: Yara detected Muck Stealer, Source: 00000002.00000003.2226223735.00000161398D2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                        Disassembly

                                                                                                                                                                                                        Reset < >

                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                          Execution Coverage:10.3%
                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                          Signature Coverage:19.6%
                                                                                                                                                                                                          Total number of Nodes:2000
                                                                                                                                                                                                          Total number of Limit Nodes:41
                                                                                                                                                                                                          execution_graph 20462 7ff646adae6e 20463 7ff646adae7d 20462->20463 20464 7ff646adae87 20462->20464 20466 7ff646ad03a8 LeaveCriticalSection 20463->20466 19674 7ff646adadd9 19677 7ff646ac54e8 LeaveCriticalSection 19674->19677 20468 7ff646adac53 20469 7ff646adac63 20468->20469 20472 7ff646ac54e8 LeaveCriticalSection 20469->20472 15937 7ff646abbb50 15938 7ff646abbb7e 15937->15938 15939 7ff646abbb65 15937->15939 15939->15938 15942 7ff646acd66c 15939->15942 15943 7ff646acd6b7 15942->15943 15947 7ff646acd67b _set_fmode 15942->15947 15952 7ff646ac4f78 15943->15952 15945 7ff646acd69e HeapAlloc 15946 7ff646abbbde 15945->15946 15945->15947 15947->15943 15947->15945 15949 7ff646ad3600 15947->15949 15955 7ff646ad3640 15949->15955 15961 7ff646acb338 GetLastError 15952->15961 15954 7ff646ac4f81 15954->15946 15960 7ff646ad0348 EnterCriticalSection 15955->15960 15962 7ff646acb379 FlsSetValue 15961->15962 15966 7ff646acb35c 15961->15966 15963 7ff646acb38b 15962->15963 15967 7ff646acb369 SetLastError 15962->15967 15978 7ff646acec08 15963->15978 15966->15962 15966->15967 15967->15954 15969 7ff646acb3b8 FlsSetValue 15972 7ff646acb3c4 FlsSetValue 15969->15972 15973 7ff646acb3d6 15969->15973 15970 7ff646acb3a8 FlsSetValue 15971 7ff646acb3b1 15970->15971 15985 7ff646aca9b8 15971->15985 15972->15971 15991 7ff646acaf64 15973->15991 15979 7ff646acec19 _set_fmode 15978->15979 15980 7ff646acec6a 15979->15980 15981 7ff646acec4e HeapAlloc 15979->15981 15984 7ff646ad3600 _set_fmode 2 API calls 15979->15984 15983 7ff646ac4f78 _set_fmode 10 API calls 15980->15983 15981->15979 15982 7ff646acb39a 15981->15982 15982->15969 15982->15970 15983->15982 15984->15979 15986 7ff646aca9bd RtlFreeHeap 15985->15986 15987 7ff646aca9ec 15985->15987 15986->15987 15988 7ff646aca9d8 GetLastError 15986->15988 15987->15967 15989 7ff646aca9e5 __free_lconv_num 15988->15989 15990 7ff646ac4f78 _set_fmode 9 API calls 15989->15990 15990->15987 15996 7ff646acae3c 15991->15996 16008 7ff646ad0348 EnterCriticalSection 15996->16008 16010 7ff646ac99d1 16022 7ff646aca448 16010->16022 16027 7ff646acb1c0 GetLastError 16022->16027 16028 7ff646acb1e4 FlsGetValue 16027->16028 16029 7ff646acb201 FlsSetValue 16027->16029 16030 7ff646acb1fb 16028->16030 16046 7ff646acb1f1 16028->16046 16031 7ff646acb213 16029->16031 16029->16046 16030->16029 16032 7ff646acec08 _set_fmode 11 API calls 16031->16032 16034 7ff646acb222 16032->16034 16033 7ff646acb26d SetLastError 16035 7ff646aca451 16033->16035 16036 7ff646acb28d 16033->16036 16037 7ff646acb240 FlsSetValue 16034->16037 16038 7ff646acb230 FlsSetValue 16034->16038 16049 7ff646aca574 16035->16049 16039 7ff646aca574 __CxxCallCatchBlock 38 API calls 16036->16039 16042 7ff646acb25e 16037->16042 16043 7ff646acb24c FlsSetValue 16037->16043 16041 7ff646acb239 16038->16041 16040 7ff646acb292 16039->16040 16044 7ff646aca9b8 __free_lconv_num 11 API calls 16041->16044 16045 7ff646acaf64 _set_fmode 11 API calls 16042->16045 16043->16041 16044->16046 16047 7ff646acb266 16045->16047 16046->16033 16048 7ff646aca9b8 __free_lconv_num 11 API calls 16047->16048 16048->16033 16058 7ff646ad36c0 16049->16058 16092 7ff646ad3678 16058->16092 16097 7ff646ad0348 EnterCriticalSection 16092->16097 19708 7ff646abcbc0 19709 7ff646abcbd0 19708->19709 19725 7ff646ac9c18 19709->19725 19711 7ff646abcbdc 19731 7ff646abceb8 19711->19731 19713 7ff646abd19c 7 API calls 19715 7ff646abcc75 19713->19715 19714 7ff646abcbf4 _RTC_Initialize 19723 7ff646abcc49 19714->19723 19736 7ff646abd068 19714->19736 19717 7ff646abcc09 19739 7ff646ac9084 19717->19739 19723->19713 19724 7ff646abcc65 19723->19724 19726 7ff646ac9c29 19725->19726 19727 7ff646ac9c31 19726->19727 19728 7ff646ac4f78 _set_fmode 11 API calls 19726->19728 19727->19711 19729 7ff646ac9c40 19728->19729 19730 7ff646aca950 _invalid_parameter_noinfo 37 API calls 19729->19730 19730->19727 19732 7ff646abcec9 19731->19732 19733 7ff646abcece __scrt_acquire_startup_lock 19731->19733 19732->19733 19734 7ff646abd19c 7 API calls 19732->19734 19733->19714 19735 7ff646abcf42 19734->19735 19764 7ff646abd02c 19736->19764 19738 7ff646abd071 19738->19717 19740 7ff646abcc15 19739->19740 19741 7ff646ac90a4 19739->19741 19740->19723 19763 7ff646abd13c InitializeSListHead 19740->19763 19742 7ff646ac90c2 GetModuleFileNameW 19741->19742 19743 7ff646ac90ac 19741->19743 19747 7ff646ac90ed 19742->19747 19744 7ff646ac4f78 _set_fmode 11 API calls 19743->19744 19745 7ff646ac90b1 19744->19745 19746 7ff646aca950 _invalid_parameter_noinfo 37 API calls 19745->19746 19746->19740 19779 7ff646ac9024 19747->19779 19750 7ff646ac9135 19751 7ff646ac4f78 _set_fmode 11 API calls 19750->19751 19752 7ff646ac913a 19751->19752 19755 7ff646aca9b8 __free_lconv_num 11 API calls 19752->19755 19753 7ff646ac914d 19754 7ff646ac916f 19753->19754 19757 7ff646ac91b4 19753->19757 19758 7ff646ac919b 19753->19758 19756 7ff646aca9b8 __free_lconv_num 11 API calls 19754->19756 19755->19740 19756->19740 19761 7ff646aca9b8 __free_lconv_num 11 API calls 19757->19761 19759 7ff646aca9b8 __free_lconv_num 11 API calls 19758->19759 19760 7ff646ac91a4 19759->19760 19762 7ff646aca9b8 __free_lconv_num 11 API calls 19760->19762 19761->19754 19762->19740 19765 7ff646abd046 19764->19765 19766 7ff646abd03f 19764->19766 19768 7ff646aca25c 19765->19768 19766->19738 19771 7ff646ac9e98 19768->19771 19778 7ff646ad0348 EnterCriticalSection 19771->19778 19780 7ff646ac903c 19779->19780 19781 7ff646ac9074 19779->19781 19780->19781 19782 7ff646acec08 _set_fmode 11 API calls 19780->19782 19781->19750 19781->19753 19783 7ff646ac906a 19782->19783 19784 7ff646aca9b8 __free_lconv_num 11 API calls 19783->19784 19784->19781 19788 7ff646ac9dc0 19791 7ff646ac9d3c 19788->19791 19798 7ff646ad0348 EnterCriticalSection 19791->19798 20473 7ff646acb040 20474 7ff646acb045 20473->20474 20475 7ff646acb05a 20473->20475 20479 7ff646acb060 20474->20479 20480 7ff646acb0a2 20479->20480 20481 7ff646acb0aa 20479->20481 20482 7ff646aca9b8 __free_lconv_num 11 API calls 20480->20482 20483 7ff646aca9b8 __free_lconv_num 11 API calls 20481->20483 20482->20481 20484 7ff646acb0b7 20483->20484 20485 7ff646aca9b8 __free_lconv_num 11 API calls 20484->20485 20486 7ff646acb0c4 20485->20486 20487 7ff646aca9b8 __free_lconv_num 11 API calls 20486->20487 20488 7ff646acb0d1 20487->20488 20489 7ff646aca9b8 __free_lconv_num 11 API calls 20488->20489 20490 7ff646acb0de 20489->20490 20491 7ff646aca9b8 __free_lconv_num 11 API calls 20490->20491 20492 7ff646acb0eb 20491->20492 20493 7ff646aca9b8 __free_lconv_num 11 API calls 20492->20493 20494 7ff646acb0f8 20493->20494 20495 7ff646aca9b8 __free_lconv_num 11 API calls 20494->20495 20496 7ff646acb105 20495->20496 20497 7ff646aca9b8 __free_lconv_num 11 API calls 20496->20497 20498 7ff646acb115 20497->20498 20499 7ff646aca9b8 __free_lconv_num 11 API calls 20498->20499 20500 7ff646acb125 20499->20500 20505 7ff646acaf04 20500->20505 20519 7ff646ad0348 EnterCriticalSection 20505->20519 18927 7ff646ad0938 18928 7ff646ad095c 18927->18928 18931 7ff646ad096c 18927->18931 18929 7ff646ac4f78 _set_fmode 11 API calls 18928->18929 18930 7ff646ad0961 18929->18930 18932 7ff646ad0c4c 18931->18932 18933 7ff646ad098e 18931->18933 18934 7ff646ac4f78 _set_fmode 11 API calls 18932->18934 18935 7ff646ad09af 18933->18935 19058 7ff646ad0ff4 18933->19058 18936 7ff646ad0c51 18934->18936 18939 7ff646ad0a21 18935->18939 18941 7ff646ad09d5 18935->18941 18946 7ff646ad0a15 18935->18946 18938 7ff646aca9b8 __free_lconv_num 11 API calls 18936->18938 18938->18930 18943 7ff646acec08 _set_fmode 11 API calls 18939->18943 18956 7ff646ad09e4 18939->18956 18940 7ff646ad0ace 18951 7ff646ad0aeb 18940->18951 18957 7ff646ad0b3d 18940->18957 19073 7ff646ac9730 18941->19073 18947 7ff646ad0a37 18943->18947 18945 7ff646aca9b8 __free_lconv_num 11 API calls 18945->18930 18946->18940 18946->18956 19079 7ff646ad719c 18946->19079 18952 7ff646aca9b8 __free_lconv_num 11 API calls 18947->18952 18949 7ff646ad09df 18954 7ff646ac4f78 _set_fmode 11 API calls 18949->18954 18950 7ff646ad09fd 18950->18946 18959 7ff646ad0ff4 45 API calls 18950->18959 18955 7ff646aca9b8 __free_lconv_num 11 API calls 18951->18955 18953 7ff646ad0a45 18952->18953 18953->18946 18953->18956 18961 7ff646acec08 _set_fmode 11 API calls 18953->18961 18954->18956 18958 7ff646ad0af4 18955->18958 18956->18945 18957->18956 18960 7ff646ad344c 40 API calls 18957->18960 18972 7ff646ad0af9 18958->18972 19115 7ff646ad344c 18958->19115 18959->18946 18962 7ff646ad0b7a 18960->18962 18963 7ff646ad0a67 18961->18963 18964 7ff646aca9b8 __free_lconv_num 11 API calls 18962->18964 18966 7ff646aca9b8 __free_lconv_num 11 API calls 18963->18966 18967 7ff646ad0b84 18964->18967 18966->18946 18967->18956 18967->18972 18968 7ff646ad0c40 18970 7ff646aca9b8 __free_lconv_num 11 API calls 18968->18970 18969 7ff646ad0b25 18971 7ff646aca9b8 __free_lconv_num 11 API calls 18969->18971 18970->18930 18971->18972 18972->18968 18973 7ff646acec08 _set_fmode 11 API calls 18972->18973 18974 7ff646ad0bc8 18973->18974 18975 7ff646ad0bd0 18974->18975 18976 7ff646ad0bd9 18974->18976 18977 7ff646aca9b8 __free_lconv_num 11 API calls 18975->18977 18978 7ff646aca514 __std_exception_copy 37 API calls 18976->18978 18979 7ff646ad0bd7 18977->18979 18980 7ff646ad0be8 18978->18980 18983 7ff646aca9b8 __free_lconv_num 11 API calls 18979->18983 18981 7ff646ad0bf0 18980->18981 18982 7ff646ad0c7b 18980->18982 19124 7ff646ad72b4 18981->19124 18985 7ff646aca970 _isindst 17 API calls 18982->18985 18983->18930 18986 7ff646ad0c8f 18985->18986 18988 7ff646ad0cb8 18986->18988 18995 7ff646ad0cc8 18986->18995 18991 7ff646ac4f78 _set_fmode 11 API calls 18988->18991 18989 7ff646ad0c17 18993 7ff646ac4f78 _set_fmode 11 API calls 18989->18993 18990 7ff646ad0c38 18992 7ff646aca9b8 __free_lconv_num 11 API calls 18990->18992 19020 7ff646ad0cbd 18991->19020 18992->18968 18994 7ff646ad0c1c 18993->18994 18997 7ff646aca9b8 __free_lconv_num 11 API calls 18994->18997 18996 7ff646ad0fab 18995->18996 18998 7ff646ad0cea 18995->18998 18999 7ff646ac4f78 _set_fmode 11 API calls 18996->18999 18997->18979 19000 7ff646ad0d07 18998->19000 19143 7ff646ad10dc 18998->19143 19001 7ff646ad0fb0 18999->19001 19004 7ff646ad0d7b 19000->19004 19006 7ff646ad0d2f 19000->19006 19014 7ff646ad0d6f 19000->19014 19003 7ff646aca9b8 __free_lconv_num 11 API calls 19001->19003 19003->19020 19009 7ff646ad0da3 19004->19009 19010 7ff646acec08 _set_fmode 11 API calls 19004->19010 19025 7ff646ad0d3e 19004->19025 19005 7ff646ad0e2e 19018 7ff646ad0e4b 19005->19018 19026 7ff646ad0e9e 19005->19026 19158 7ff646ac976c 19006->19158 19012 7ff646acec08 _set_fmode 11 API calls 19009->19012 19009->19014 19009->19025 19015 7ff646ad0d95 19010->19015 19019 7ff646ad0dc5 19012->19019 19013 7ff646aca9b8 __free_lconv_num 11 API calls 19013->19020 19014->19005 19014->19025 19164 7ff646ad705c 19014->19164 19021 7ff646aca9b8 __free_lconv_num 11 API calls 19015->19021 19016 7ff646ad0d57 19016->19014 19028 7ff646ad10dc 45 API calls 19016->19028 19017 7ff646ad0d39 19022 7ff646ac4f78 _set_fmode 11 API calls 19017->19022 19023 7ff646aca9b8 __free_lconv_num 11 API calls 19018->19023 19024 7ff646aca9b8 __free_lconv_num 11 API calls 19019->19024 19021->19009 19022->19025 19027 7ff646ad0e54 19023->19027 19024->19014 19025->19013 19026->19025 19029 7ff646ad344c 40 API calls 19026->19029 19032 7ff646ad344c 40 API calls 19027->19032 19035 7ff646ad0e5a 19027->19035 19028->19014 19030 7ff646ad0edc 19029->19030 19031 7ff646aca9b8 __free_lconv_num 11 API calls 19030->19031 19033 7ff646ad0ee6 19031->19033 19036 7ff646ad0e86 19032->19036 19033->19025 19033->19035 19034 7ff646ad0f9f 19038 7ff646aca9b8 __free_lconv_num 11 API calls 19034->19038 19035->19034 19039 7ff646acec08 _set_fmode 11 API calls 19035->19039 19037 7ff646aca9b8 __free_lconv_num 11 API calls 19036->19037 19037->19035 19038->19020 19040 7ff646ad0f2b 19039->19040 19041 7ff646ad0f33 19040->19041 19042 7ff646ad0f3c 19040->19042 19043 7ff646aca9b8 __free_lconv_num 11 API calls 19041->19043 19044 7ff646ad04e4 37 API calls 19042->19044 19045 7ff646ad0f3a 19043->19045 19046 7ff646ad0f4a 19044->19046 19049 7ff646aca9b8 __free_lconv_num 11 API calls 19045->19049 19047 7ff646ad0f52 SetEnvironmentVariableW 19046->19047 19048 7ff646ad0fdf 19046->19048 19050 7ff646ad0f76 19047->19050 19051 7ff646ad0f97 19047->19051 19052 7ff646aca970 _isindst 17 API calls 19048->19052 19049->19020 19055 7ff646ac4f78 _set_fmode 11 API calls 19050->19055 19054 7ff646aca9b8 __free_lconv_num 11 API calls 19051->19054 19053 7ff646ad0ff3 19052->19053 19054->19034 19056 7ff646ad0f7b 19055->19056 19057 7ff646aca9b8 __free_lconv_num 11 API calls 19056->19057 19057->19045 19059 7ff646ad1011 19058->19059 19060 7ff646ad1029 19058->19060 19059->18935 19061 7ff646acec08 _set_fmode 11 API calls 19060->19061 19066 7ff646ad104d 19061->19066 19062 7ff646ad10ae 19065 7ff646aca9b8 __free_lconv_num 11 API calls 19062->19065 19063 7ff646aca574 __CxxCallCatchBlock 45 API calls 19064 7ff646ad10d8 19063->19064 19065->19059 19066->19062 19067 7ff646acec08 _set_fmode 11 API calls 19066->19067 19068 7ff646aca9b8 __free_lconv_num 11 API calls 19066->19068 19069 7ff646aca514 __std_exception_copy 37 API calls 19066->19069 19070 7ff646ad10bd 19066->19070 19072 7ff646ad10d2 19066->19072 19067->19066 19068->19066 19069->19066 19071 7ff646aca970 _isindst 17 API calls 19070->19071 19071->19072 19072->19063 19074 7ff646ac9740 19073->19074 19076 7ff646ac9749 19073->19076 19074->19076 19188 7ff646ac9208 19074->19188 19076->18949 19076->18950 19080 7ff646ad62c4 19079->19080 19081 7ff646ad71a9 19079->19081 19082 7ff646ad62d1 19080->19082 19088 7ff646ad6307 19080->19088 19083 7ff646ac4fbc 45 API calls 19081->19083 19085 7ff646ac4f78 _set_fmode 11 API calls 19082->19085 19099 7ff646ad6278 19082->19099 19084 7ff646ad71dd 19083->19084 19089 7ff646ad71e2 19084->19089 19093 7ff646ad71f3 19084->19093 19096 7ff646ad720a 19084->19096 19090 7ff646ad62db 19085->19090 19086 7ff646ad6331 19087 7ff646ac4f78 _set_fmode 11 API calls 19086->19087 19091 7ff646ad6336 19087->19091 19088->19086 19092 7ff646ad6356 19088->19092 19089->18946 19094 7ff646aca950 _invalid_parameter_noinfo 37 API calls 19090->19094 19095 7ff646aca950 _invalid_parameter_noinfo 37 API calls 19091->19095 19100 7ff646ac4fbc 45 API calls 19092->19100 19107 7ff646ad6341 19092->19107 19097 7ff646ac4f78 _set_fmode 11 API calls 19093->19097 19098 7ff646ad62e6 19094->19098 19095->19107 19102 7ff646ad7214 19096->19102 19103 7ff646ad7226 19096->19103 19101 7ff646ad71f8 19097->19101 19098->18946 19099->18946 19100->19107 19108 7ff646aca950 _invalid_parameter_noinfo 37 API calls 19101->19108 19104 7ff646ac4f78 _set_fmode 11 API calls 19102->19104 19105 7ff646ad724e 19103->19105 19106 7ff646ad7237 19103->19106 19109 7ff646ad7219 19104->19109 19430 7ff646ad8fbc 19105->19430 19421 7ff646ad6314 19106->19421 19107->18946 19108->19089 19112 7ff646aca950 _invalid_parameter_noinfo 37 API calls 19109->19112 19112->19089 19114 7ff646ac4f78 _set_fmode 11 API calls 19114->19089 19116 7ff646ad346e 19115->19116 19117 7ff646ad348b 19115->19117 19116->19117 19119 7ff646ad347c 19116->19119 19118 7ff646ad3495 19117->19118 19470 7ff646ad7ca8 19117->19470 19477 7ff646ad7ce4 19118->19477 19121 7ff646ac4f78 _set_fmode 11 API calls 19119->19121 19123 7ff646ad3481 memcpy_s 19121->19123 19123->18969 19125 7ff646ac4fbc 45 API calls 19124->19125 19126 7ff646ad731a 19125->19126 19127 7ff646ad7328 19126->19127 19489 7ff646acef94 19126->19489 19492 7ff646ac551c 19127->19492 19131 7ff646ad7414 19134 7ff646ad7425 19131->19134 19135 7ff646aca9b8 __free_lconv_num 11 API calls 19131->19135 19132 7ff646ac4fbc 45 API calls 19133 7ff646ad7397 19132->19133 19137 7ff646acef94 5 API calls 19133->19137 19140 7ff646ad73a0 19133->19140 19136 7ff646ad0c13 19134->19136 19138 7ff646aca9b8 __free_lconv_num 11 API calls 19134->19138 19135->19134 19136->18989 19136->18990 19137->19140 19138->19136 19139 7ff646ac551c 14 API calls 19141 7ff646ad73fb 19139->19141 19140->19139 19141->19131 19142 7ff646ad7403 SetEnvironmentVariableW 19141->19142 19142->19131 19144 7ff646ad10ff 19143->19144 19145 7ff646ad111c 19143->19145 19144->19000 19146 7ff646acec08 _set_fmode 11 API calls 19145->19146 19153 7ff646ad1140 19146->19153 19147 7ff646ad11c4 19149 7ff646aca574 __CxxCallCatchBlock 45 API calls 19147->19149 19148 7ff646ad11a1 19151 7ff646aca9b8 __free_lconv_num 11 API calls 19148->19151 19150 7ff646ad11ca 19149->19150 19151->19144 19152 7ff646acec08 _set_fmode 11 API calls 19152->19153 19153->19147 19153->19148 19153->19152 19154 7ff646aca9b8 __free_lconv_num 11 API calls 19153->19154 19155 7ff646ad04e4 37 API calls 19153->19155 19156 7ff646ad11b0 19153->19156 19154->19153 19155->19153 19157 7ff646aca970 _isindst 17 API calls 19156->19157 19157->19147 19159 7ff646ac9785 19158->19159 19160 7ff646ac977c 19158->19160 19159->19016 19159->19017 19160->19159 19514 7ff646ac927c 19160->19514 19165 7ff646ad7069 19164->19165 19168 7ff646ad7096 19164->19168 19166 7ff646ad706e 19165->19166 19165->19168 19167 7ff646ac4f78 _set_fmode 11 API calls 19166->19167 19170 7ff646ad7073 19167->19170 19169 7ff646ad70da 19168->19169 19172 7ff646ad70f9 19168->19172 19183 7ff646ad70ce __crtLCMapStringW 19168->19183 19171 7ff646ac4f78 _set_fmode 11 API calls 19169->19171 19173 7ff646aca950 _invalid_parameter_noinfo 37 API calls 19170->19173 19174 7ff646ad70df 19171->19174 19175 7ff646ad7103 19172->19175 19176 7ff646ad7115 19172->19176 19177 7ff646ad707e 19173->19177 19178 7ff646aca950 _invalid_parameter_noinfo 37 API calls 19174->19178 19179 7ff646ac4f78 _set_fmode 11 API calls 19175->19179 19180 7ff646ac4fbc 45 API calls 19176->19180 19177->19014 19178->19183 19182 7ff646ad7108 19179->19182 19181 7ff646ad7122 19180->19181 19181->19183 19561 7ff646ad8b78 19181->19561 19184 7ff646aca950 _invalid_parameter_noinfo 37 API calls 19182->19184 19183->19014 19184->19183 19187 7ff646ac4f78 _set_fmode 11 API calls 19187->19183 19189 7ff646ac9221 19188->19189 19202 7ff646ac921d 19188->19202 19211 7ff646ad2660 19189->19211 19194 7ff646ac9233 19196 7ff646aca9b8 __free_lconv_num 11 API calls 19194->19196 19195 7ff646ac923f 19237 7ff646ac92ec 19195->19237 19196->19202 19199 7ff646aca9b8 __free_lconv_num 11 API calls 19200 7ff646ac9266 19199->19200 19201 7ff646aca9b8 __free_lconv_num 11 API calls 19200->19201 19201->19202 19202->19076 19203 7ff646ac955c 19202->19203 19208 7ff646ac9585 19203->19208 19209 7ff646ac959e 19203->19209 19204 7ff646ad0858 WideCharToMultiByte 19204->19209 19205 7ff646acec08 _set_fmode 11 API calls 19205->19209 19206 7ff646ac962e 19207 7ff646aca9b8 __free_lconv_num 11 API calls 19206->19207 19207->19208 19208->19076 19209->19204 19209->19205 19209->19206 19209->19208 19210 7ff646aca9b8 __free_lconv_num 11 API calls 19209->19210 19210->19209 19212 7ff646ad266d 19211->19212 19216 7ff646ac9226 19211->19216 19256 7ff646acb294 19212->19256 19217 7ff646ad299c GetEnvironmentStringsW 19216->19217 19218 7ff646ac922b 19217->19218 19219 7ff646ad29cc 19217->19219 19218->19194 19218->19195 19220 7ff646ad0858 WideCharToMultiByte 19219->19220 19221 7ff646ad2a1d 19220->19221 19222 7ff646ad2a24 FreeEnvironmentStringsW 19221->19222 19223 7ff646acd66c _fread_nolock 12 API calls 19221->19223 19222->19218 19224 7ff646ad2a37 19223->19224 19225 7ff646ad2a3f 19224->19225 19226 7ff646ad2a48 19224->19226 19227 7ff646aca9b8 __free_lconv_num 11 API calls 19225->19227 19228 7ff646ad0858 WideCharToMultiByte 19226->19228 19229 7ff646ad2a46 19227->19229 19230 7ff646ad2a6b 19228->19230 19229->19222 19231 7ff646ad2a6f 19230->19231 19232 7ff646ad2a79 19230->19232 19233 7ff646aca9b8 __free_lconv_num 11 API calls 19231->19233 19234 7ff646aca9b8 __free_lconv_num 11 API calls 19232->19234 19235 7ff646ad2a77 FreeEnvironmentStringsW 19233->19235 19234->19235 19235->19218 19238 7ff646ac9311 19237->19238 19239 7ff646acec08 _set_fmode 11 API calls 19238->19239 19240 7ff646ac9347 19239->19240 19242 7ff646ac93c2 19240->19242 19245 7ff646acec08 _set_fmode 11 API calls 19240->19245 19246 7ff646ac93b1 19240->19246 19248 7ff646aca514 __std_exception_copy 37 API calls 19240->19248 19251 7ff646ac93e7 19240->19251 19252 7ff646ac934f 19240->19252 19254 7ff646aca9b8 __free_lconv_num 11 API calls 19240->19254 19241 7ff646aca9b8 __free_lconv_num 11 API calls 19244 7ff646ac9247 19241->19244 19243 7ff646aca9b8 __free_lconv_num 11 API calls 19242->19243 19243->19244 19244->19199 19245->19240 19415 7ff646ac9518 19246->19415 19248->19240 19250 7ff646aca9b8 __free_lconv_num 11 API calls 19250->19252 19253 7ff646aca970 _isindst 17 API calls 19251->19253 19252->19241 19255 7ff646ac93fa 19253->19255 19254->19240 19257 7ff646acb2a5 FlsGetValue 19256->19257 19258 7ff646acb2c0 FlsSetValue 19256->19258 19259 7ff646acb2b2 19257->19259 19260 7ff646acb2ba 19257->19260 19258->19259 19261 7ff646acb2cd 19258->19261 19263 7ff646acb2b8 19259->19263 19264 7ff646aca574 __CxxCallCatchBlock 45 API calls 19259->19264 19260->19258 19262 7ff646acec08 _set_fmode 11 API calls 19261->19262 19265 7ff646acb2dc 19262->19265 19276 7ff646ad2334 19263->19276 19266 7ff646acb335 19264->19266 19267 7ff646acb2fa FlsSetValue 19265->19267 19268 7ff646acb2ea FlsSetValue 19265->19268 19270 7ff646acb306 FlsSetValue 19267->19270 19271 7ff646acb318 19267->19271 19269 7ff646acb2f3 19268->19269 19272 7ff646aca9b8 __free_lconv_num 11 API calls 19269->19272 19270->19269 19273 7ff646acaf64 _set_fmode 11 API calls 19271->19273 19272->19259 19274 7ff646acb320 19273->19274 19275 7ff646aca9b8 __free_lconv_num 11 API calls 19274->19275 19275->19263 19299 7ff646ad25a4 19276->19299 19278 7ff646ad2369 19314 7ff646ad2034 19278->19314 19281 7ff646ad2386 19281->19216 19282 7ff646acd66c _fread_nolock 12 API calls 19283 7ff646ad2397 19282->19283 19284 7ff646ad239f 19283->19284 19286 7ff646ad23ae 19283->19286 19285 7ff646aca9b8 __free_lconv_num 11 API calls 19284->19285 19285->19281 19286->19286 19321 7ff646ad26dc 19286->19321 19289 7ff646ad24aa 19290 7ff646ac4f78 _set_fmode 11 API calls 19289->19290 19291 7ff646ad24af 19290->19291 19295 7ff646aca9b8 __free_lconv_num 11 API calls 19291->19295 19292 7ff646ad2505 19294 7ff646ad256c 19292->19294 19332 7ff646ad1e64 19292->19332 19293 7ff646ad24c4 19293->19292 19296 7ff646aca9b8 __free_lconv_num 11 API calls 19293->19296 19298 7ff646aca9b8 __free_lconv_num 11 API calls 19294->19298 19295->19281 19296->19292 19298->19281 19300 7ff646ad25c7 19299->19300 19301 7ff646ad25d1 19300->19301 19347 7ff646ad0348 EnterCriticalSection 19300->19347 19304 7ff646ad2643 19301->19304 19306 7ff646aca574 __CxxCallCatchBlock 45 API calls 19301->19306 19304->19278 19307 7ff646ad265b 19306->19307 19310 7ff646acb294 50 API calls 19307->19310 19313 7ff646ad26b2 19307->19313 19311 7ff646ad269c 19310->19311 19312 7ff646ad2334 65 API calls 19311->19312 19312->19313 19313->19278 19315 7ff646ac4fbc 45 API calls 19314->19315 19316 7ff646ad2048 19315->19316 19317 7ff646ad2054 GetOEMCP 19316->19317 19318 7ff646ad2066 19316->19318 19319 7ff646ad207b 19317->19319 19318->19319 19320 7ff646ad206b GetACP 19318->19320 19319->19281 19319->19282 19320->19319 19322 7ff646ad2034 47 API calls 19321->19322 19324 7ff646ad2709 19322->19324 19323 7ff646ad285f 19325 7ff646abc5c0 _log10_special 8 API calls 19323->19325 19324->19323 19326 7ff646ad2746 IsValidCodePage 19324->19326 19327 7ff646ad2760 memcpy_s 19324->19327 19329 7ff646ad24a1 19325->19329 19326->19323 19328 7ff646ad2757 19326->19328 19348 7ff646ad214c 19327->19348 19328->19327 19330 7ff646ad2786 GetCPInfo 19328->19330 19329->19289 19329->19293 19330->19323 19330->19327 19414 7ff646ad0348 EnterCriticalSection 19332->19414 19349 7ff646ad2189 GetCPInfo 19348->19349 19350 7ff646ad227f 19348->19350 19349->19350 19355 7ff646ad219c 19349->19355 19351 7ff646abc5c0 _log10_special 8 API calls 19350->19351 19353 7ff646ad231e 19351->19353 19352 7ff646ad2eb0 48 API calls 19354 7ff646ad2213 19352->19354 19353->19323 19359 7ff646ad7bf4 19354->19359 19355->19352 19358 7ff646ad7bf4 54 API calls 19358->19350 19360 7ff646ac4fbc 45 API calls 19359->19360 19361 7ff646ad7c19 19360->19361 19364 7ff646ad78c0 19361->19364 19365 7ff646ad7901 19364->19365 19366 7ff646acf910 _fread_nolock MultiByteToWideChar 19365->19366 19369 7ff646ad794b 19366->19369 19367 7ff646ad7bc9 19368 7ff646abc5c0 _log10_special 8 API calls 19367->19368 19370 7ff646ad2246 19368->19370 19369->19367 19371 7ff646acd66c _fread_nolock 12 API calls 19369->19371 19372 7ff646ad7a81 19369->19372 19374 7ff646ad7983 19369->19374 19370->19358 19371->19374 19372->19367 19373 7ff646aca9b8 __free_lconv_num 11 API calls 19372->19373 19373->19367 19374->19372 19375 7ff646acf910 _fread_nolock MultiByteToWideChar 19374->19375 19376 7ff646ad79f6 19375->19376 19376->19372 19395 7ff646acf154 19376->19395 19379 7ff646ad7a92 19381 7ff646acd66c _fread_nolock 12 API calls 19379->19381 19383 7ff646ad7b64 19379->19383 19385 7ff646ad7ab0 19379->19385 19380 7ff646ad7a41 19380->19372 19382 7ff646acf154 __crtLCMapStringW 6 API calls 19380->19382 19381->19385 19382->19372 19383->19372 19384 7ff646aca9b8 __free_lconv_num 11 API calls 19383->19384 19384->19372 19385->19372 19386 7ff646acf154 __crtLCMapStringW 6 API calls 19385->19386 19387 7ff646ad7b30 19386->19387 19387->19383 19388 7ff646ad7b50 19387->19388 19389 7ff646ad7b66 19387->19389 19390 7ff646ad0858 WideCharToMultiByte 19388->19390 19391 7ff646ad0858 WideCharToMultiByte 19389->19391 19392 7ff646ad7b5e 19390->19392 19391->19392 19392->19383 19393 7ff646ad7b7e 19392->19393 19393->19372 19394 7ff646aca9b8 __free_lconv_num 11 API calls 19393->19394 19394->19372 19401 7ff646aced80 19395->19401 19398 7ff646acf19a 19398->19372 19398->19379 19398->19380 19400 7ff646acf203 LCMapStringW 19400->19398 19402 7ff646aceddd 19401->19402 19409 7ff646acedd8 __vcrt_FlsAlloc 19401->19409 19402->19398 19411 7ff646acf240 19402->19411 19403 7ff646acee0d LoadLibraryExW 19405 7ff646aceee2 19403->19405 19406 7ff646acee32 GetLastError 19403->19406 19404 7ff646acef02 GetProcAddress 19404->19402 19408 7ff646acef13 19404->19408 19405->19404 19407 7ff646aceef9 FreeLibrary 19405->19407 19406->19409 19407->19404 19408->19402 19409->19402 19409->19403 19409->19404 19410 7ff646acee6c LoadLibraryExW 19409->19410 19410->19405 19410->19409 19412 7ff646aced80 __crtLCMapStringW 5 API calls 19411->19412 19413 7ff646acf26e __crtLCMapStringW 19412->19413 19413->19400 19419 7ff646ac951d 19415->19419 19420 7ff646ac93b9 19415->19420 19416 7ff646ac9546 19418 7ff646aca9b8 __free_lconv_num 11 API calls 19416->19418 19417 7ff646aca9b8 __free_lconv_num 11 API calls 19417->19419 19418->19420 19419->19416 19419->19417 19420->19250 19422 7ff646ad6331 19421->19422 19423 7ff646ad6348 19421->19423 19424 7ff646ac4f78 _set_fmode 11 API calls 19422->19424 19423->19422 19426 7ff646ad6356 19423->19426 19425 7ff646ad6336 19424->19425 19427 7ff646aca950 _invalid_parameter_noinfo 37 API calls 19425->19427 19428 7ff646ac4fbc 45 API calls 19426->19428 19429 7ff646ad6341 19426->19429 19427->19429 19428->19429 19429->19089 19431 7ff646ac4fbc 45 API calls 19430->19431 19432 7ff646ad8fe1 19431->19432 19435 7ff646ad8c38 19432->19435 19437 7ff646ad8c86 19435->19437 19436 7ff646abc5c0 _log10_special 8 API calls 19438 7ff646ad7275 19436->19438 19439 7ff646ad8d0d 19437->19439 19441 7ff646ad8cf8 GetCPInfo 19437->19441 19444 7ff646ad8d11 19437->19444 19438->19089 19438->19114 19440 7ff646acf910 _fread_nolock MultiByteToWideChar 19439->19440 19439->19444 19442 7ff646ad8da5 19440->19442 19441->19439 19441->19444 19443 7ff646acd66c _fread_nolock 12 API calls 19442->19443 19442->19444 19445 7ff646ad8ddc 19442->19445 19443->19445 19444->19436 19445->19444 19446 7ff646acf910 _fread_nolock MultiByteToWideChar 19445->19446 19447 7ff646ad8e4a 19446->19447 19448 7ff646acf910 _fread_nolock MultiByteToWideChar 19447->19448 19458 7ff646ad8f2c 19447->19458 19450 7ff646ad8e70 19448->19450 19449 7ff646aca9b8 __free_lconv_num 11 API calls 19449->19444 19451 7ff646acd66c _fread_nolock 12 API calls 19450->19451 19452 7ff646ad8e9d 19450->19452 19450->19458 19451->19452 19453 7ff646acf910 _fread_nolock MultiByteToWideChar 19452->19453 19452->19458 19454 7ff646ad8f14 19453->19454 19455 7ff646ad8f34 19454->19455 19456 7ff646ad8f1a 19454->19456 19464 7ff646acefd8 19455->19464 19456->19458 19460 7ff646aca9b8 __free_lconv_num 11 API calls 19456->19460 19458->19444 19458->19449 19460->19458 19461 7ff646ad8f73 19461->19444 19463 7ff646aca9b8 __free_lconv_num 11 API calls 19461->19463 19462 7ff646aca9b8 __free_lconv_num 11 API calls 19462->19461 19463->19444 19465 7ff646aced80 __crtLCMapStringW 5 API calls 19464->19465 19466 7ff646acf016 19465->19466 19467 7ff646acf01e 19466->19467 19468 7ff646acf240 __crtLCMapStringW 5 API calls 19466->19468 19467->19461 19467->19462 19469 7ff646acf087 CompareStringW 19468->19469 19469->19467 19471 7ff646ad7cb1 19470->19471 19472 7ff646ad7cca HeapSize 19470->19472 19473 7ff646ac4f78 _set_fmode 11 API calls 19471->19473 19474 7ff646ad7cb6 19473->19474 19475 7ff646aca950 _invalid_parameter_noinfo 37 API calls 19474->19475 19476 7ff646ad7cc1 19475->19476 19476->19118 19478 7ff646ad7d03 19477->19478 19479 7ff646ad7cf9 19477->19479 19481 7ff646ad7d08 19478->19481 19487 7ff646ad7d0f _set_fmode 19478->19487 19480 7ff646acd66c _fread_nolock 12 API calls 19479->19480 19486 7ff646ad7d01 19480->19486 19484 7ff646aca9b8 __free_lconv_num 11 API calls 19481->19484 19482 7ff646ad7d42 HeapReAlloc 19482->19486 19482->19487 19483 7ff646ad7d15 19485 7ff646ac4f78 _set_fmode 11 API calls 19483->19485 19484->19486 19485->19486 19486->19123 19487->19482 19487->19483 19488 7ff646ad3600 _set_fmode 2 API calls 19487->19488 19488->19487 19490 7ff646aced80 __crtLCMapStringW 5 API calls 19489->19490 19491 7ff646acefb4 19490->19491 19491->19127 19493 7ff646ac5546 19492->19493 19494 7ff646ac556a 19492->19494 19497 7ff646aca9b8 __free_lconv_num 11 API calls 19493->19497 19498 7ff646ac5555 19493->19498 19495 7ff646ac55c4 19494->19495 19500 7ff646ac556f 19494->19500 19496 7ff646acf910 _fread_nolock MultiByteToWideChar 19495->19496 19508 7ff646ac55e0 19496->19508 19497->19498 19498->19131 19498->19132 19499 7ff646ac5584 19503 7ff646acd66c _fread_nolock 12 API calls 19499->19503 19500->19498 19500->19499 19502 7ff646aca9b8 __free_lconv_num 11 API calls 19500->19502 19501 7ff646ac55e7 GetLastError 19504 7ff646ac4eec _fread_nolock 11 API calls 19501->19504 19502->19499 19503->19498 19506 7ff646ac55f4 19504->19506 19505 7ff646ac5622 19505->19498 19509 7ff646acf910 _fread_nolock MultiByteToWideChar 19505->19509 19510 7ff646ac4f78 _set_fmode 11 API calls 19506->19510 19507 7ff646ac5615 19512 7ff646acd66c _fread_nolock 12 API calls 19507->19512 19508->19501 19508->19505 19508->19507 19511 7ff646aca9b8 __free_lconv_num 11 API calls 19508->19511 19513 7ff646ac5666 19509->19513 19510->19498 19511->19507 19512->19505 19513->19498 19513->19501 19515 7ff646ac9295 19514->19515 19516 7ff646ac9291 19514->19516 19535 7ff646ad2aac GetEnvironmentStringsW 19515->19535 19516->19159 19527 7ff646ac963c 19516->19527 19519 7ff646ac92a2 19521 7ff646aca9b8 __free_lconv_num 11 API calls 19519->19521 19520 7ff646ac92ae 19542 7ff646ac93fc 19520->19542 19521->19516 19524 7ff646aca9b8 __free_lconv_num 11 API calls 19525 7ff646ac92d5 19524->19525 19526 7ff646aca9b8 __free_lconv_num 11 API calls 19525->19526 19526->19516 19528 7ff646ac965f 19527->19528 19533 7ff646ac9676 19527->19533 19528->19159 19529 7ff646acec08 _set_fmode 11 API calls 19529->19533 19530 7ff646ac96ea 19532 7ff646aca9b8 __free_lconv_num 11 API calls 19530->19532 19531 7ff646acf910 MultiByteToWideChar _fread_nolock 19531->19533 19532->19528 19533->19528 19533->19529 19533->19530 19533->19531 19534 7ff646aca9b8 __free_lconv_num 11 API calls 19533->19534 19534->19533 19536 7ff646ac929a 19535->19536 19537 7ff646ad2ad0 19535->19537 19536->19519 19536->19520 19538 7ff646acd66c _fread_nolock 12 API calls 19537->19538 19539 7ff646ad2b07 memcpy_s 19538->19539 19540 7ff646aca9b8 __free_lconv_num 11 API calls 19539->19540 19541 7ff646ad2b27 FreeEnvironmentStringsW 19540->19541 19541->19536 19543 7ff646ac9424 19542->19543 19544 7ff646acec08 _set_fmode 11 API calls 19543->19544 19556 7ff646ac945f 19544->19556 19545 7ff646aca9b8 __free_lconv_num 11 API calls 19546 7ff646ac92b6 19545->19546 19546->19524 19547 7ff646ac94e1 19548 7ff646aca9b8 __free_lconv_num 11 API calls 19547->19548 19548->19546 19549 7ff646acec08 _set_fmode 11 API calls 19549->19556 19550 7ff646ac94d0 19551 7ff646ac9518 11 API calls 19550->19551 19553 7ff646ac94d8 19551->19553 19552 7ff646ad04e4 37 API calls 19552->19556 19554 7ff646aca9b8 __free_lconv_num 11 API calls 19553->19554 19558 7ff646ac9467 19554->19558 19555 7ff646ac9504 19559 7ff646aca970 _isindst 17 API calls 19555->19559 19556->19547 19556->19549 19556->19550 19556->19552 19556->19555 19557 7ff646aca9b8 __free_lconv_num 11 API calls 19556->19557 19556->19558 19557->19556 19558->19545 19560 7ff646ac9516 19559->19560 19563 7ff646ad8ba1 __crtLCMapStringW 19561->19563 19562 7ff646ad715e 19562->19183 19562->19187 19563->19562 19564 7ff646acefd8 6 API calls 19563->19564 19564->19562 16463 7ff646abccac 16484 7ff646abce7c 16463->16484 16466 7ff646abcdf8 16638 7ff646abd19c IsProcessorFeaturePresent 16466->16638 16467 7ff646abccc8 __scrt_acquire_startup_lock 16469 7ff646abce02 16467->16469 16475 7ff646abcce6 __scrt_release_startup_lock 16467->16475 16470 7ff646abd19c 7 API calls 16469->16470 16472 7ff646abce0d __CxxCallCatchBlock 16470->16472 16471 7ff646abcd0b 16473 7ff646abcd91 16490 7ff646abd2e4 16473->16490 16475->16471 16475->16473 16627 7ff646ac9b9c 16475->16627 16476 7ff646abcd96 16493 7ff646ab1000 16476->16493 16481 7ff646abcdb9 16481->16472 16634 7ff646abd000 16481->16634 16485 7ff646abce84 16484->16485 16486 7ff646abce90 __scrt_dllmain_crt_thread_attach 16485->16486 16487 7ff646abccc0 16486->16487 16488 7ff646abce9d 16486->16488 16487->16466 16487->16467 16488->16487 16645 7ff646abd8f8 16488->16645 16491 7ff646ada540 memcpy_s 16490->16491 16492 7ff646abd2fb GetStartupInfoW 16491->16492 16492->16476 16494 7ff646ab1009 16493->16494 16672 7ff646ac54f4 16494->16672 16496 7ff646ab37fb 16679 7ff646ab36b0 16496->16679 16500 7ff646abc5c0 _log10_special 8 API calls 16502 7ff646ab3ca7 16500->16502 16632 7ff646abd328 GetModuleHandleW 16502->16632 16503 7ff646ab383c 16846 7ff646ab1c80 16503->16846 16504 7ff646ab391b 16855 7ff646ab45b0 16504->16855 16508 7ff646ab385b 16751 7ff646ab8a20 16508->16751 16509 7ff646ab396a 16878 7ff646ab2710 16509->16878 16513 7ff646ab388e 16520 7ff646ab38bb __vcrt_freefls 16513->16520 16850 7ff646ab8b90 16513->16850 16514 7ff646ab395d 16515 7ff646ab3984 16514->16515 16516 7ff646ab3962 16514->16516 16519 7ff646ab1c80 49 API calls 16515->16519 16874 7ff646ac00bc 16516->16874 16521 7ff646ab39a3 16519->16521 16522 7ff646ab8a20 14 API calls 16520->16522 16530 7ff646ab38de __vcrt_freefls 16520->16530 16525 7ff646ab1950 115 API calls 16521->16525 16522->16530 16523 7ff646ab8b30 40 API calls 16524 7ff646ab3a0b 16523->16524 16526 7ff646ab8b90 40 API calls 16524->16526 16527 7ff646ab39ce 16525->16527 16528 7ff646ab3a17 16526->16528 16527->16508 16529 7ff646ab39de 16527->16529 16531 7ff646ab8b90 40 API calls 16528->16531 16532 7ff646ab2710 54 API calls 16529->16532 16530->16523 16535 7ff646ab390e __vcrt_freefls 16530->16535 16533 7ff646ab3a23 16531->16533 16541 7ff646ab3808 __vcrt_freefls 16532->16541 16534 7ff646ab8b90 40 API calls 16533->16534 16534->16535 16536 7ff646ab8a20 14 API calls 16535->16536 16537 7ff646ab3a3b 16536->16537 16538 7ff646ab3b2f 16537->16538 16539 7ff646ab3a60 __vcrt_freefls 16537->16539 16540 7ff646ab2710 54 API calls 16538->16540 16550 7ff646ab3aab 16539->16550 16764 7ff646ab8b30 16539->16764 16540->16541 16541->16500 16543 7ff646ab8a20 14 API calls 16544 7ff646ab3bf4 __vcrt_freefls 16543->16544 16545 7ff646ab3d41 16544->16545 16546 7ff646ab3c46 16544->16546 16889 7ff646ab44d0 16545->16889 16547 7ff646ab3c50 16546->16547 16548 7ff646ab3cd4 16546->16548 16771 7ff646ab90e0 16547->16771 16552 7ff646ab8a20 14 API calls 16548->16552 16550->16543 16555 7ff646ab3ce0 16552->16555 16553 7ff646ab3d4f 16556 7ff646ab3d71 16553->16556 16557 7ff646ab3d65 16553->16557 16558 7ff646ab3c61 16555->16558 16562 7ff646ab3ced 16555->16562 16560 7ff646ab1c80 49 API calls 16556->16560 16892 7ff646ab4620 16557->16892 16565 7ff646ab2710 54 API calls 16558->16565 16572 7ff646ab3cc8 __vcrt_freefls 16560->16572 16566 7ff646ab1c80 49 API calls 16562->16566 16563 7ff646ab3dc4 16821 7ff646ab9400 16563->16821 16565->16541 16568 7ff646ab3d0b 16566->16568 16571 7ff646ab3d12 16568->16571 16568->16572 16569 7ff646ab3da7 SetDllDirectoryW LoadLibraryExW 16569->16563 16570 7ff646ab3dd7 SetDllDirectoryW 16575 7ff646ab3e0a 16570->16575 16618 7ff646ab3e5a 16570->16618 16573 7ff646ab2710 54 API calls 16571->16573 16572->16563 16572->16569 16573->16541 16577 7ff646ab8a20 14 API calls 16575->16577 16576 7ff646ab3ffc 16579 7ff646ab4029 16576->16579 16580 7ff646ab4006 PostMessageW GetMessageW 16576->16580 16583 7ff646ab3e16 __vcrt_freefls 16577->16583 16578 7ff646ab3f1b 16826 7ff646ab33c0 16578->16826 16969 7ff646ab3360 16579->16969 16580->16579 16585 7ff646ab3ef2 16583->16585 16589 7ff646ab3e4e 16583->16589 16588 7ff646ab8b30 40 API calls 16585->16588 16588->16618 16589->16618 16895 7ff646ab6db0 16589->16895 16618->16576 16618->16578 16628 7ff646ac9bb3 16627->16628 16629 7ff646ac9bd4 16627->16629 16628->16473 16630 7ff646aca448 45 API calls 16629->16630 16631 7ff646ac9bd9 16630->16631 16633 7ff646abd339 16632->16633 16633->16481 16636 7ff646abd011 16634->16636 16635 7ff646abcdd0 16635->16471 16636->16635 16637 7ff646abd8f8 7 API calls 16636->16637 16637->16635 16639 7ff646abd1c2 _isindst memcpy_s 16638->16639 16640 7ff646abd1e1 RtlCaptureContext RtlLookupFunctionEntry 16639->16640 16641 7ff646abd246 memcpy_s 16640->16641 16642 7ff646abd20a RtlVirtualUnwind 16640->16642 16643 7ff646abd278 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16641->16643 16642->16641 16644 7ff646abd2c6 _isindst 16643->16644 16644->16469 16646 7ff646abd900 16645->16646 16647 7ff646abd90a 16645->16647 16651 7ff646abdc94 16646->16651 16647->16487 16652 7ff646abd905 16651->16652 16653 7ff646abdca3 16651->16653 16655 7ff646abdd00 16652->16655 16659 7ff646abded0 16653->16659 16656 7ff646abdd2b 16655->16656 16657 7ff646abdd2f 16656->16657 16658 7ff646abdd0e DeleteCriticalSection 16656->16658 16657->16647 16658->16656 16663 7ff646abdd38 16659->16663 16664 7ff646abdd7c __vcrt_FlsAlloc 16663->16664 16665 7ff646abde22 TlsFree 16663->16665 16664->16665 16666 7ff646abddaa LoadLibraryExW 16664->16666 16667 7ff646abde69 GetProcAddress 16664->16667 16671 7ff646abdded LoadLibraryExW 16664->16671 16668 7ff646abde49 16666->16668 16669 7ff646abddcb GetLastError 16666->16669 16667->16665 16668->16667 16670 7ff646abde60 FreeLibrary 16668->16670 16669->16664 16670->16667 16671->16664 16671->16668 16674 7ff646acf4f0 16672->16674 16673 7ff646aca884 _invalid_parameter_noinfo 37 API calls 16678 7ff646acf56c 16673->16678 16675 7ff646acf596 16674->16675 16676 7ff646acf543 16674->16676 16982 7ff646acf3c8 16675->16982 16676->16673 16678->16496 16990 7ff646abc8c0 16679->16990 16682 7ff646ab3710 16992 7ff646ab92f0 FindFirstFileExW 16682->16992 16683 7ff646ab36eb GetLastError 16997 7ff646ab2c50 16683->16997 16687 7ff646ab3706 16690 7ff646abc5c0 _log10_special 8 API calls 16687->16690 16688 7ff646ab3723 17012 7ff646ab9370 CreateFileW 16688->17012 16689 7ff646ab377d 17023 7ff646ab94b0 16689->17023 16693 7ff646ab37b5 16690->16693 16693->16541 16701 7ff646ab1950 16693->16701 16695 7ff646ab378b 16695->16687 16697 7ff646ab2810 49 API calls 16695->16697 16696 7ff646ab3734 17015 7ff646ab2810 16696->17015 16697->16687 16700 7ff646ab374c __vcrt_FlsAlloc 16700->16689 16702 7ff646ab45b0 108 API calls 16701->16702 16703 7ff646ab1985 16702->16703 16704 7ff646ab1c43 16703->16704 16705 7ff646ab7f80 83 API calls 16703->16705 16706 7ff646abc5c0 _log10_special 8 API calls 16704->16706 16707 7ff646ab19cb 16705->16707 16708 7ff646ab1c5e 16706->16708 16750 7ff646ab1a03 16707->16750 17380 7ff646ac0744 16707->17380 16708->16503 16708->16504 16710 7ff646ac00bc 74 API calls 16710->16704 16711 7ff646ab19e5 16712 7ff646ab1a08 16711->16712 16713 7ff646ab19e9 16711->16713 17384 7ff646ac040c 16712->17384 16715 7ff646ac4f78 _set_fmode 11 API calls 16713->16715 16717 7ff646ab19ee 16715->16717 17387 7ff646ab2910 16717->17387 16718 7ff646ab1a45 16724 7ff646ab1a5c 16718->16724 16725 7ff646ab1a7b 16718->16725 16719 7ff646ab1a26 16721 7ff646ac4f78 _set_fmode 11 API calls 16719->16721 16722 7ff646ab1a2b 16721->16722 16723 7ff646ab2910 54 API calls 16722->16723 16723->16750 16727 7ff646ac4f78 _set_fmode 11 API calls 16724->16727 16726 7ff646ab1c80 49 API calls 16725->16726 16728 7ff646ab1a92 16726->16728 16729 7ff646ab1a61 16727->16729 16730 7ff646ab1c80 49 API calls 16728->16730 16731 7ff646ab2910 54 API calls 16729->16731 16732 7ff646ab1add 16730->16732 16731->16750 16733 7ff646ac0744 73 API calls 16732->16733 16734 7ff646ab1b01 16733->16734 16735 7ff646ab1b35 16734->16735 16736 7ff646ab1b16 16734->16736 16738 7ff646ac040c _fread_nolock 53 API calls 16735->16738 16737 7ff646ac4f78 _set_fmode 11 API calls 16736->16737 16740 7ff646ab1b1b 16737->16740 16739 7ff646ab1b4a 16738->16739 16741 7ff646ab1b50 16739->16741 16742 7ff646ab1b6f 16739->16742 16743 7ff646ab2910 54 API calls 16740->16743 16744 7ff646ac4f78 _set_fmode 11 API calls 16741->16744 17402 7ff646ac0180 16742->17402 16743->16750 16746 7ff646ab1b55 16744->16746 16748 7ff646ab2910 54 API calls 16746->16748 16748->16750 16749 7ff646ab2710 54 API calls 16749->16750 16750->16710 16752 7ff646ab8a2a 16751->16752 16753 7ff646ab9400 2 API calls 16752->16753 16754 7ff646ab8a49 GetEnvironmentVariableW 16753->16754 16755 7ff646ab8ab2 16754->16755 16756 7ff646ab8a66 ExpandEnvironmentStringsW 16754->16756 16758 7ff646abc5c0 _log10_special 8 API calls 16755->16758 16756->16755 16757 7ff646ab8a88 16756->16757 16759 7ff646ab94b0 2 API calls 16757->16759 16760 7ff646ab8ac4 16758->16760 16761 7ff646ab8a9a 16759->16761 16760->16513 16762 7ff646abc5c0 _log10_special 8 API calls 16761->16762 16763 7ff646ab8aaa 16762->16763 16763->16513 16765 7ff646ab9400 2 API calls 16764->16765 16766 7ff646ab8b4c 16765->16766 16767 7ff646ab9400 2 API calls 16766->16767 16768 7ff646ab8b5c 16767->16768 17620 7ff646ac82a8 16768->17620 16770 7ff646ab8b6a __vcrt_freefls 16770->16550 16772 7ff646ab90f5 16771->16772 17638 7ff646ab8760 GetCurrentProcess OpenProcessToken 16772->17638 16775 7ff646ab8760 7 API calls 16776 7ff646ab9121 16775->16776 16777 7ff646ab9154 16776->16777 16778 7ff646ab913a 16776->16778 16780 7ff646ab26b0 48 API calls 16777->16780 16779 7ff646ab26b0 48 API calls 16778->16779 16782 7ff646ab9152 16779->16782 16781 7ff646ab9167 LocalFree LocalFree 16780->16781 16783 7ff646ab9183 16781->16783 16785 7ff646ab918f 16781->16785 16782->16781 17648 7ff646ab2b50 16783->17648 16786 7ff646abc5c0 _log10_special 8 API calls 16785->16786 16787 7ff646ab3c55 16786->16787 16787->16558 16788 7ff646ab8850 16787->16788 16789 7ff646ab8868 16788->16789 16790 7ff646ab888c 16789->16790 16791 7ff646ab88ea GetTempPathW GetCurrentProcessId 16789->16791 16793 7ff646ab8a20 14 API calls 16790->16793 17657 7ff646ab25c0 16791->17657 16794 7ff646ab8898 16793->16794 17664 7ff646ab81c0 16794->17664 16800 7ff646ab8918 __vcrt_freefls 16811 7ff646ab8955 __vcrt_freefls 16800->16811 17661 7ff646ac8bd8 16800->17661 16806 7ff646abc5c0 _log10_special 8 API calls 16812 7ff646ab9400 2 API calls 16811->16812 16820 7ff646ab89c4 __vcrt_freefls 16811->16820 16813 7ff646ab89a1 16812->16813 16820->16806 16822 7ff646ab9422 MultiByteToWideChar 16821->16822 16825 7ff646ab9446 16821->16825 16824 7ff646ab945c __vcrt_freefls 16822->16824 16822->16825 16823 7ff646ab9463 MultiByteToWideChar 16823->16824 16824->16570 16825->16823 16825->16824 16832 7ff646ab33ce memcpy_s 16826->16832 16827 7ff646ab35c7 16828 7ff646abc5c0 _log10_special 8 API calls 16827->16828 16829 7ff646ab3664 16828->16829 16829->16541 16845 7ff646ab90c0 LocalFree 16829->16845 16831 7ff646ab1c80 49 API calls 16831->16832 16832->16827 16832->16831 16837 7ff646ab35c9 16832->16837 16838 7ff646ab2a50 54 API calls 16832->16838 16840 7ff646ab35e2 16832->16840 16843 7ff646ab35d0 16832->16843 17835 7ff646ab4550 16832->17835 17841 7ff646ab7e10 16832->17841 17852 7ff646ab1600 16832->17852 17900 7ff646ab7110 16832->17900 17904 7ff646ab4180 16832->17904 17948 7ff646ab4440 16832->17948 16834 7ff646ab2710 54 API calls 16834->16827 16839 7ff646ab2710 54 API calls 16837->16839 16838->16832 16839->16827 16840->16834 16844 7ff646ab2710 54 API calls 16843->16844 16844->16827 16847 7ff646ab1ca5 16846->16847 16848 7ff646ac49f4 49 API calls 16847->16848 16849 7ff646ab1cc8 16848->16849 16849->16508 16851 7ff646ab9400 2 API calls 16850->16851 16852 7ff646ab8ba4 16851->16852 16853 7ff646ac82a8 38 API calls 16852->16853 16854 7ff646ab8bb6 __vcrt_freefls 16853->16854 16854->16520 16856 7ff646ab45bc 16855->16856 16857 7ff646ab9400 2 API calls 16856->16857 16858 7ff646ab45e4 16857->16858 16859 7ff646ab9400 2 API calls 16858->16859 16860 7ff646ab45f7 16859->16860 18115 7ff646ac6004 16860->18115 16863 7ff646abc5c0 _log10_special 8 API calls 16864 7ff646ab392b 16863->16864 16864->16509 16865 7ff646ab7f80 16864->16865 16866 7ff646ab7fa4 16865->16866 16867 7ff646ac0744 73 API calls 16866->16867 16872 7ff646ab807b __vcrt_freefls 16866->16872 16868 7ff646ab7fc0 16867->16868 16868->16872 18506 7ff646ac7938 16868->18506 16870 7ff646ac0744 73 API calls 16873 7ff646ab7fd5 16870->16873 16871 7ff646ac040c _fread_nolock 53 API calls 16871->16873 16872->16514 16873->16870 16873->16871 16873->16872 16875 7ff646ac00ec 16874->16875 18521 7ff646abfe98 16875->18521 16877 7ff646ac0105 16877->16509 16879 7ff646abc8c0 16878->16879 16880 7ff646ab2734 GetCurrentProcessId 16879->16880 16881 7ff646ab1c80 49 API calls 16880->16881 16882 7ff646ab2787 16881->16882 16883 7ff646ac49f4 49 API calls 16882->16883 16884 7ff646ab27cf 16883->16884 16885 7ff646ab2620 12 API calls 16884->16885 16886 7ff646ab27f1 16885->16886 16887 7ff646abc5c0 _log10_special 8 API calls 16886->16887 16888 7ff646ab2801 16887->16888 16888->16541 16890 7ff646ab1c80 49 API calls 16889->16890 16891 7ff646ab44ed 16890->16891 16891->16553 16893 7ff646ab1c80 49 API calls 16892->16893 16894 7ff646ab4650 16893->16894 16894->16572 16896 7ff646ab6dc5 16895->16896 16897 7ff646ab3e6c 16896->16897 16898 7ff646ac4f78 _set_fmode 11 API calls 16896->16898 16901 7ff646ab7330 16897->16901 16899 7ff646ab6dd2 16898->16899 16900 7ff646ab2910 54 API calls 16899->16900 16900->16897 18532 7ff646ab1470 16901->18532 18638 7ff646ab6350 16969->18638 16989 7ff646ac54dc EnterCriticalSection 16982->16989 16991 7ff646ab36bc GetModuleFileNameW 16990->16991 16991->16682 16991->16683 16993 7ff646ab9342 16992->16993 16994 7ff646ab932f FindClose 16992->16994 16995 7ff646abc5c0 _log10_special 8 API calls 16993->16995 16994->16993 16996 7ff646ab371a 16995->16996 16996->16688 16996->16689 16998 7ff646abc8c0 16997->16998 16999 7ff646ab2c70 GetCurrentProcessId 16998->16999 17028 7ff646ab26b0 16999->17028 17001 7ff646ab2cb9 17032 7ff646ac4c48 17001->17032 17004 7ff646ab26b0 48 API calls 17006 7ff646ab2d34 FormatMessageW 17004->17006 17007 7ff646ab2d7f MessageBoxW 17006->17007 17008 7ff646ab2d6d 17006->17008 17010 7ff646abc5c0 _log10_special 8 API calls 17007->17010 17009 7ff646ab26b0 48 API calls 17008->17009 17009->17007 17011 7ff646ab2daf 17010->17011 17011->16687 17013 7ff646ab93b0 GetFinalPathNameByHandleW CloseHandle 17012->17013 17014 7ff646ab3730 17012->17014 17013->17014 17014->16696 17014->16700 17016 7ff646ab2834 17015->17016 17017 7ff646ab26b0 48 API calls 17016->17017 17018 7ff646ab2887 17017->17018 17019 7ff646ac4c48 48 API calls 17018->17019 17020 7ff646ab28d0 MessageBoxW 17019->17020 17021 7ff646abc5c0 _log10_special 8 API calls 17020->17021 17022 7ff646ab2900 17021->17022 17022->16687 17024 7ff646ab94da WideCharToMultiByte 17023->17024 17025 7ff646ab9505 17023->17025 17024->17025 17027 7ff646ab951b __vcrt_freefls 17024->17027 17026 7ff646ab9522 WideCharToMultiByte 17025->17026 17025->17027 17026->17027 17027->16695 17029 7ff646ab26d5 17028->17029 17030 7ff646ac4c48 48 API calls 17029->17030 17031 7ff646ab26f8 17030->17031 17031->17001 17033 7ff646ac4ca2 17032->17033 17034 7ff646ac4cc7 17033->17034 17036 7ff646ac4d03 17033->17036 17035 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17034->17035 17038 7ff646ac4cf1 17035->17038 17050 7ff646ac3000 17036->17050 17039 7ff646abc5c0 _log10_special 8 API calls 17038->17039 17041 7ff646ab2d04 17039->17041 17040 7ff646aca9b8 __free_lconv_num 11 API calls 17040->17038 17041->17004 17043 7ff646ac4e0a 17044 7ff646ac4e14 17043->17044 17049 7ff646ac4de4 17043->17049 17047 7ff646aca9b8 __free_lconv_num 11 API calls 17044->17047 17045 7ff646aca9b8 __free_lconv_num 11 API calls 17045->17038 17046 7ff646ac4db0 17048 7ff646ac4db9 17046->17048 17046->17049 17047->17038 17048->17045 17049->17040 17051 7ff646ac303e 17050->17051 17052 7ff646ac302e 17050->17052 17053 7ff646ac3047 17051->17053 17057 7ff646ac3075 17051->17057 17055 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17052->17055 17056 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17053->17056 17054 7ff646ac306d 17054->17043 17054->17046 17054->17048 17054->17049 17055->17054 17056->17054 17057->17052 17057->17054 17061 7ff646ac3a14 17057->17061 17094 7ff646ac3460 17057->17094 17131 7ff646ac2bf0 17057->17131 17062 7ff646ac3ac7 17061->17062 17063 7ff646ac3a56 17061->17063 17066 7ff646ac3b20 17062->17066 17067 7ff646ac3acc 17062->17067 17064 7ff646ac3af1 17063->17064 17065 7ff646ac3a5c 17063->17065 17154 7ff646ac1dc4 17064->17154 17068 7ff646ac3a61 17065->17068 17069 7ff646ac3a90 17065->17069 17072 7ff646ac3b37 17066->17072 17073 7ff646ac3b2a 17066->17073 17077 7ff646ac3b2f 17066->17077 17070 7ff646ac3b01 17067->17070 17071 7ff646ac3ace 17067->17071 17068->17072 17075 7ff646ac3a67 17068->17075 17069->17075 17069->17077 17161 7ff646ac19b4 17070->17161 17076 7ff646ac3a70 17071->17076 17081 7ff646ac3add 17071->17081 17168 7ff646ac471c 17072->17168 17073->17064 17073->17077 17075->17076 17082 7ff646ac3aa2 17075->17082 17089 7ff646ac3a8b 17075->17089 17092 7ff646ac3b60 17076->17092 17134 7ff646ac41c8 17076->17134 17077->17092 17172 7ff646ac21d4 17077->17172 17081->17064 17084 7ff646ac3ae2 17081->17084 17082->17092 17144 7ff646ac4504 17082->17144 17084->17092 17150 7ff646ac45c8 17084->17150 17086 7ff646abc5c0 _log10_special 8 API calls 17088 7ff646ac3e5a 17086->17088 17088->17057 17089->17092 17093 7ff646ac3d4c 17089->17093 17179 7ff646ac4830 17089->17179 17092->17086 17093->17092 17185 7ff646acea78 17093->17185 17095 7ff646ac346e 17094->17095 17096 7ff646ac3484 17094->17096 17097 7ff646ac3ac7 17095->17097 17098 7ff646ac3a56 17095->17098 17100 7ff646ac34c4 17095->17100 17099 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17096->17099 17096->17100 17103 7ff646ac3b20 17097->17103 17104 7ff646ac3acc 17097->17104 17101 7ff646ac3af1 17098->17101 17102 7ff646ac3a5c 17098->17102 17099->17100 17100->17057 17111 7ff646ac1dc4 38 API calls 17101->17111 17105 7ff646ac3a61 17102->17105 17106 7ff646ac3a90 17102->17106 17109 7ff646ac3b37 17103->17109 17110 7ff646ac3b2a 17103->17110 17114 7ff646ac3b2f 17103->17114 17107 7ff646ac3b01 17104->17107 17108 7ff646ac3ace 17104->17108 17105->17109 17112 7ff646ac3a67 17105->17112 17106->17112 17106->17114 17116 7ff646ac19b4 38 API calls 17107->17116 17113 7ff646ac3a70 17108->17113 17120 7ff646ac3add 17108->17120 17115 7ff646ac471c 45 API calls 17109->17115 17110->17101 17110->17114 17127 7ff646ac3a8b 17111->17127 17112->17113 17118 7ff646ac3aa2 17112->17118 17112->17127 17117 7ff646ac41c8 47 API calls 17113->17117 17126 7ff646ac3b60 17113->17126 17119 7ff646ac21d4 38 API calls 17114->17119 17114->17126 17115->17127 17116->17127 17117->17127 17121 7ff646ac4504 46 API calls 17118->17121 17118->17126 17119->17127 17120->17101 17122 7ff646ac3ae2 17120->17122 17121->17127 17124 7ff646ac45c8 37 API calls 17122->17124 17122->17126 17123 7ff646abc5c0 _log10_special 8 API calls 17125 7ff646ac3e5a 17123->17125 17124->17127 17125->17057 17126->17123 17127->17126 17128 7ff646ac3d4c 17127->17128 17129 7ff646ac4830 45 API calls 17127->17129 17128->17126 17130 7ff646acea78 46 API calls 17128->17130 17129->17128 17130->17128 17363 7ff646ac1038 17131->17363 17135 7ff646ac41ee 17134->17135 17197 7ff646ac0bf0 17135->17197 17140 7ff646ac4333 17141 7ff646ac43c1 17140->17141 17143 7ff646ac4830 45 API calls 17140->17143 17141->17089 17142 7ff646ac4830 45 API calls 17142->17140 17143->17141 17145 7ff646ac4539 17144->17145 17146 7ff646ac457e 17145->17146 17147 7ff646ac4557 17145->17147 17148 7ff646ac4830 45 API calls 17145->17148 17146->17089 17149 7ff646acea78 46 API calls 17147->17149 17148->17147 17149->17146 17151 7ff646ac45e9 17150->17151 17152 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17151->17152 17153 7ff646ac461a 17151->17153 17152->17153 17153->17089 17155 7ff646ac1df7 17154->17155 17156 7ff646ac1e26 17155->17156 17158 7ff646ac1ee3 17155->17158 17160 7ff646ac1e63 17156->17160 17333 7ff646ac0c98 17156->17333 17159 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17158->17159 17159->17160 17160->17089 17162 7ff646ac19e7 17161->17162 17163 7ff646ac1a16 17162->17163 17165 7ff646ac1ad3 17162->17165 17164 7ff646ac0c98 12 API calls 17163->17164 17167 7ff646ac1a53 17163->17167 17164->17167 17166 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17165->17166 17166->17167 17167->17089 17169 7ff646ac475f 17168->17169 17171 7ff646ac4763 __crtLCMapStringW 17169->17171 17341 7ff646ac47b8 17169->17341 17171->17089 17173 7ff646ac2207 17172->17173 17174 7ff646ac2236 17173->17174 17176 7ff646ac22f3 17173->17176 17175 7ff646ac0c98 12 API calls 17174->17175 17178 7ff646ac2273 17174->17178 17175->17178 17177 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17176->17177 17177->17178 17178->17089 17180 7ff646ac4847 17179->17180 17345 7ff646acda28 17180->17345 17186 7ff646aceaa9 17185->17186 17192 7ff646aceab7 17185->17192 17187 7ff646acead7 17186->17187 17188 7ff646ac4830 45 API calls 17186->17188 17186->17192 17189 7ff646aceb0f 17187->17189 17190 7ff646aceae8 17187->17190 17188->17187 17189->17192 17193 7ff646aceb9a 17189->17193 17194 7ff646aceb39 17189->17194 17353 7ff646ad0110 17190->17353 17192->17093 17195 7ff646acf910 _fread_nolock MultiByteToWideChar 17193->17195 17194->17192 17356 7ff646acf910 17194->17356 17195->17192 17198 7ff646ac0c16 17197->17198 17199 7ff646ac0c27 17197->17199 17205 7ff646ace5e0 17198->17205 17199->17198 17200 7ff646acd66c _fread_nolock 12 API calls 17199->17200 17201 7ff646ac0c54 17200->17201 17202 7ff646ac0c68 17201->17202 17203 7ff646aca9b8 __free_lconv_num 11 API calls 17201->17203 17204 7ff646aca9b8 __free_lconv_num 11 API calls 17202->17204 17203->17202 17204->17198 17206 7ff646ace630 17205->17206 17207 7ff646ace5fd 17205->17207 17206->17207 17209 7ff646ace662 17206->17209 17208 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17207->17208 17217 7ff646ac4311 17208->17217 17214 7ff646ace775 17209->17214 17222 7ff646ace6aa 17209->17222 17210 7ff646ace867 17260 7ff646acdacc 17210->17260 17212 7ff646ace82d 17253 7ff646acde64 17212->17253 17213 7ff646ace7fc 17246 7ff646ace144 17213->17246 17214->17210 17214->17212 17214->17213 17216 7ff646ace7bf 17214->17216 17219 7ff646ace7b5 17214->17219 17236 7ff646ace374 17216->17236 17217->17140 17217->17142 17219->17212 17221 7ff646ace7ba 17219->17221 17221->17213 17221->17216 17222->17217 17227 7ff646aca514 17222->17227 17225 7ff646aca970 _isindst 17 API calls 17226 7ff646ace8c4 17225->17226 17228 7ff646aca521 17227->17228 17229 7ff646aca52b 17227->17229 17228->17229 17233 7ff646aca546 17228->17233 17230 7ff646ac4f78 _set_fmode 11 API calls 17229->17230 17235 7ff646aca532 17230->17235 17231 7ff646aca950 _invalid_parameter_noinfo 37 API calls 17232 7ff646aca53e 17231->17232 17232->17217 17232->17225 17233->17232 17234 7ff646ac4f78 _set_fmode 11 API calls 17233->17234 17234->17235 17235->17231 17269 7ff646ad411c 17236->17269 17240 7ff646ace41c 17241 7ff646ace471 17240->17241 17243 7ff646ace43c 17240->17243 17245 7ff646ace420 17240->17245 17322 7ff646acdf60 17241->17322 17243->17243 17318 7ff646ace21c 17243->17318 17245->17217 17247 7ff646ad411c 38 API calls 17246->17247 17248 7ff646ace18e 17247->17248 17249 7ff646ad3b64 37 API calls 17248->17249 17250 7ff646ace1de 17249->17250 17251 7ff646ace21c 45 API calls 17250->17251 17252 7ff646ace1e2 17250->17252 17251->17252 17252->17217 17254 7ff646ad411c 38 API calls 17253->17254 17255 7ff646acdeaf 17254->17255 17256 7ff646ad3b64 37 API calls 17255->17256 17257 7ff646acdf07 17256->17257 17258 7ff646acdf0b 17257->17258 17259 7ff646acdf60 45 API calls 17257->17259 17258->17217 17259->17258 17261 7ff646acdb44 17260->17261 17262 7ff646acdb11 17260->17262 17264 7ff646acdb5c 17261->17264 17267 7ff646acdbdd 17261->17267 17263 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17262->17263 17266 7ff646acdb3d memcpy_s 17263->17266 17265 7ff646acde64 46 API calls 17264->17265 17265->17266 17266->17217 17267->17266 17268 7ff646ac4830 45 API calls 17267->17268 17268->17266 17270 7ff646ad416f fegetenv 17269->17270 17271 7ff646ad7e9c 37 API calls 17270->17271 17275 7ff646ad41c2 17271->17275 17272 7ff646ad41ef 17277 7ff646aca514 __std_exception_copy 37 API calls 17272->17277 17273 7ff646ad42b2 17274 7ff646ad7e9c 37 API calls 17273->17274 17276 7ff646ad42dc 17274->17276 17275->17273 17278 7ff646ad428c 17275->17278 17279 7ff646ad41dd 17275->17279 17280 7ff646ad7e9c 37 API calls 17276->17280 17281 7ff646ad426d 17277->17281 17284 7ff646aca514 __std_exception_copy 37 API calls 17278->17284 17279->17272 17279->17273 17282 7ff646ad42ed 17280->17282 17283 7ff646ad5394 17281->17283 17288 7ff646ad4275 17281->17288 17285 7ff646ad8090 20 API calls 17282->17285 17286 7ff646aca970 _isindst 17 API calls 17283->17286 17284->17281 17296 7ff646ad4356 memcpy_s 17285->17296 17287 7ff646ad53a9 17286->17287 17289 7ff646abc5c0 _log10_special 8 API calls 17288->17289 17290 7ff646ace3c1 17289->17290 17314 7ff646ad3b64 17290->17314 17291 7ff646ad46ff memcpy_s 17292 7ff646ad4a3f 17293 7ff646ad3c80 37 API calls 17292->17293 17300 7ff646ad5157 17293->17300 17294 7ff646ad49eb 17294->17292 17297 7ff646ad53ac memcpy_s 37 API calls 17294->17297 17295 7ff646ad4397 memcpy_s 17308 7ff646ad4cdb memcpy_s 17295->17308 17312 7ff646ad47f3 memcpy_s 17295->17312 17296->17291 17296->17295 17298 7ff646ac4f78 _set_fmode 11 API calls 17296->17298 17297->17292 17299 7ff646ad47d0 17298->17299 17301 7ff646aca950 _invalid_parameter_noinfo 37 API calls 17299->17301 17302 7ff646ad53ac memcpy_s 37 API calls 17300->17302 17306 7ff646ad51b2 17300->17306 17301->17295 17302->17306 17303 7ff646ad5338 17304 7ff646ad7e9c 37 API calls 17303->17304 17304->17288 17305 7ff646ac4f78 11 API calls _set_fmode 17305->17312 17306->17303 17309 7ff646ad3c80 37 API calls 17306->17309 17313 7ff646ad53ac memcpy_s 37 API calls 17306->17313 17307 7ff646ac4f78 11 API calls _set_fmode 17307->17308 17308->17292 17308->17294 17308->17307 17310 7ff646aca950 37 API calls _invalid_parameter_noinfo 17308->17310 17309->17306 17310->17308 17311 7ff646aca950 37 API calls _invalid_parameter_noinfo 17311->17312 17312->17294 17312->17305 17312->17311 17313->17306 17315 7ff646ad3b83 17314->17315 17316 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17315->17316 17317 7ff646ad3bae memcpy_s 17315->17317 17316->17317 17317->17240 17319 7ff646ace248 memcpy_s 17318->17319 17320 7ff646ac4830 45 API calls 17319->17320 17321 7ff646ace302 memcpy_s 17319->17321 17320->17321 17321->17245 17323 7ff646acdf9b 17322->17323 17327 7ff646acdfe8 memcpy_s 17322->17327 17324 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17323->17324 17325 7ff646acdfc7 17324->17325 17325->17245 17326 7ff646ace053 17328 7ff646aca514 __std_exception_copy 37 API calls 17326->17328 17327->17326 17329 7ff646ac4830 45 API calls 17327->17329 17330 7ff646ace095 memcpy_s 17328->17330 17329->17326 17331 7ff646aca970 _isindst 17 API calls 17330->17331 17332 7ff646ace140 17331->17332 17334 7ff646ac0ccf 17333->17334 17335 7ff646ac0cbe 17333->17335 17334->17335 17336 7ff646acd66c _fread_nolock 12 API calls 17334->17336 17335->17160 17337 7ff646ac0d00 17336->17337 17338 7ff646ac0d14 17337->17338 17339 7ff646aca9b8 __free_lconv_num 11 API calls 17337->17339 17340 7ff646aca9b8 __free_lconv_num 11 API calls 17338->17340 17339->17338 17340->17335 17342 7ff646ac47de 17341->17342 17343 7ff646ac47d6 17341->17343 17342->17171 17344 7ff646ac4830 45 API calls 17343->17344 17344->17342 17346 7ff646acda41 17345->17346 17347 7ff646ac486f 17345->17347 17346->17347 17348 7ff646ad3374 45 API calls 17346->17348 17349 7ff646acda94 17347->17349 17348->17347 17350 7ff646ac487f 17349->17350 17351 7ff646acdaad 17349->17351 17350->17093 17351->17350 17352 7ff646ad26c0 45 API calls 17351->17352 17352->17350 17359 7ff646ad6df8 17353->17359 17358 7ff646acf919 MultiByteToWideChar 17356->17358 17361 7ff646ad6e5c 17359->17361 17360 7ff646abc5c0 _log10_special 8 API calls 17362 7ff646ad012d 17360->17362 17361->17360 17362->17192 17364 7ff646ac107f 17363->17364 17365 7ff646ac106d 17363->17365 17367 7ff646ac108d 17364->17367 17371 7ff646ac10c9 17364->17371 17366 7ff646ac4f78 _set_fmode 11 API calls 17365->17366 17368 7ff646ac1072 17366->17368 17369 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17367->17369 17370 7ff646aca950 _invalid_parameter_noinfo 37 API calls 17368->17370 17379 7ff646ac107d 17369->17379 17370->17379 17372 7ff646ac1445 17371->17372 17374 7ff646ac4f78 _set_fmode 11 API calls 17371->17374 17373 7ff646ac4f78 _set_fmode 11 API calls 17372->17373 17372->17379 17375 7ff646ac16d9 17373->17375 17376 7ff646ac143a 17374->17376 17378 7ff646aca950 _invalid_parameter_noinfo 37 API calls 17375->17378 17377 7ff646aca950 _invalid_parameter_noinfo 37 API calls 17376->17377 17377->17372 17378->17379 17379->17057 17381 7ff646ac0774 17380->17381 17408 7ff646ac04d4 17381->17408 17383 7ff646ac078d 17383->16711 17420 7ff646ac042c 17384->17420 17388 7ff646abc8c0 17387->17388 17389 7ff646ab2930 GetCurrentProcessId 17388->17389 17390 7ff646ab1c80 49 API calls 17389->17390 17391 7ff646ab2979 17390->17391 17434 7ff646ac49f4 17391->17434 17396 7ff646ab1c80 49 API calls 17397 7ff646ab29ff 17396->17397 17464 7ff646ab2620 17397->17464 17400 7ff646abc5c0 _log10_special 8 API calls 17401 7ff646ab2a31 17400->17401 17401->16750 17403 7ff646ac0189 17402->17403 17404 7ff646ab1b89 17402->17404 17405 7ff646ac4f78 _set_fmode 11 API calls 17403->17405 17404->16749 17404->16750 17406 7ff646ac018e 17405->17406 17407 7ff646aca950 _invalid_parameter_noinfo 37 API calls 17406->17407 17407->17404 17409 7ff646ac053e 17408->17409 17410 7ff646ac04fe 17408->17410 17409->17410 17412 7ff646ac054a 17409->17412 17411 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17410->17411 17415 7ff646ac0525 17411->17415 17419 7ff646ac54dc EnterCriticalSection 17412->17419 17415->17383 17421 7ff646ac0456 17420->17421 17432 7ff646ab1a20 17420->17432 17422 7ff646ac04a2 17421->17422 17424 7ff646ac0465 memcpy_s 17421->17424 17421->17432 17433 7ff646ac54dc EnterCriticalSection 17422->17433 17426 7ff646ac4f78 _set_fmode 11 API calls 17424->17426 17427 7ff646ac047a 17426->17427 17429 7ff646aca950 _invalid_parameter_noinfo 37 API calls 17427->17429 17429->17432 17432->16718 17432->16719 17435 7ff646ac4a4e 17434->17435 17436 7ff646ac4a73 17435->17436 17437 7ff646ac4aaf 17435->17437 17438 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17436->17438 17473 7ff646ac2c80 17437->17473 17440 7ff646ac4a9d 17438->17440 17442 7ff646abc5c0 _log10_special 8 API calls 17440->17442 17441 7ff646ac4b8c 17443 7ff646aca9b8 __free_lconv_num 11 API calls 17441->17443 17445 7ff646ab29c3 17442->17445 17443->17440 17452 7ff646ac51d0 17445->17452 17446 7ff646ac4b61 17449 7ff646aca9b8 __free_lconv_num 11 API calls 17446->17449 17447 7ff646ac4bb0 17447->17441 17448 7ff646ac4bba 17447->17448 17451 7ff646aca9b8 __free_lconv_num 11 API calls 17448->17451 17449->17440 17450 7ff646ac4b58 17450->17441 17450->17446 17451->17440 17453 7ff646acb338 _set_fmode 11 API calls 17452->17453 17454 7ff646ac51e7 17453->17454 17455 7ff646ab29e5 17454->17455 17456 7ff646acec08 _set_fmode 11 API calls 17454->17456 17459 7ff646ac5227 17454->17459 17455->17396 17457 7ff646ac521c 17456->17457 17458 7ff646aca9b8 __free_lconv_num 11 API calls 17457->17458 17458->17459 17459->17455 17611 7ff646acec90 17459->17611 17462 7ff646aca970 _isindst 17 API calls 17463 7ff646ac526c 17462->17463 17465 7ff646ab262f 17464->17465 17466 7ff646ab9400 2 API calls 17465->17466 17467 7ff646ab2660 17466->17467 17468 7ff646ab266f MessageBoxW 17467->17468 17469 7ff646ab2683 MessageBoxA 17467->17469 17470 7ff646ab2690 17468->17470 17469->17470 17471 7ff646abc5c0 _log10_special 8 API calls 17470->17471 17472 7ff646ab26a0 17471->17472 17472->17400 17474 7ff646ac2cbe 17473->17474 17475 7ff646ac2cae 17473->17475 17476 7ff646ac2cf5 17474->17476 17477 7ff646ac2cc7 17474->17477 17478 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17475->17478 17476->17475 17480 7ff646ac2ced 17476->17480 17481 7ff646ac4830 45 API calls 17476->17481 17483 7ff646ac2fa4 17476->17483 17487 7ff646ac3610 17476->17487 17513 7ff646ac32d8 17476->17513 17543 7ff646ac2b60 17476->17543 17479 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17477->17479 17478->17480 17479->17480 17480->17441 17480->17446 17480->17447 17480->17450 17481->17476 17485 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17483->17485 17485->17475 17488 7ff646ac36c5 17487->17488 17489 7ff646ac3652 17487->17489 17492 7ff646ac371f 17488->17492 17493 7ff646ac36ca 17488->17493 17490 7ff646ac36ef 17489->17490 17491 7ff646ac3658 17489->17491 17560 7ff646ac1bc0 17490->17560 17499 7ff646ac365d 17491->17499 17502 7ff646ac372e 17491->17502 17492->17490 17492->17502 17511 7ff646ac3688 17492->17511 17494 7ff646ac36ff 17493->17494 17495 7ff646ac36cc 17493->17495 17567 7ff646ac17b0 17494->17567 17496 7ff646ac366d 17495->17496 17501 7ff646ac36db 17495->17501 17503 7ff646ac375d 17496->17503 17546 7ff646ac3f74 17496->17546 17499->17496 17504 7ff646ac36a0 17499->17504 17499->17511 17501->17490 17506 7ff646ac36e0 17501->17506 17502->17503 17574 7ff646ac1fd0 17502->17574 17508 7ff646abc5c0 _log10_special 8 API calls 17503->17508 17504->17503 17556 7ff646ac4430 17504->17556 17506->17503 17509 7ff646ac45c8 37 API calls 17506->17509 17510 7ff646ac39f3 17508->17510 17509->17511 17510->17476 17511->17503 17581 7ff646ace8c8 17511->17581 17514 7ff646ac32e3 17513->17514 17515 7ff646ac32f9 17513->17515 17517 7ff646ac36c5 17514->17517 17518 7ff646ac3652 17514->17518 17534 7ff646ac3337 17514->17534 17516 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17515->17516 17515->17534 17516->17534 17519 7ff646ac36ca 17517->17519 17520 7ff646ac371f 17517->17520 17521 7ff646ac36ef 17518->17521 17522 7ff646ac3658 17518->17522 17523 7ff646ac36ff 17519->17523 17524 7ff646ac36cc 17519->17524 17520->17521 17529 7ff646ac372e 17520->17529 17541 7ff646ac3688 17520->17541 17526 7ff646ac1bc0 38 API calls 17521->17526 17522->17529 17530 7ff646ac365d 17522->17530 17527 7ff646ac17b0 38 API calls 17523->17527 17525 7ff646ac366d 17524->17525 17531 7ff646ac36db 17524->17531 17528 7ff646ac3f74 47 API calls 17525->17528 17542 7ff646ac375d 17525->17542 17526->17541 17527->17541 17528->17541 17533 7ff646ac1fd0 38 API calls 17529->17533 17529->17542 17530->17525 17532 7ff646ac36a0 17530->17532 17530->17541 17531->17521 17535 7ff646ac36e0 17531->17535 17536 7ff646ac4430 47 API calls 17532->17536 17532->17542 17533->17541 17534->17476 17538 7ff646ac45c8 37 API calls 17535->17538 17535->17542 17536->17541 17537 7ff646abc5c0 _log10_special 8 API calls 17539 7ff646ac39f3 17537->17539 17538->17541 17539->17476 17540 7ff646ace8c8 47 API calls 17540->17541 17541->17540 17541->17542 17542->17537 17594 7ff646ac0d84 17543->17594 17547 7ff646ac3f96 17546->17547 17548 7ff646ac0bf0 12 API calls 17547->17548 17549 7ff646ac3fde 17548->17549 17550 7ff646ace5e0 46 API calls 17549->17550 17552 7ff646ac40b1 17550->17552 17551 7ff646ac40d3 17553 7ff646ac415c 17551->17553 17555 7ff646ac4830 45 API calls 17551->17555 17552->17551 17554 7ff646ac4830 45 API calls 17552->17554 17553->17511 17554->17551 17555->17553 17557 7ff646ac4448 17556->17557 17559 7ff646ac44b0 17556->17559 17558 7ff646ace8c8 47 API calls 17557->17558 17557->17559 17558->17559 17559->17511 17561 7ff646ac1bf3 17560->17561 17562 7ff646ac1c22 17561->17562 17564 7ff646ac1cdf 17561->17564 17563 7ff646ac0bf0 12 API calls 17562->17563 17566 7ff646ac1c5f 17562->17566 17563->17566 17565 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17564->17565 17565->17566 17566->17511 17568 7ff646ac17e3 17567->17568 17569 7ff646ac1812 17568->17569 17571 7ff646ac18cf 17568->17571 17570 7ff646ac0bf0 12 API calls 17569->17570 17573 7ff646ac184f 17569->17573 17570->17573 17572 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17571->17572 17572->17573 17573->17511 17576 7ff646ac2003 17574->17576 17575 7ff646ac2032 17577 7ff646ac0bf0 12 API calls 17575->17577 17580 7ff646ac206f 17575->17580 17576->17575 17578 7ff646ac20ef 17576->17578 17577->17580 17579 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17578->17579 17579->17580 17580->17511 17583 7ff646ace8f0 17581->17583 17582 7ff646ace935 17587 7ff646ace8f5 memcpy_s 17582->17587 17590 7ff646ace91e memcpy_s 17582->17590 17591 7ff646ad0858 17582->17591 17583->17582 17585 7ff646ac4830 45 API calls 17583->17585 17583->17587 17583->17590 17584 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17584->17587 17585->17582 17587->17511 17590->17584 17590->17587 17592 7ff646ad087c WideCharToMultiByte 17591->17592 17595 7ff646ac0db1 17594->17595 17596 7ff646ac0dc3 17594->17596 17597 7ff646ac4f78 _set_fmode 11 API calls 17595->17597 17598 7ff646ac0dd0 17596->17598 17602 7ff646ac0e0d 17596->17602 17599 7ff646ac0db6 17597->17599 17600 7ff646aca884 _invalid_parameter_noinfo 37 API calls 17598->17600 17601 7ff646aca950 _invalid_parameter_noinfo 37 API calls 17599->17601 17608 7ff646ac0dc1 17600->17608 17601->17608 17603 7ff646ac0eb6 17602->17603 17604 7ff646ac4f78 _set_fmode 11 API calls 17602->17604 17605 7ff646ac4f78 _set_fmode 11 API calls 17603->17605 17603->17608 17606 7ff646ac0eab 17604->17606 17607 7ff646ac0f60 17605->17607 17609 7ff646aca950 _invalid_parameter_noinfo 37 API calls 17606->17609 17610 7ff646aca950 _invalid_parameter_noinfo 37 API calls 17607->17610 17608->17476 17609->17603 17610->17608 17615 7ff646acecad 17611->17615 17612 7ff646acecb2 17613 7ff646ac524d 17612->17613 17614 7ff646ac4f78 _set_fmode 11 API calls 17612->17614 17613->17455 17613->17462 17616 7ff646acecbc 17614->17616 17615->17612 17615->17613 17618 7ff646acecfc 17615->17618 17617 7ff646aca950 _invalid_parameter_noinfo 37 API calls 17616->17617 17617->17613 17618->17613 17619 7ff646ac4f78 _set_fmode 11 API calls 17618->17619 17619->17616 17621 7ff646ac82b5 17620->17621 17622 7ff646ac82c8 17620->17622 17623 7ff646ac4f78 _set_fmode 11 API calls 17621->17623 17630 7ff646ac7f2c 17622->17630 17625 7ff646ac82ba 17623->17625 17627 7ff646aca950 _invalid_parameter_noinfo 37 API calls 17625->17627 17628 7ff646ac82c6 17627->17628 17628->16770 17637 7ff646ad0348 EnterCriticalSection 17630->17637 17639 7ff646ab87a1 GetTokenInformation 17638->17639 17641 7ff646ab8823 __vcrt_freefls 17638->17641 17640 7ff646ab87c2 GetLastError 17639->17640 17642 7ff646ab87cd 17639->17642 17640->17641 17640->17642 17643 7ff646ab8836 CloseHandle 17641->17643 17644 7ff646ab883c 17641->17644 17642->17641 17645 7ff646ab87e9 GetTokenInformation 17642->17645 17643->17644 17644->16775 17645->17641 17646 7ff646ab880c 17645->17646 17646->17641 17647 7ff646ab8816 ConvertSidToStringSidW 17646->17647 17647->17641 17649 7ff646abc8c0 17648->17649 17650 7ff646ab2b74 GetCurrentProcessId 17649->17650 17651 7ff646ab26b0 48 API calls 17650->17651 17652 7ff646ab2bc7 17651->17652 17653 7ff646ac4c48 48 API calls 17652->17653 17654 7ff646ab2c10 MessageBoxW 17653->17654 17655 7ff646abc5c0 _log10_special 8 API calls 17654->17655 17656 7ff646ab2c40 17655->17656 17656->16785 17658 7ff646ab25e5 17657->17658 17659 7ff646ac4c48 48 API calls 17658->17659 17660 7ff646ab2604 17659->17660 17660->16800 17696 7ff646ac8804 17661->17696 17665 7ff646ab81cc 17664->17665 17666 7ff646ab9400 2 API calls 17665->17666 17667 7ff646ab81eb 17666->17667 17668 7ff646ab81f3 17667->17668 17669 7ff646ab8206 ExpandEnvironmentStringsW 17667->17669 17670 7ff646ab2810 49 API calls 17668->17670 17671 7ff646ab822c __vcrt_freefls 17669->17671 17737 7ff646ad15c8 17696->17737 17836 7ff646ab455a 17835->17836 17837 7ff646ab9400 2 API calls 17836->17837 17838 7ff646ab457f 17837->17838 17839 7ff646abc5c0 _log10_special 8 API calls 17838->17839 17840 7ff646ab45a7 17839->17840 17840->16832 17842 7ff646ab7e1e 17841->17842 17843 7ff646ab1c80 49 API calls 17842->17843 17846 7ff646ab7f42 17842->17846 17849 7ff646ab7ea5 17843->17849 17844 7ff646abc5c0 _log10_special 8 API calls 17845 7ff646ab7f73 17844->17845 17845->16832 17846->17844 17847 7ff646ab1c80 49 API calls 17847->17849 17848 7ff646ab4550 10 API calls 17848->17849 17849->17846 17849->17847 17849->17848 17850 7ff646ab9400 2 API calls 17849->17850 17851 7ff646ab7f13 CreateDirectoryW 17850->17851 17851->17846 17851->17849 17853 7ff646ab1613 17852->17853 17854 7ff646ab1637 17852->17854 17973 7ff646ab1050 17853->17973 17856 7ff646ab45b0 108 API calls 17854->17856 17858 7ff646ab164b 17856->17858 17857 7ff646ab1618 17860 7ff646ab1682 17858->17860 17861 7ff646ab1653 17858->17861 17862 7ff646ab45b0 108 API calls 17860->17862 17864 7ff646ac4f78 _set_fmode 11 API calls 17861->17864 17865 7ff646ab1696 17862->17865 17866 7ff646ab1658 17864->17866 17868 7ff646ab169e 17865->17868 17869 7ff646ab16b8 17865->17869 17867 7ff646ab2910 54 API calls 17866->17867 17870 7ff646ab1671 17867->17870 17871 7ff646ab2710 54 API calls 17868->17871 17872 7ff646ac0744 73 API calls 17869->17872 17870->16832 17902 7ff646ab717b 17900->17902 17903 7ff646ab7134 17900->17903 17902->16832 17903->17902 18037 7ff646ac5094 17903->18037 17905 7ff646ab4191 17904->17905 17906 7ff646ab44d0 49 API calls 17905->17906 17907 7ff646ab41cb 17906->17907 17908 7ff646ab44d0 49 API calls 17907->17908 17909 7ff646ab41db 17908->17909 17910 7ff646ab422c 17909->17910 17911 7ff646ab41fd 17909->17911 17913 7ff646ab4100 51 API calls 17910->17913 18052 7ff646ab4100 17911->18052 17914 7ff646ab422a 17913->17914 17949 7ff646ab1c80 49 API calls 17948->17949 17950 7ff646ab4464 17949->17950 17950->16832 17974 7ff646ab45b0 108 API calls 17973->17974 17975 7ff646ab108c 17974->17975 17976 7ff646ab1094 17975->17976 17977 7ff646ab10a9 17975->17977 17978 7ff646ab2710 54 API calls 17976->17978 17979 7ff646ac0744 73 API calls 17977->17979 17985 7ff646ab10a4 __vcrt_freefls 17978->17985 17980 7ff646ab10bf 17979->17980 17985->17857 18038 7ff646ac50a1 18037->18038 18039 7ff646ac50ce 18037->18039 18041 7ff646ac4f78 _set_fmode 11 API calls 18038->18041 18048 7ff646ac5058 18038->18048 18040 7ff646ac50f1 18039->18040 18043 7ff646ac510d 18039->18043 18042 7ff646ac4f78 _set_fmode 11 API calls 18040->18042 18044 7ff646ac50ab 18041->18044 18045 7ff646ac50f6 18042->18045 18046 7ff646ac4fbc 45 API calls 18043->18046 18047 7ff646aca950 _invalid_parameter_noinfo 37 API calls 18044->18047 18049 7ff646aca950 _invalid_parameter_noinfo 37 API calls 18045->18049 18051 7ff646ac5101 18046->18051 18050 7ff646ac50b6 18047->18050 18048->17903 18049->18051 18050->17903 18051->17903 18053 7ff646ab4126 18052->18053 18116 7ff646ac5f38 18115->18116 18117 7ff646ac5f5e 18116->18117 18119 7ff646ac5f91 18116->18119 18118 7ff646ac4f78 _set_fmode 11 API calls 18117->18118 18120 7ff646ac5f63 18118->18120 18121 7ff646ac5fa4 18119->18121 18122 7ff646ac5f97 18119->18122 18123 7ff646aca950 _invalid_parameter_noinfo 37 API calls 18120->18123 18134 7ff646acac98 18121->18134 18124 7ff646ac4f78 _set_fmode 11 API calls 18122->18124 18126 7ff646ab4606 18123->18126 18124->18126 18126->16863 18147 7ff646ad0348 EnterCriticalSection 18134->18147 18507 7ff646ac7968 18506->18507 18510 7ff646ac7444 18507->18510 18509 7ff646ac7981 18509->16873 18511 7ff646ac745f 18510->18511 18512 7ff646ac748e 18510->18512 18513 7ff646aca884 _invalid_parameter_noinfo 37 API calls 18511->18513 18520 7ff646ac54dc EnterCriticalSection 18512->18520 18515 7ff646ac747f 18513->18515 18515->18509 18522 7ff646abfee1 18521->18522 18523 7ff646abfeb3 18521->18523 18530 7ff646abfed3 18522->18530 18531 7ff646ac54dc EnterCriticalSection 18522->18531 18524 7ff646aca884 _invalid_parameter_noinfo 37 API calls 18523->18524 18524->18530 18530->16877 18533 7ff646ab45b0 108 API calls 18532->18533 18534 7ff646ab1493 18533->18534 18535 7ff646ab14bc 18534->18535 18536 7ff646ab149b 18534->18536 18538 7ff646ac0744 73 API calls 18535->18538 18537 7ff646ab2710 54 API calls 18536->18537 18639 7ff646ab6365 18638->18639 18640 7ff646ab1c80 49 API calls 18639->18640 18641 7ff646ab63a1 18640->18641 18642 7ff646ab63cd 18641->18642 18643 7ff646ab63aa 18641->18643 18645 7ff646ab4620 49 API calls 18642->18645 18644 7ff646ab2710 54 API calls 18643->18644 18647 7ff646ab63c3 18644->18647 18646 7ff646ab63e5 18645->18646 18648 7ff646ab6403 18646->18648 18650 7ff646ab2710 54 API calls 18646->18650 18649 7ff646abc5c0 _log10_special 8 API calls 18647->18649 18651 7ff646ab4550 10 API calls 18648->18651 18650->18648 20146 7ff646ad1720 20157 7ff646ad7454 20146->20157 20158 7ff646ad7461 20157->20158 20159 7ff646aca9b8 __free_lconv_num 11 API calls 20158->20159 20160 7ff646ad747d 20158->20160 20159->20158 20161 7ff646aca9b8 __free_lconv_num 11 API calls 20160->20161 20162 7ff646ad1729 20160->20162 20161->20160 20163 7ff646ad0348 EnterCriticalSection 20162->20163 16162 7ff646ac5698 16163 7ff646ac56cf 16162->16163 16164 7ff646ac56b2 16162->16164 16163->16164 16165 7ff646ac56e2 CreateFileW 16163->16165 16213 7ff646ac4f58 16164->16213 16167 7ff646ac5716 16165->16167 16168 7ff646ac574c 16165->16168 16187 7ff646ac57ec GetFileType 16167->16187 16216 7ff646ac5c74 16168->16216 16172 7ff646ac4f78 _set_fmode 11 API calls 16175 7ff646ac56bf 16172->16175 16180 7ff646aca950 _invalid_parameter_noinfo 37 API calls 16175->16180 16176 7ff646ac5741 CloseHandle 16184 7ff646ac56ca 16176->16184 16177 7ff646ac572b CloseHandle 16177->16184 16178 7ff646ac5780 16242 7ff646ac5a34 16178->16242 16179 7ff646ac5755 16237 7ff646ac4eec 16179->16237 16180->16184 16186 7ff646ac575f 16186->16184 16188 7ff646ac58f7 16187->16188 16189 7ff646ac583a 16187->16189 16191 7ff646ac5921 16188->16191 16192 7ff646ac58ff 16188->16192 16190 7ff646ac5866 GetFileInformationByHandle 16189->16190 16194 7ff646ac5b70 21 API calls 16189->16194 16195 7ff646ac588f 16190->16195 16196 7ff646ac5912 GetLastError 16190->16196 16193 7ff646ac5944 PeekNamedPipe 16191->16193 16212 7ff646ac58e2 16191->16212 16192->16196 16197 7ff646ac5903 16192->16197 16193->16212 16203 7ff646ac5854 16194->16203 16199 7ff646ac5a34 51 API calls 16195->16199 16198 7ff646ac4eec _fread_nolock 11 API calls 16196->16198 16200 7ff646ac4f78 _set_fmode 11 API calls 16197->16200 16198->16212 16201 7ff646ac589a 16199->16201 16200->16212 16259 7ff646ac5994 16201->16259 16202 7ff646abc5c0 _log10_special 8 API calls 16205 7ff646ac5724 16202->16205 16203->16190 16203->16212 16205->16176 16205->16177 16207 7ff646ac5994 10 API calls 16208 7ff646ac58b9 16207->16208 16209 7ff646ac5994 10 API calls 16208->16209 16210 7ff646ac58ca 16209->16210 16211 7ff646ac4f78 _set_fmode 11 API calls 16210->16211 16210->16212 16211->16212 16212->16202 16214 7ff646acb338 _set_fmode 11 API calls 16213->16214 16215 7ff646ac4f61 16214->16215 16215->16172 16217 7ff646ac5caa 16216->16217 16218 7ff646ac4f78 _set_fmode 11 API calls 16217->16218 16236 7ff646ac5d42 __vcrt_freefls 16217->16236 16220 7ff646ac5cbc 16218->16220 16219 7ff646abc5c0 _log10_special 8 API calls 16221 7ff646ac5751 16219->16221 16222 7ff646ac4f78 _set_fmode 11 API calls 16220->16222 16221->16178 16221->16179 16223 7ff646ac5cc4 16222->16223 16266 7ff646ac7e78 16223->16266 16225 7ff646ac5cd9 16226 7ff646ac5ce1 16225->16226 16227 7ff646ac5ceb 16225->16227 16228 7ff646ac4f78 _set_fmode 11 API calls 16226->16228 16229 7ff646ac4f78 _set_fmode 11 API calls 16227->16229 16233 7ff646ac5ce6 16228->16233 16230 7ff646ac5cf0 16229->16230 16231 7ff646ac4f78 _set_fmode 11 API calls 16230->16231 16230->16236 16232 7ff646ac5cfa 16231->16232 16234 7ff646ac7e78 45 API calls 16232->16234 16235 7ff646ac5d34 GetDriveTypeW 16233->16235 16233->16236 16234->16233 16235->16236 16236->16219 16238 7ff646acb338 _set_fmode 11 API calls 16237->16238 16239 7ff646ac4ef9 __free_lconv_num 16238->16239 16240 7ff646acb338 _set_fmode 11 API calls 16239->16240 16241 7ff646ac4f1b 16240->16241 16241->16186 16244 7ff646ac5a5c 16242->16244 16243 7ff646ac578d 16252 7ff646ac5b70 16243->16252 16244->16243 16360 7ff646acf794 16244->16360 16246 7ff646ac5af0 16246->16243 16247 7ff646acf794 51 API calls 16246->16247 16248 7ff646ac5b03 16247->16248 16248->16243 16249 7ff646acf794 51 API calls 16248->16249 16250 7ff646ac5b16 16249->16250 16250->16243 16251 7ff646acf794 51 API calls 16250->16251 16251->16243 16253 7ff646ac5b8a 16252->16253 16254 7ff646ac5bc1 16253->16254 16255 7ff646ac5b9a 16253->16255 16256 7ff646acf628 21 API calls 16254->16256 16257 7ff646ac4eec _fread_nolock 11 API calls 16255->16257 16258 7ff646ac5baa 16255->16258 16256->16258 16257->16258 16258->16186 16260 7ff646ac59b0 16259->16260 16261 7ff646ac59bd FileTimeToSystemTime 16259->16261 16260->16261 16263 7ff646ac59b8 16260->16263 16262 7ff646ac59d1 SystemTimeToTzSpecificLocalTime 16261->16262 16261->16263 16262->16263 16264 7ff646abc5c0 _log10_special 8 API calls 16263->16264 16265 7ff646ac58a9 16264->16265 16265->16207 16267 7ff646ac7e94 16266->16267 16268 7ff646ac7f02 16266->16268 16267->16268 16269 7ff646ac7e99 16267->16269 16303 7ff646ad0830 16268->16303 16271 7ff646ac7eb1 16269->16271 16272 7ff646ac7ece 16269->16272 16278 7ff646ac7c48 GetFullPathNameW 16271->16278 16286 7ff646ac7cbc GetFullPathNameW 16272->16286 16277 7ff646ac7ec6 __vcrt_freefls 16277->16225 16279 7ff646ac7c6e GetLastError 16278->16279 16280 7ff646ac7c84 16278->16280 16281 7ff646ac4eec _fread_nolock 11 API calls 16279->16281 16284 7ff646ac4f78 _set_fmode 11 API calls 16280->16284 16285 7ff646ac7c80 16280->16285 16282 7ff646ac7c7b 16281->16282 16283 7ff646ac4f78 _set_fmode 11 API calls 16282->16283 16283->16285 16284->16285 16285->16277 16287 7ff646ac7cef GetLastError 16286->16287 16292 7ff646ac7d05 __vcrt_freefls 16286->16292 16288 7ff646ac4eec _fread_nolock 11 API calls 16287->16288 16289 7ff646ac7cfc 16288->16289 16290 7ff646ac4f78 _set_fmode 11 API calls 16289->16290 16291 7ff646ac7d01 16290->16291 16294 7ff646ac7d94 16291->16294 16292->16291 16293 7ff646ac7d5f GetFullPathNameW 16292->16293 16293->16287 16293->16291 16295 7ff646ac7e08 memcpy_s 16294->16295 16298 7ff646ac7dbd memcpy_s 16294->16298 16295->16277 16296 7ff646ac7df1 16297 7ff646ac4f78 _set_fmode 11 API calls 16296->16297 16302 7ff646ac7df6 16297->16302 16298->16295 16298->16296 16300 7ff646ac7e2a 16298->16300 16299 7ff646aca950 _invalid_parameter_noinfo 37 API calls 16299->16295 16300->16295 16301 7ff646ac4f78 _set_fmode 11 API calls 16300->16301 16301->16302 16302->16299 16306 7ff646ad0640 16303->16306 16307 7ff646ad0682 16306->16307 16308 7ff646ad066b 16306->16308 16310 7ff646ad0686 16307->16310 16311 7ff646ad06a7 16307->16311 16309 7ff646ac4f78 _set_fmode 11 API calls 16308->16309 16313 7ff646ad0670 16309->16313 16332 7ff646ad07ac 16310->16332 16344 7ff646acf628 16311->16344 16318 7ff646aca950 _invalid_parameter_noinfo 37 API calls 16313->16318 16315 7ff646ad06ac 16321 7ff646ad0751 16315->16321 16327 7ff646ad06d3 16315->16327 16317 7ff646ad068f 16319 7ff646ac4f58 _fread_nolock 11 API calls 16317->16319 16331 7ff646ad067b __vcrt_freefls 16318->16331 16320 7ff646ad0694 16319->16320 16323 7ff646ac4f78 _set_fmode 11 API calls 16320->16323 16321->16308 16324 7ff646ad0759 16321->16324 16322 7ff646abc5c0 _log10_special 8 API calls 16325 7ff646ad07a1 16322->16325 16323->16313 16326 7ff646ac7c48 13 API calls 16324->16326 16325->16277 16326->16331 16328 7ff646ac7cbc 14 API calls 16327->16328 16329 7ff646ad0717 16328->16329 16330 7ff646ac7d94 37 API calls 16329->16330 16329->16331 16330->16331 16331->16322 16333 7ff646ad07f6 16332->16333 16334 7ff646ad07c6 16332->16334 16335 7ff646ad0801 GetDriveTypeW 16333->16335 16336 7ff646ad07e1 16333->16336 16337 7ff646ac4f58 _fread_nolock 11 API calls 16334->16337 16335->16336 16339 7ff646abc5c0 _log10_special 8 API calls 16336->16339 16338 7ff646ad07cb 16337->16338 16340 7ff646ac4f78 _set_fmode 11 API calls 16338->16340 16341 7ff646ad068b 16339->16341 16342 7ff646ad07d6 16340->16342 16341->16315 16341->16317 16343 7ff646aca950 _invalid_parameter_noinfo 37 API calls 16342->16343 16343->16336 16358 7ff646ada540 16344->16358 16347 7ff646acf675 16350 7ff646abc5c0 _log10_special 8 API calls 16347->16350 16348 7ff646acf69c 16349 7ff646acec08 _set_fmode 11 API calls 16348->16349 16351 7ff646acf6ab 16349->16351 16352 7ff646acf709 16350->16352 16353 7ff646acf6c4 16351->16353 16354 7ff646acf6b5 GetCurrentDirectoryW 16351->16354 16352->16315 16355 7ff646ac4f78 _set_fmode 11 API calls 16353->16355 16354->16353 16356 7ff646acf6c9 16354->16356 16355->16356 16357 7ff646aca9b8 __free_lconv_num 11 API calls 16356->16357 16357->16347 16359 7ff646acf65e GetCurrentDirectoryW 16358->16359 16359->16347 16359->16348 16361 7ff646acf7c5 16360->16361 16362 7ff646acf7a1 16360->16362 16364 7ff646acf7ff 16361->16364 16367 7ff646acf81e 16361->16367 16362->16361 16363 7ff646acf7a6 16362->16363 16365 7ff646ac4f78 _set_fmode 11 API calls 16363->16365 16366 7ff646ac4f78 _set_fmode 11 API calls 16364->16366 16368 7ff646acf7ab 16365->16368 16369 7ff646acf804 16366->16369 16377 7ff646ac4fbc 16367->16377 16371 7ff646aca950 _invalid_parameter_noinfo 37 API calls 16368->16371 16372 7ff646aca950 _invalid_parameter_noinfo 37 API calls 16369->16372 16373 7ff646acf7b6 16371->16373 16374 7ff646acf80f 16372->16374 16373->16246 16374->16246 16375 7ff646acf82b 16375->16374 16376 7ff646ad054c 51 API calls 16375->16376 16376->16375 16378 7ff646ac4fe0 16377->16378 16379 7ff646ac4fdb 16377->16379 16378->16379 16380 7ff646acb1c0 __CxxCallCatchBlock 45 API calls 16378->16380 16379->16375 16381 7ff646ac4ffb 16380->16381 16385 7ff646acd9f4 16381->16385 16386 7ff646ac501e 16385->16386 16387 7ff646acda09 16385->16387 16389 7ff646acda60 16386->16389 16387->16386 16393 7ff646ad3374 16387->16393 16390 7ff646acda75 16389->16390 16391 7ff646acda88 16389->16391 16390->16391 16406 7ff646ad26c0 16390->16406 16391->16379 16394 7ff646acb1c0 __CxxCallCatchBlock 45 API calls 16393->16394 16395 7ff646ad3383 16394->16395 16396 7ff646ad33ce 16395->16396 16405 7ff646ad0348 EnterCriticalSection 16395->16405 16396->16386 16407 7ff646acb1c0 __CxxCallCatchBlock 45 API calls 16406->16407 16408 7ff646ad26c9 16407->16408 19945 7ff646acc590 19956 7ff646ad0348 EnterCriticalSection 19945->19956 20628 7ff646ac5480 20629 7ff646ac548b 20628->20629 20637 7ff646acf314 20629->20637 20650 7ff646ad0348 EnterCriticalSection 20637->20650 16409 7ff646acf9fc 16410 7ff646acfbee 16409->16410 16414 7ff646acfa3e _isindst 16409->16414 16411 7ff646ac4f78 _set_fmode 11 API calls 16410->16411 16429 7ff646acfbde 16411->16429 16412 7ff646abc5c0 _log10_special 8 API calls 16413 7ff646acfc09 16412->16413 16414->16410 16415 7ff646acfabe _isindst 16414->16415 16430 7ff646ad6204 16415->16430 16420 7ff646acfc1a 16422 7ff646aca970 _isindst 17 API calls 16420->16422 16424 7ff646acfc2e 16422->16424 16427 7ff646acfb1b 16427->16429 16454 7ff646ad6248 16427->16454 16429->16412 16431 7ff646ad6213 16430->16431 16432 7ff646acfadc 16430->16432 16461 7ff646ad0348 EnterCriticalSection 16431->16461 16436 7ff646ad5608 16432->16436 16437 7ff646ad5611 16436->16437 16438 7ff646acfaf1 16436->16438 16439 7ff646ac4f78 _set_fmode 11 API calls 16437->16439 16438->16420 16442 7ff646ad5638 16438->16442 16440 7ff646ad5616 16439->16440 16441 7ff646aca950 _invalid_parameter_noinfo 37 API calls 16440->16441 16441->16438 16443 7ff646ad5641 16442->16443 16444 7ff646acfb02 16442->16444 16445 7ff646ac4f78 _set_fmode 11 API calls 16443->16445 16444->16420 16448 7ff646ad5668 16444->16448 16446 7ff646ad5646 16445->16446 16447 7ff646aca950 _invalid_parameter_noinfo 37 API calls 16446->16447 16447->16444 16449 7ff646ad5671 16448->16449 16453 7ff646acfb13 16448->16453 16450 7ff646ac4f78 _set_fmode 11 API calls 16449->16450 16451 7ff646ad5676 16450->16451 16452 7ff646aca950 _invalid_parameter_noinfo 37 API calls 16451->16452 16452->16453 16453->16420 16453->16427 16462 7ff646ad0348 EnterCriticalSection 16454->16462

                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                          Function 00007FF646AB8BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 0 7ff646ab8bd0-7ff646ab8d16 call 7ff646abc8c0 call 7ff646ab9400 SetConsoleCtrlHandler GetStartupInfoW call 7ff646ac5460 call 7ff646aca4ec call 7ff646ac878c call 7ff646ac5460 call 7ff646aca4ec call 7ff646ac878c call 7ff646ac5460 call 7ff646aca4ec call 7ff646ac878c GetCommandLineW CreateProcessW 23 7ff646ab8d18-7ff646ab8d38 GetLastError call 7ff646ab2c50 0->23 24 7ff646ab8d3d-7ff646ab8d79 RegisterClassW 0->24 31 7ff646ab9029-7ff646ab904f call 7ff646abc5c0 23->31 26 7ff646ab8d81-7ff646ab8dd5 CreateWindowExW 24->26 27 7ff646ab8d7b GetLastError 24->27 29 7ff646ab8ddf-7ff646ab8de4 ShowWindow 26->29 30 7ff646ab8dd7-7ff646ab8ddd GetLastError 26->30 27->26 32 7ff646ab8dea-7ff646ab8dfa WaitForSingleObject 29->32 30->32 34 7ff646ab8e78-7ff646ab8e7f 32->34 35 7ff646ab8dfc 32->35 36 7ff646ab8e81-7ff646ab8e91 WaitForSingleObject 34->36 37 7ff646ab8ec2-7ff646ab8ec9 34->37 39 7ff646ab8e00-7ff646ab8e03 35->39 40 7ff646ab8fe8-7ff646ab8ff2 36->40 41 7ff646ab8e97-7ff646ab8ea7 TerminateProcess 36->41 42 7ff646ab8fb0-7ff646ab8fc9 GetMessageW 37->42 43 7ff646ab8ecf-7ff646ab8ee5 QueryPerformanceFrequency QueryPerformanceCounter 37->43 44 7ff646ab8e05 GetLastError 39->44 45 7ff646ab8e0b-7ff646ab8e12 39->45 48 7ff646ab9001-7ff646ab9025 GetExitCodeProcess CloseHandle * 2 40->48 49 7ff646ab8ff4-7ff646ab8ffa DestroyWindow 40->49 50 7ff646ab8eaf-7ff646ab8ebd WaitForSingleObject 41->50 51 7ff646ab8ea9 GetLastError 41->51 46 7ff646ab8fdf-7ff646ab8fe6 42->46 47 7ff646ab8fcb-7ff646ab8fd9 TranslateMessage DispatchMessageW 42->47 52 7ff646ab8ef0-7ff646ab8f28 MsgWaitForMultipleObjects PeekMessageW 43->52 44->45 45->36 53 7ff646ab8e14-7ff646ab8e31 PeekMessageW 45->53 46->40 46->42 47->46 48->31 49->48 50->40 51->50 54 7ff646ab8f63-7ff646ab8f6a 52->54 55 7ff646ab8f2a 52->55 56 7ff646ab8e33-7ff646ab8e64 TranslateMessage DispatchMessageW PeekMessageW 53->56 57 7ff646ab8e66-7ff646ab8e76 WaitForSingleObject 53->57 54->42 59 7ff646ab8f6c-7ff646ab8f95 QueryPerformanceCounter 54->59 58 7ff646ab8f30-7ff646ab8f61 TranslateMessage DispatchMessageW PeekMessageW 55->58 56->56 56->57 57->34 57->39 58->54 58->58 59->52 60 7ff646ab8f9b-7ff646ab8fa2 59->60 60->40 61 7ff646ab8fa4-7ff646ab8fa8 60->61 61->42
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                                                                                                                                                          • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                                                                                                                                                          • API String ID: 3832162212-3165540532
                                                                                                                                                                                                          • Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
                                                                                                                                                                                                          • Instruction ID: 90a9b7065753a577a3d8aaa6a24ab6decbbff63b8eb4cc3ba588ef88bab95aef
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4CD17072A0CE8686EB50BF74E8542A9B761FF84B58F404235EE5D82A94DF3DD189C720
                                                                                                                                                                                                          Function 00007FF646AB1000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 62 7ff646ab1000-7ff646ab3806 call 7ff646abfe88 call 7ff646abfe90 call 7ff646abc8c0 call 7ff646ac5460 call 7ff646ac54f4 call 7ff646ab36b0 76 7ff646ab3814-7ff646ab3836 call 7ff646ab1950 62->76 77 7ff646ab3808-7ff646ab380f 62->77 83 7ff646ab383c-7ff646ab3856 call 7ff646ab1c80 76->83 84 7ff646ab391b-7ff646ab3931 call 7ff646ab45b0 76->84 78 7ff646ab3c97-7ff646ab3cb2 call 7ff646abc5c0 77->78 88 7ff646ab385b-7ff646ab389b call 7ff646ab8a20 83->88 89 7ff646ab3933-7ff646ab3960 call 7ff646ab7f80 84->89 90 7ff646ab396a-7ff646ab397f call 7ff646ab2710 84->90 97 7ff646ab38c1-7ff646ab38cc call 7ff646ac4fa0 88->97 98 7ff646ab389d-7ff646ab38a3 88->98 100 7ff646ab3984-7ff646ab39a6 call 7ff646ab1c80 89->100 101 7ff646ab3962-7ff646ab3965 call 7ff646ac00bc 89->101 102 7ff646ab3c8f 90->102 110 7ff646ab38d2-7ff646ab38e1 call 7ff646ab8a20 97->110 111 7ff646ab39fc-7ff646ab3a2a call 7ff646ab8b30 call 7ff646ab8b90 * 3 97->111 103 7ff646ab38af-7ff646ab38bd call 7ff646ab8b90 98->103 104 7ff646ab38a5-7ff646ab38ad 98->104 115 7ff646ab39b0-7ff646ab39b9 100->115 101->90 102->78 103->97 104->103 120 7ff646ab39f4-7ff646ab39f7 call 7ff646ac4fa0 110->120 121 7ff646ab38e7-7ff646ab38ed 110->121 138 7ff646ab3a2f-7ff646ab3a3e call 7ff646ab8a20 111->138 115->115 118 7ff646ab39bb-7ff646ab39d8 call 7ff646ab1950 115->118 118->88 127 7ff646ab39de-7ff646ab39ef call 7ff646ab2710 118->127 120->111 125 7ff646ab38f0-7ff646ab38fc 121->125 128 7ff646ab38fe-7ff646ab3903 125->128 129 7ff646ab3905-7ff646ab3908 125->129 127->102 128->125 128->129 129->120 132 7ff646ab390e-7ff646ab3916 call 7ff646ac4fa0 129->132 132->138 141 7ff646ab3a44-7ff646ab3a47 138->141 142 7ff646ab3b45-7ff646ab3b53 138->142 141->142 143 7ff646ab3a4d-7ff646ab3a50 141->143 144 7ff646ab3b59-7ff646ab3b5d 142->144 145 7ff646ab3a67 142->145 146 7ff646ab3b14-7ff646ab3b17 143->146 147 7ff646ab3a56-7ff646ab3a5a 143->147 148 7ff646ab3a6b-7ff646ab3a90 call 7ff646ac4fa0 144->148 145->148 150 7ff646ab3b2f-7ff646ab3b40 call 7ff646ab2710 146->150 151 7ff646ab3b19-7ff646ab3b1d 146->151 147->146 149 7ff646ab3a60 147->149 157 7ff646ab3a92-7ff646ab3aa6 call 7ff646ab8b30 148->157 158 7ff646ab3aab-7ff646ab3ac0 148->158 149->145 159 7ff646ab3c7f-7ff646ab3c87 150->159 151->150 153 7ff646ab3b1f-7ff646ab3b2a 151->153 153->148 157->158 161 7ff646ab3be8-7ff646ab3bfa call 7ff646ab8a20 158->161 162 7ff646ab3ac6-7ff646ab3aca 158->162 159->102 171 7ff646ab3c2e 161->171 172 7ff646ab3bfc-7ff646ab3c02 161->172 164 7ff646ab3ad0-7ff646ab3ae8 call 7ff646ac52c0 162->164 165 7ff646ab3bcd-7ff646ab3be2 call 7ff646ab1940 162->165 175 7ff646ab3b62-7ff646ab3b7a call 7ff646ac52c0 164->175 176 7ff646ab3aea-7ff646ab3b02 call 7ff646ac52c0 164->176 165->161 165->162 177 7ff646ab3c31-7ff646ab3c40 call 7ff646ac4fa0 171->177 173 7ff646ab3c1e-7ff646ab3c2c 172->173 174 7ff646ab3c04-7ff646ab3c1c 172->174 173->177 174->177 184 7ff646ab3b87-7ff646ab3b9f call 7ff646ac52c0 175->184 185 7ff646ab3b7c-7ff646ab3b80 175->185 176->165 186 7ff646ab3b08-7ff646ab3b0f 176->186 187 7ff646ab3d41-7ff646ab3d63 call 7ff646ab44d0 177->187 188 7ff646ab3c46-7ff646ab3c4a 177->188 197 7ff646ab3ba1-7ff646ab3ba5 184->197 198 7ff646ab3bac-7ff646ab3bc4 call 7ff646ac52c0 184->198 185->184 186->165 201 7ff646ab3d71-7ff646ab3d82 call 7ff646ab1c80 187->201 202 7ff646ab3d65-7ff646ab3d6f call 7ff646ab4620 187->202 190 7ff646ab3c50-7ff646ab3c5f call 7ff646ab90e0 188->190 191 7ff646ab3cd4-7ff646ab3ce6 call 7ff646ab8a20 188->191 204 7ff646ab3c61 190->204 205 7ff646ab3cb3-7ff646ab3cb6 call 7ff646ab8850 190->205 206 7ff646ab3d35-7ff646ab3d3c 191->206 207 7ff646ab3ce8-7ff646ab3ceb 191->207 197->198 198->165 219 7ff646ab3bc6 198->219 210 7ff646ab3d87-7ff646ab3d96 201->210 202->210 213 7ff646ab3c68 call 7ff646ab2710 204->213 218 7ff646ab3cbb-7ff646ab3cbd 205->218 206->213 207->206 214 7ff646ab3ced-7ff646ab3d10 call 7ff646ab1c80 207->214 216 7ff646ab3dc4-7ff646ab3dda call 7ff646ab9400 210->216 217 7ff646ab3d98-7ff646ab3d9f 210->217 226 7ff646ab3c6d-7ff646ab3c77 213->226 230 7ff646ab3d12-7ff646ab3d26 call 7ff646ab2710 call 7ff646ac4fa0 214->230 231 7ff646ab3d2b-7ff646ab3d33 call 7ff646ac4fa0 214->231 234 7ff646ab3de8-7ff646ab3e04 SetDllDirectoryW 216->234 235 7ff646ab3ddc 216->235 217->216 222 7ff646ab3da1-7ff646ab3da5 217->222 224 7ff646ab3cbf-7ff646ab3cc6 218->224 225 7ff646ab3cc8-7ff646ab3ccf 218->225 219->165 222->216 228 7ff646ab3da7-7ff646ab3dbe SetDllDirectoryW LoadLibraryExW 222->228 224->213 225->210 226->159 228->216 230->226 231->210 238 7ff646ab3f01-7ff646ab3f08 234->238 239 7ff646ab3e0a-7ff646ab3e19 call 7ff646ab8a20 234->239 235->234 241 7ff646ab3f0e-7ff646ab3f15 238->241 242 7ff646ab3ffc-7ff646ab4004 238->242 251 7ff646ab3e32-7ff646ab3e3c call 7ff646ac4fa0 239->251 252 7ff646ab3e1b-7ff646ab3e21 239->252 241->242 245 7ff646ab3f1b-7ff646ab3f25 call 7ff646ab33c0 241->245 246 7ff646ab4029-7ff646ab405b call 7ff646ab36a0 call 7ff646ab3360 call 7ff646ab3670 call 7ff646ab6fb0 call 7ff646ab6d60 242->246 247 7ff646ab4006-7ff646ab4023 PostMessageW GetMessageW 242->247 245->226 259 7ff646ab3f2b-7ff646ab3f3f call 7ff646ab90c0 245->259 247->246 261 7ff646ab3ef2-7ff646ab3efc call 7ff646ab8b30 251->261 262 7ff646ab3e42-7ff646ab3e48 251->262 256 7ff646ab3e23-7ff646ab3e2b 252->256 257 7ff646ab3e2d-7ff646ab3e2f 252->257 256->257 257->251 271 7ff646ab3f41-7ff646ab3f5e PostMessageW GetMessageW 259->271 272 7ff646ab3f64-7ff646ab3fa0 call 7ff646ab8b30 call 7ff646ab8bd0 call 7ff646ab6fb0 call 7ff646ab6d60 call 7ff646ab8ad0 259->272 261->238 262->261 266 7ff646ab3e4e-7ff646ab3e54 262->266 269 7ff646ab3e5f-7ff646ab3e61 266->269 270 7ff646ab3e56-7ff646ab3e58 266->270 269->238 274 7ff646ab3e67-7ff646ab3e83 call 7ff646ab6db0 call 7ff646ab7330 269->274 270->274 275 7ff646ab3e5a 270->275 271->272 307 7ff646ab3fa5-7ff646ab3fa7 272->307 290 7ff646ab3e8e-7ff646ab3e95 274->290 291 7ff646ab3e85-7ff646ab3e8c 274->291 275->238 294 7ff646ab3eaf-7ff646ab3eb9 call 7ff646ab71a0 290->294 295 7ff646ab3e97-7ff646ab3ea4 call 7ff646ab6df0 290->295 293 7ff646ab3edb-7ff646ab3ef0 call 7ff646ab2a50 call 7ff646ab6fb0 call 7ff646ab6d60 291->293 293->238 305 7ff646ab3ec4-7ff646ab3ed2 call 7ff646ab74e0 294->305 306 7ff646ab3ebb-7ff646ab3ec2 294->306 295->294 304 7ff646ab3ea6-7ff646ab3ead 295->304 304->293 305->238 319 7ff646ab3ed4 305->319 306->293 310 7ff646ab3fe9-7ff646ab3ff7 call 7ff646ab1900 307->310 311 7ff646ab3fa9-7ff646ab3fb3 call 7ff646ab9200 307->311 310->226 311->310 321 7ff646ab3fb5-7ff646ab3fca 311->321 319->293 322 7ff646ab3fe4 call 7ff646ab2a50 321->322 323 7ff646ab3fcc-7ff646ab3fdf call 7ff646ab2710 call 7ff646ab1900 321->323 322->310 323->226
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                          • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
                                                                                                                                                                                                          • API String ID: 2776309574-4232158417
                                                                                                                                                                                                          • Opcode ID: 221ee4957dd18ffe06ee3afddcba002a7644656f480b66111b2d55fc76433b33
                                                                                                                                                                                                          • Instruction ID: e663eb8b3e3a5c81446f7c51d033023ef0ae220e8eabbe53520916e19b31bc26
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 221ee4957dd18ffe06ee3afddcba002a7644656f480b66111b2d55fc76433b33
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 54328F61A0CE8A91FB15FB2594543B9E791AF45B80F844036DB5EC32D6EF2EE5D8C320
                                                                                                                                                                                                          Function 00007FF646AD5C70 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 477 7ff646ad5c70-7ff646ad5cab call 7ff646ad55f8 call 7ff646ad5600 call 7ff646ad5668 484 7ff646ad5ed5-7ff646ad5f21 call 7ff646aca970 call 7ff646ad55f8 call 7ff646ad5600 call 7ff646ad5668 477->484 485 7ff646ad5cb1-7ff646ad5cbc call 7ff646ad5608 477->485 512 7ff646ad605f-7ff646ad60cd call 7ff646aca970 call 7ff646ad15e8 484->512 513 7ff646ad5f27-7ff646ad5f32 call 7ff646ad5608 484->513 485->484 491 7ff646ad5cc2-7ff646ad5ccc 485->491 493 7ff646ad5cee-7ff646ad5cf2 491->493 494 7ff646ad5cce-7ff646ad5cd1 491->494 495 7ff646ad5cf5-7ff646ad5cfd 493->495 497 7ff646ad5cd4-7ff646ad5cdf 494->497 495->495 498 7ff646ad5cff-7ff646ad5d12 call 7ff646acd66c 495->498 500 7ff646ad5ce1-7ff646ad5ce8 497->500 501 7ff646ad5cea-7ff646ad5cec 497->501 507 7ff646ad5d14-7ff646ad5d16 call 7ff646aca9b8 498->507 508 7ff646ad5d2a-7ff646ad5d36 call 7ff646aca9b8 498->508 500->497 500->501 501->493 502 7ff646ad5d1b-7ff646ad5d29 501->502 507->502 519 7ff646ad5d3d-7ff646ad5d45 508->519 531 7ff646ad60cf-7ff646ad60d6 512->531 532 7ff646ad60db-7ff646ad60de 512->532 513->512 521 7ff646ad5f38-7ff646ad5f43 call 7ff646ad5638 513->521 519->519 520 7ff646ad5d47-7ff646ad5d58 call 7ff646ad04e4 519->520 520->484 529 7ff646ad5d5e-7ff646ad5db4 call 7ff646ada540 * 4 call 7ff646ad5b8c 520->529 521->512 530 7ff646ad5f49-7ff646ad5f6c call 7ff646aca9b8 GetTimeZoneInformation 521->530 590 7ff646ad5db6-7ff646ad5dba 529->590 546 7ff646ad5f72-7ff646ad5f93 530->546 547 7ff646ad6034-7ff646ad605e call 7ff646ad55f0 call 7ff646ad55e0 call 7ff646ad55e8 530->547 535 7ff646ad616b-7ff646ad616e 531->535 536 7ff646ad6115-7ff646ad6128 call 7ff646acd66c 532->536 537 7ff646ad60e0 532->537 538 7ff646ad60e3 call 7ff646ad5eec 535->538 539 7ff646ad6174-7ff646ad617c call 7ff646ad5c70 535->539 550 7ff646ad6133-7ff646ad614e call 7ff646ad15e8 536->550 551 7ff646ad612a 536->551 537->538 556 7ff646ad60e8-7ff646ad6114 call 7ff646aca9b8 call 7ff646abc5c0 538->556 539->556 553 7ff646ad5f95-7ff646ad5f9b 546->553 554 7ff646ad5f9e-7ff646ad5fa5 546->554 575 7ff646ad6155-7ff646ad6167 call 7ff646aca9b8 550->575 576 7ff646ad6150-7ff646ad6153 550->576 557 7ff646ad612c-7ff646ad6131 call 7ff646aca9b8 551->557 553->554 559 7ff646ad5fa7-7ff646ad5faf 554->559 560 7ff646ad5fb9 554->560 557->537 559->560 568 7ff646ad5fb1-7ff646ad5fb7 559->568 567 7ff646ad5fbb-7ff646ad602f call 7ff646ada540 * 4 call 7ff646ad2bcc call 7ff646ad6184 * 2 560->567 567->547 568->567 575->535 576->557 592 7ff646ad5dc0-7ff646ad5dc4 590->592 593 7ff646ad5dbc 590->593 592->590 594 7ff646ad5dc6-7ff646ad5deb call 7ff646ac6bc8 592->594 593->592 600 7ff646ad5dee-7ff646ad5df2 594->600 602 7ff646ad5df4-7ff646ad5dff 600->602 603 7ff646ad5e01-7ff646ad5e05 600->603 602->603 605 7ff646ad5e07-7ff646ad5e0b 602->605 603->600 607 7ff646ad5e8c-7ff646ad5e90 605->607 608 7ff646ad5e0d-7ff646ad5e35 call 7ff646ac6bc8 605->608 610 7ff646ad5e92-7ff646ad5e94 607->610 611 7ff646ad5e97-7ff646ad5ea4 607->611 617 7ff646ad5e53-7ff646ad5e57 608->617 618 7ff646ad5e37 608->618 610->611 613 7ff646ad5ebf-7ff646ad5ece call 7ff646ad55f0 call 7ff646ad55e0 611->613 614 7ff646ad5ea6-7ff646ad5ebc call 7ff646ad5b8c 611->614 613->484 614->613 617->607 623 7ff646ad5e59-7ff646ad5e77 call 7ff646ac6bc8 617->623 621 7ff646ad5e3a-7ff646ad5e41 618->621 621->617 625 7ff646ad5e43-7ff646ad5e51 621->625 629 7ff646ad5e83-7ff646ad5e8a 623->629 625->617 625->621 629->607 630 7ff646ad5e79-7ff646ad5e7d 629->630 630->607 631 7ff646ad5e7f 630->631 631->629
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF646AD5CB5
                                                                                                                                                                                                            • Part of subcall function 00007FF646AD5608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF646AD561C
                                                                                                                                                                                                            • Part of subcall function 00007FF646ACA9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF646AD2D92,?,?,?,00007FF646AD2DCF,?,?,00000000,00007FF646AD3295,?,?,?,00007FF646AD31C7), ref: 00007FF646ACA9CE
                                                                                                                                                                                                            • Part of subcall function 00007FF646ACA9B8: GetLastError.KERNEL32(?,?,?,00007FF646AD2D92,?,?,?,00007FF646AD2DCF,?,?,00000000,00007FF646AD3295,?,?,?,00007FF646AD31C7), ref: 00007FF646ACA9D8
                                                                                                                                                                                                            • Part of subcall function 00007FF646ACA970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF646ACA94F,?,?,?,?,?,00007FF646ACA83A), ref: 00007FF646ACA979
                                                                                                                                                                                                            • Part of subcall function 00007FF646ACA970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF646ACA94F,?,?,?,?,?,00007FF646ACA83A), ref: 00007FF646ACA99E
                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF646AD5CA4
                                                                                                                                                                                                            • Part of subcall function 00007FF646AD5668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF646AD567C
                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF646AD5F1A
                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF646AD5F2B
                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF646AD5F3C
                                                                                                                                                                                                          • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF646AD617C), ref: 00007FF646AD5F63
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                          • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                          • API String ID: 4070488512-239921721
                                                                                                                                                                                                          • Opcode ID: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
                                                                                                                                                                                                          • Instruction ID: 55578c49a2b50647e8dd274050e19fb689096193c7310f5c576fc5e830db80a3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 89D1B036A0CA4286E724FF25D4411B9E7A2EF84794F448136EE4DC7686DF3EE8C18760
                                                                                                                                                                                                          Function 00007FF646AD69D4 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 691 7ff646ad69d4-7ff646ad6a47 call 7ff646ad6708 694 7ff646ad6a61-7ff646ad6a6b call 7ff646ac8590 691->694 695 7ff646ad6a49-7ff646ad6a52 call 7ff646ac4f58 691->695 700 7ff646ad6a6d-7ff646ad6a84 call 7ff646ac4f58 call 7ff646ac4f78 694->700 701 7ff646ad6a86-7ff646ad6aef CreateFileW 694->701 702 7ff646ad6a55-7ff646ad6a5c call 7ff646ac4f78 695->702 700->702 704 7ff646ad6af1-7ff646ad6af7 701->704 705 7ff646ad6b6c-7ff646ad6b77 GetFileType 701->705 718 7ff646ad6da2-7ff646ad6dc2 702->718 708 7ff646ad6b39-7ff646ad6b67 GetLastError call 7ff646ac4eec 704->708 709 7ff646ad6af9-7ff646ad6afd 704->709 711 7ff646ad6bca-7ff646ad6bd1 705->711 712 7ff646ad6b79-7ff646ad6bb4 GetLastError call 7ff646ac4eec CloseHandle 705->712 708->702 709->708 716 7ff646ad6aff-7ff646ad6b37 CreateFileW 709->716 714 7ff646ad6bd3-7ff646ad6bd7 711->714 715 7ff646ad6bd9-7ff646ad6bdc 711->715 712->702 725 7ff646ad6bba-7ff646ad6bc5 call 7ff646ac4f78 712->725 722 7ff646ad6be2-7ff646ad6c37 call 7ff646ac84a8 714->722 715->722 723 7ff646ad6bde 715->723 716->705 716->708 730 7ff646ad6c56-7ff646ad6c87 call 7ff646ad6488 722->730 731 7ff646ad6c39-7ff646ad6c45 call 7ff646ad6910 722->731 723->722 725->702 736 7ff646ad6c8d-7ff646ad6ccf 730->736 737 7ff646ad6c89-7ff646ad6c8b 730->737 731->730 738 7ff646ad6c47 731->738 740 7ff646ad6cf1-7ff646ad6cfc 736->740 741 7ff646ad6cd1-7ff646ad6cd5 736->741 739 7ff646ad6c49-7ff646ad6c51 call 7ff646acab30 737->739 738->739 739->718 744 7ff646ad6d02-7ff646ad6d06 740->744 745 7ff646ad6da0 740->745 741->740 743 7ff646ad6cd7-7ff646ad6cec 741->743 743->740 744->745 747 7ff646ad6d0c-7ff646ad6d51 CloseHandle CreateFileW 744->747 745->718 748 7ff646ad6d53-7ff646ad6d81 GetLastError call 7ff646ac4eec call 7ff646ac86d0 747->748 749 7ff646ad6d86-7ff646ad6d9b 747->749 748->749 749->745
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1617910340-0
                                                                                                                                                                                                          • Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
                                                                                                                                                                                                          • Instruction ID: 4b9469eb6c5fc31cb35a5f7cffc3118790cff9842ea38c706e8772ccd5f79d83
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D3C1D032B28E4585EB50EFA4C4902AC7772FB49B98F055229DE2E977D4CF3AE495C310
                                                                                                                                                                                                          Function 00007FF646AB83B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • FindFirstFileW.KERNELBASE(?,00007FF646AB8B09,00007FF646AB3FA5), ref: 00007FF646AB841B
                                                                                                                                                                                                          • RemoveDirectoryW.KERNEL32(?,00007FF646AB8B09,00007FF646AB3FA5), ref: 00007FF646AB849E
                                                                                                                                                                                                          • DeleteFileW.KERNELBASE(?,00007FF646AB8B09,00007FF646AB3FA5), ref: 00007FF646AB84BD
                                                                                                                                                                                                          • FindNextFileW.KERNELBASE(?,00007FF646AB8B09,00007FF646AB3FA5), ref: 00007FF646AB84CB
                                                                                                                                                                                                          • FindClose.KERNEL32(?,00007FF646AB8B09,00007FF646AB3FA5), ref: 00007FF646AB84DC
                                                                                                                                                                                                          • RemoveDirectoryW.KERNELBASE(?,00007FF646AB8B09,00007FF646AB3FA5), ref: 00007FF646AB84E5
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                                                                                                                                                          • String ID: %s\*
                                                                                                                                                                                                          • API String ID: 1057558799-766152087
                                                                                                                                                                                                          • Opcode ID: 39a93d91a788addd72801eeb202cf5dd5373a6ceabdc1da620128e14205563d9
                                                                                                                                                                                                          • Instruction ID: 8c86abc49579f10d6e34541715bbc53c9d2aeefcb6a30df112c6c6214f4081e7
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 39a93d91a788addd72801eeb202cf5dd5373a6ceabdc1da620128e14205563d9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C5418431A0CD4685EB60BB28E4545B9A364FF94B54F400232EA5DC36D4DF3ED58AC721
                                                                                                                                                                                                          Function 00007FF646AD5EEC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 1012 7ff646ad5eec-7ff646ad5f21 call 7ff646ad55f8 call 7ff646ad5600 call 7ff646ad5668 1019 7ff646ad605f-7ff646ad60cd call 7ff646aca970 call 7ff646ad15e8 1012->1019 1020 7ff646ad5f27-7ff646ad5f32 call 7ff646ad5608 1012->1020 1032 7ff646ad60cf-7ff646ad60d6 1019->1032 1033 7ff646ad60db-7ff646ad60de 1019->1033 1020->1019 1025 7ff646ad5f38-7ff646ad5f43 call 7ff646ad5638 1020->1025 1025->1019 1031 7ff646ad5f49-7ff646ad5f6c call 7ff646aca9b8 GetTimeZoneInformation 1025->1031 1044 7ff646ad5f72-7ff646ad5f93 1031->1044 1045 7ff646ad6034-7ff646ad605e call 7ff646ad55f0 call 7ff646ad55e0 call 7ff646ad55e8 1031->1045 1035 7ff646ad616b-7ff646ad616e 1032->1035 1036 7ff646ad6115-7ff646ad6128 call 7ff646acd66c 1033->1036 1037 7ff646ad60e0 1033->1037 1038 7ff646ad60e3 call 7ff646ad5eec 1035->1038 1039 7ff646ad6174-7ff646ad617c call 7ff646ad5c70 1035->1039 1048 7ff646ad6133-7ff646ad614e call 7ff646ad15e8 1036->1048 1049 7ff646ad612a 1036->1049 1037->1038 1053 7ff646ad60e8-7ff646ad6114 call 7ff646aca9b8 call 7ff646abc5c0 1038->1053 1039->1053 1050 7ff646ad5f95-7ff646ad5f9b 1044->1050 1051 7ff646ad5f9e-7ff646ad5fa5 1044->1051 1069 7ff646ad6155-7ff646ad6167 call 7ff646aca9b8 1048->1069 1070 7ff646ad6150-7ff646ad6153 1048->1070 1054 7ff646ad612c-7ff646ad6131 call 7ff646aca9b8 1049->1054 1050->1051 1055 7ff646ad5fa7-7ff646ad5faf 1051->1055 1056 7ff646ad5fb9 1051->1056 1054->1037 1055->1056 1063 7ff646ad5fb1-7ff646ad5fb7 1055->1063 1062 7ff646ad5fbb-7ff646ad602f call 7ff646ada540 * 4 call 7ff646ad2bcc call 7ff646ad6184 * 2 1056->1062 1062->1045 1063->1062 1069->1035 1070->1054
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF646AD5F1A
                                                                                                                                                                                                            • Part of subcall function 00007FF646AD5668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF646AD567C
                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF646AD5F2B
                                                                                                                                                                                                            • Part of subcall function 00007FF646AD5608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF646AD561C
                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF646AD5F3C
                                                                                                                                                                                                            • Part of subcall function 00007FF646AD5638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF646AD564C
                                                                                                                                                                                                            • Part of subcall function 00007FF646ACA9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF646AD2D92,?,?,?,00007FF646AD2DCF,?,?,00000000,00007FF646AD3295,?,?,?,00007FF646AD31C7), ref: 00007FF646ACA9CE
                                                                                                                                                                                                            • Part of subcall function 00007FF646ACA9B8: GetLastError.KERNEL32(?,?,?,00007FF646AD2D92,?,?,?,00007FF646AD2DCF,?,?,00000000,00007FF646AD3295,?,?,?,00007FF646AD31C7), ref: 00007FF646ACA9D8
                                                                                                                                                                                                          • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF646AD617C), ref: 00007FF646AD5F63
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                          • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                          • API String ID: 3458911817-239921721
                                                                                                                                                                                                          • Opcode ID: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
                                                                                                                                                                                                          • Instruction ID: 462c1a6e787762f53ce4442e65868ce01f5fa0c96262af21b11dcfb6fb0b5114
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3F515332A0CA4286E714FF25D8815B9E762FF48784F449135EE4DC7696DF3EE48087A0
                                                                                                                                                                                                          Function 00007FF646AB92F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Find$CloseFileFirst
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2295610775-0
                                                                                                                                                                                                          • Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
                                                                                                                                                                                                          • Instruction ID: 94e0381262aa3be1df1a36332a5e030d073c09c9b33a0a3afa61ecf0f50070c9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7BF06872A1CB4586F7A0BB60B45976AF390FB84764F044339DA6D426D4DF3DD0898A10
                                                                                                                                                                                                          Function 00007FF646AD0938 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1010374628-0
                                                                                                                                                                                                          • Opcode ID: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
                                                                                                                                                                                                          • Instruction ID: bfdaa5846c838cf4e90fe4b9c7f55c12ee1b8b531be475d0fd3672fd7e076044
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0202B022A0DE4240FA65BF21B445279E692AF45BA0F554A35DE9EC73D2DE3FE4C18330
                                                                                                                                                                                                          Function 00007FF646AB1950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 329 7ff646ab1950-7ff646ab198b call 7ff646ab45b0 332 7ff646ab1991-7ff646ab19d1 call 7ff646ab7f80 329->332 333 7ff646ab1c4e-7ff646ab1c72 call 7ff646abc5c0 329->333 338 7ff646ab19d7-7ff646ab19e7 call 7ff646ac0744 332->338 339 7ff646ab1c3b-7ff646ab1c3e call 7ff646ac00bc 332->339 344 7ff646ab1a08-7ff646ab1a24 call 7ff646ac040c 338->344 345 7ff646ab19e9-7ff646ab1a03 call 7ff646ac4f78 call 7ff646ab2910 338->345 343 7ff646ab1c43-7ff646ab1c4b 339->343 343->333 350 7ff646ab1a45-7ff646ab1a5a call 7ff646ac4f98 344->350 351 7ff646ab1a26-7ff646ab1a40 call 7ff646ac4f78 call 7ff646ab2910 344->351 345->339 359 7ff646ab1a5c-7ff646ab1a76 call 7ff646ac4f78 call 7ff646ab2910 350->359 360 7ff646ab1a7b-7ff646ab1afc call 7ff646ab1c80 * 2 call 7ff646ac0744 350->360 351->339 359->339 371 7ff646ab1b01-7ff646ab1b14 call 7ff646ac4fb4 360->371 374 7ff646ab1b35-7ff646ab1b4e call 7ff646ac040c 371->374 375 7ff646ab1b16-7ff646ab1b30 call 7ff646ac4f78 call 7ff646ab2910 371->375 380 7ff646ab1b50-7ff646ab1b6a call 7ff646ac4f78 call 7ff646ab2910 374->380 381 7ff646ab1b6f-7ff646ab1b8b call 7ff646ac0180 374->381 375->339 380->339 389 7ff646ab1b9e-7ff646ab1bac 381->389 390 7ff646ab1b8d-7ff646ab1b99 call 7ff646ab2710 381->390 389->339 393 7ff646ab1bb2-7ff646ab1bb9 389->393 390->339 395 7ff646ab1bc1-7ff646ab1bc7 393->395 396 7ff646ab1be0-7ff646ab1bef 395->396 397 7ff646ab1bc9-7ff646ab1bd6 395->397 396->396 398 7ff646ab1bf1-7ff646ab1bfa 396->398 397->398 399 7ff646ab1c0f 398->399 400 7ff646ab1bfc-7ff646ab1bff 398->400 402 7ff646ab1c11-7ff646ab1c24 399->402 400->399 401 7ff646ab1c01-7ff646ab1c04 400->401 401->399 403 7ff646ab1c06-7ff646ab1c09 401->403 404 7ff646ab1c26 402->404 405 7ff646ab1c2d-7ff646ab1c39 402->405 403->399 406 7ff646ab1c0b-7ff646ab1c0d 403->406 404->405 405->339 405->395 406->402
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB7F80: _fread_nolock.LIBCMT ref: 00007FF646AB802A
                                                                                                                                                                                                          • _fread_nolock.LIBCMT ref: 00007FF646AB1A1B
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB2910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF646AB1B6A), ref: 00007FF646AB295E
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _fread_nolock$CurrentProcess
                                                                                                                                                                                                          • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                          • API String ID: 2397952137-3497178890
                                                                                                                                                                                                          • Opcode ID: f8096cce2067d15cebc3bdaacbdc60c8b6a2e1e4d6ea3146b715ff88ef4c1dca
                                                                                                                                                                                                          • Instruction ID: fb68b462c496d3267f3d19e048758a998510c19fa25a4a07b9e80cc3ea4f54ed
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f8096cce2067d15cebc3bdaacbdc60c8b6a2e1e4d6ea3146b715ff88ef4c1dca
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5A81C671A0CE8A86E760FB24D0446F9A391FF45B84F404435DA8EC779ADE3EE5C58760
                                                                                                                                                                                                          Function 00007FF646AB1600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 407 7ff646ab1600-7ff646ab1611 408 7ff646ab1613-7ff646ab161c call 7ff646ab1050 407->408 409 7ff646ab1637-7ff646ab1651 call 7ff646ab45b0 407->409 414 7ff646ab162e-7ff646ab1636 408->414 415 7ff646ab161e-7ff646ab1629 call 7ff646ab2710 408->415 416 7ff646ab1682-7ff646ab169c call 7ff646ab45b0 409->416 417 7ff646ab1653-7ff646ab1681 call 7ff646ac4f78 call 7ff646ab2910 409->417 415->414 424 7ff646ab169e-7ff646ab16b3 call 7ff646ab2710 416->424 425 7ff646ab16b8-7ff646ab16cf call 7ff646ac0744 416->425 431 7ff646ab1821-7ff646ab1824 call 7ff646ac00bc 424->431 432 7ff646ab16d1-7ff646ab16f4 call 7ff646ac4f78 call 7ff646ab2910 425->432 433 7ff646ab16f9-7ff646ab16fd 425->433 440 7ff646ab1829-7ff646ab183b 431->440 445 7ff646ab1819-7ff646ab181c call 7ff646ac00bc 432->445 434 7ff646ab16ff-7ff646ab170b call 7ff646ab1210 433->434 435 7ff646ab1717-7ff646ab1737 call 7ff646ac4fb4 433->435 442 7ff646ab1710-7ff646ab1712 434->442 446 7ff646ab1761-7ff646ab176c 435->446 447 7ff646ab1739-7ff646ab175c call 7ff646ac4f78 call 7ff646ab2910 435->447 442->445 445->431 451 7ff646ab1802-7ff646ab180a call 7ff646ac4fa0 446->451 452 7ff646ab1772-7ff646ab1777 446->452 460 7ff646ab180f-7ff646ab1814 447->460 451->460 455 7ff646ab1780-7ff646ab17a2 call 7ff646ac040c 452->455 462 7ff646ab17a4-7ff646ab17bc call 7ff646ac0b4c 455->462 463 7ff646ab17da-7ff646ab17e6 call 7ff646ac4f78 455->463 460->445 468 7ff646ab17be-7ff646ab17c1 462->468 469 7ff646ab17c5-7ff646ab17d8 call 7ff646ac4f78 462->469 470 7ff646ab17ed-7ff646ab17f8 call 7ff646ab2910 463->470 468->455 471 7ff646ab17c3 468->471 469->470 474 7ff646ab17fd 470->474 471->474 474->451
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                          • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                          • API String ID: 2050909247-1550345328
                                                                                                                                                                                                          • Opcode ID: e33f210c217a6ffcc68d29fe46a5e37371bf7e5689aecd108357e4c1f5d99a01
                                                                                                                                                                                                          • Instruction ID: 7cea0f6b518ac829e0a57dd3ded8ca75e6943cbfbf62f1eea1e4938712e7af52
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e33f210c217a6ffcc68d29fe46a5e37371bf7e5689aecd108357e4c1f5d99a01
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4851CE61B0CE4B92EA10BB6194001B9E361BF44B94F404532EE0D8779ADF3EE9D9C760
                                                                                                                                                                                                          Function 00007FF646AB8850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetTempPathW.KERNEL32(?,?,00000000,00007FF646AB3CBB), ref: 00007FF646AB88F4
                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,00000000,00007FF646AB3CBB), ref: 00007FF646AB88FA
                                                                                                                                                                                                          • CreateDirectoryW.KERNELBASE(?,00000000,00007FF646AB3CBB), ref: 00007FF646AB893C
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB8A20: GetEnvironmentVariableW.KERNEL32(00007FF646AB388E), ref: 00007FF646AB8A57
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB8A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF646AB8A79
                                                                                                                                                                                                            • Part of subcall function 00007FF646AC82A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF646AC82C1
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB2810: MessageBoxW.USER32 ref: 00007FF646AB28EA
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                                                                                          • API String ID: 3563477958-1339014028
                                                                                                                                                                                                          • Opcode ID: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
                                                                                                                                                                                                          • Instruction ID: 2546f8c976cc7f5e1d053ae623ef2df7c0b73ed9b1cb8fb79c5707d50c9421b4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E341C211A0DE4645FA20FB65A8552FA9391AF89FC4F400031EE0ED77DADE3EE585C361
                                                                                                                                                                                                          Function 00007FF646AB1210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 754 7ff646ab1210-7ff646ab126d call 7ff646abbdf0 757 7ff646ab126f-7ff646ab1296 call 7ff646ab2710 754->757 758 7ff646ab1297-7ff646ab12af call 7ff646ac4fb4 754->758 763 7ff646ab12b1-7ff646ab12cf call 7ff646ac4f78 call 7ff646ab2910 758->763 764 7ff646ab12d4-7ff646ab12e4 call 7ff646ac4fb4 758->764 775 7ff646ab1439-7ff646ab144e call 7ff646abbad0 call 7ff646ac4fa0 * 2 763->775 770 7ff646ab1309-7ff646ab131b 764->770 771 7ff646ab12e6-7ff646ab1304 call 7ff646ac4f78 call 7ff646ab2910 764->771 774 7ff646ab1320-7ff646ab1345 call 7ff646ac040c 770->774 771->775 782 7ff646ab1431 774->782 783 7ff646ab134b-7ff646ab1355 call 7ff646ac0180 774->783 791 7ff646ab1453-7ff646ab146d 775->791 782->775 783->782 790 7ff646ab135b-7ff646ab1367 783->790 792 7ff646ab1370-7ff646ab1398 call 7ff646aba230 790->792 795 7ff646ab1416-7ff646ab142c call 7ff646ab2710 792->795 796 7ff646ab139a-7ff646ab139d 792->796 795->782 797 7ff646ab1411 796->797 798 7ff646ab139f-7ff646ab13a9 796->798 797->795 800 7ff646ab13d4-7ff646ab13d7 798->800 801 7ff646ab13ab-7ff646ab13b9 call 7ff646ac0b4c 798->801 802 7ff646ab13d9-7ff646ab13e7 call 7ff646ad9ea0 800->802 803 7ff646ab13ea-7ff646ab13ef 800->803 807 7ff646ab13be-7ff646ab13c1 801->807 802->803 803->792 806 7ff646ab13f5-7ff646ab13f8 803->806 809 7ff646ab140c-7ff646ab140f 806->809 810 7ff646ab13fa-7ff646ab13fd 806->810 811 7ff646ab13cf-7ff646ab13d2 807->811 812 7ff646ab13c3-7ff646ab13cd call 7ff646ac0180 807->812 809->782 810->795 813 7ff646ab13ff-7ff646ab1407 810->813 811->795 812->803 812->811 813->774
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                          • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                          • API String ID: 2050909247-2813020118
                                                                                                                                                                                                          • Opcode ID: 5203fde90a14cfca52878d148793ed0f56fa2f4a03ba52266beea290f2c18543
                                                                                                                                                                                                          • Instruction ID: 94b5e9199faa9a2437e9a99d68bb45cad878c6760aeae8a0a6c71f3252fb2062
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5203fde90a14cfca52878d148793ed0f56fa2f4a03ba52266beea290f2c18543
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8D51F762A0CE4685E660BB11A4403BAE291FF85F94F444135EE4EC77D9EF3EE985C720
                                                                                                                                                                                                          Function 00007FF646ACED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,?,00007FF646ACF11A,?,?,-00000018,00007FF646ACADC3,?,?,?,00007FF646ACACBA,?,?,?,00007FF646AC5FAE), ref: 00007FF646ACEEFC
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,?,?,00007FF646ACF11A,?,?,-00000018,00007FF646ACADC3,?,?,?,00007FF646ACACBA,?,?,?,00007FF646AC5FAE), ref: 00007FF646ACEF08
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                          • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                          • API String ID: 3013587201-537541572
                                                                                                                                                                                                          • Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
                                                                                                                                                                                                          • Instruction ID: 14ecf939b8a505e272a2ee51ba5cea1676fcc5a38141318f937c7cfc00b2c5a6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4141F261B1DE1291FB16FB16A804675A3D1BF49BD0F884539ED1EC7784EE3EE8858320
                                                                                                                                                                                                          Function 00007FF646AB36B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(?,00007FF646AB3804), ref: 00007FF646AB36E1
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF646AB3804), ref: 00007FF646AB36EB
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF646AB3706,?,00007FF646AB3804), ref: 00007FF646AB2C9E
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF646AB3706,?,00007FF646AB3804), ref: 00007FF646AB2D63
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB2C50: MessageBoxW.USER32 ref: 00007FF646AB2D99
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
                                                                                                                                                                                                          • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                          • API String ID: 3187769757-2863816727
                                                                                                                                                                                                          • Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
                                                                                                                                                                                                          • Instruction ID: f4218f39d8e50210100c9c618269aac41dbcf59cfdedcadee4aa92cf82d355c3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1821B8A1F1CE4691FA20F720E8153B6E255BF48B95F804136EB5EC25D6EE2EE5C4C720
                                                                                                                                                                                                          Function 00007FF646ACBACC Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 899 7ff646acbacc-7ff646acbaf2 900 7ff646acbaf4-7ff646acbb08 call 7ff646ac4f58 call 7ff646ac4f78 899->900 901 7ff646acbb0d-7ff646acbb11 899->901 915 7ff646acbefe 900->915 902 7ff646acbee7-7ff646acbef3 call 7ff646ac4f58 call 7ff646ac4f78 901->902 903 7ff646acbb17-7ff646acbb1e 901->903 922 7ff646acbef9 call 7ff646aca950 902->922 903->902 905 7ff646acbb24-7ff646acbb52 903->905 905->902 909 7ff646acbb58-7ff646acbb5f 905->909 912 7ff646acbb61-7ff646acbb73 call 7ff646ac4f58 call 7ff646ac4f78 909->912 913 7ff646acbb78-7ff646acbb7b 909->913 912->922 918 7ff646acbee3-7ff646acbee5 913->918 919 7ff646acbb81-7ff646acbb87 913->919 920 7ff646acbf01-7ff646acbf18 915->920 918->920 919->918 923 7ff646acbb8d-7ff646acbb90 919->923 922->915 923->912 926 7ff646acbb92-7ff646acbbb7 923->926 928 7ff646acbbea-7ff646acbbf1 926->928 929 7ff646acbbb9-7ff646acbbbb 926->929 932 7ff646acbbf3-7ff646acbc1b call 7ff646acd66c call 7ff646aca9b8 * 2 928->932 933 7ff646acbbc6-7ff646acbbdd call 7ff646ac4f58 call 7ff646ac4f78 call 7ff646aca950 928->933 930 7ff646acbbe2-7ff646acbbe8 929->930 931 7ff646acbbbd-7ff646acbbc4 929->931 935 7ff646acbc68-7ff646acbc7f 930->935 931->930 931->933 959 7ff646acbc1d-7ff646acbc33 call 7ff646ac4f78 call 7ff646ac4f58 932->959 960 7ff646acbc38-7ff646acbc63 call 7ff646acc2f4 932->960 963 7ff646acbd70 933->963 938 7ff646acbc81-7ff646acbc89 935->938 939 7ff646acbcfa-7ff646acbd04 call 7ff646ad398c 935->939 938->939 943 7ff646acbc8b-7ff646acbc8d 938->943 950 7ff646acbd8e 939->950 951 7ff646acbd0a-7ff646acbd1f 939->951 943->939 947 7ff646acbc8f-7ff646acbca5 943->947 947->939 952 7ff646acbca7-7ff646acbcb3 947->952 955 7ff646acbd93-7ff646acbdb3 ReadFile 950->955 951->950 957 7ff646acbd21-7ff646acbd33 GetConsoleMode 951->957 952->939 958 7ff646acbcb5-7ff646acbcb7 952->958 961 7ff646acbead-7ff646acbeb6 GetLastError 955->961 962 7ff646acbdb9-7ff646acbdc1 955->962 957->950 964 7ff646acbd35-7ff646acbd3d 957->964 958->939 965 7ff646acbcb9-7ff646acbcd1 958->965 959->963 960->935 971 7ff646acbed3-7ff646acbed6 961->971 972 7ff646acbeb8-7ff646acbece call 7ff646ac4f78 call 7ff646ac4f58 961->972 962->961 968 7ff646acbdc7 962->968 973 7ff646acbd73-7ff646acbd7d call 7ff646aca9b8 963->973 964->955 970 7ff646acbd3f-7ff646acbd61 ReadConsoleW 964->970 965->939 966 7ff646acbcd3-7ff646acbcdf 965->966 966->939 974 7ff646acbce1-7ff646acbce3 966->974 978 7ff646acbdce-7ff646acbde3 968->978 980 7ff646acbd82-7ff646acbd8c 970->980 981 7ff646acbd63 GetLastError 970->981 975 7ff646acbedc-7ff646acbede 971->975 976 7ff646acbd69-7ff646acbd6b call 7ff646ac4eec 971->976 972->963 973->920 974->939 985 7ff646acbce5-7ff646acbcf5 974->985 975->973 976->963 978->973 987 7ff646acbde5-7ff646acbdf0 978->987 980->978 981->976 985->939 991 7ff646acbdf2-7ff646acbe0b call 7ff646acb6e4 987->991 992 7ff646acbe17-7ff646acbe1f 987->992 999 7ff646acbe10-7ff646acbe12 991->999 996 7ff646acbe21-7ff646acbe33 992->996 997 7ff646acbe9b-7ff646acbea8 call 7ff646acb524 992->997 1000 7ff646acbe35 996->1000 1001 7ff646acbe8e-7ff646acbe96 996->1001 997->999 999->973 1003 7ff646acbe3a-7ff646acbe41 1000->1003 1001->973 1004 7ff646acbe43-7ff646acbe47 1003->1004 1005 7ff646acbe7d-7ff646acbe88 1003->1005 1006 7ff646acbe63 1004->1006 1007 7ff646acbe49-7ff646acbe50 1004->1007 1005->1001 1009 7ff646acbe69-7ff646acbe79 1006->1009 1007->1006 1008 7ff646acbe52-7ff646acbe56 1007->1008 1008->1006 1010 7ff646acbe58-7ff646acbe61 1008->1010 1009->1003 1011 7ff646acbe7b 1009->1011 1010->1009 1011->1001
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                          • Opcode ID: 71330427dde7a49afb2283bb308656113f98e0c66a4f806cd66398b14c9322eb
                                                                                                                                                                                                          • Instruction ID: 4bd69cada80353a37acf5b273de84fa040e5e699879e62acb933e40167c84bd8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 71330427dde7a49afb2283bb308656113f98e0c66a4f806cd66398b14c9322eb
                                                                                                                                                                                                          • Instruction Fuzzy Hash: EEC1C322A0CF8681E761BB1594402BDBBA1EF81B80F554131EA4F87795CF7FE8D98720
                                                                                                                                                                                                          Function 00007FF646AB8760 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 995526605-0
                                                                                                                                                                                                          • Opcode ID: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
                                                                                                                                                                                                          • Instruction ID: e922f539595c6da0abe4fc4c8d9879105661e91a21a22ea4e74c9b48d0e8e5d1
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F1215121A0CE4642EB50BB99F45422AE3A1FF85BE0F100235EA6D83AE4DE6ED4848750
                                                                                                                                                                                                          Function 00007FF646AB90E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB8760: GetCurrentProcess.KERNEL32 ref: 00007FF646AB8780
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB8760: OpenProcessToken.ADVAPI32 ref: 00007FF646AB8793
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB8760: GetTokenInformation.KERNELBASE ref: 00007FF646AB87B8
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB8760: GetLastError.KERNEL32 ref: 00007FF646AB87C2
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB8760: GetTokenInformation.KERNELBASE ref: 00007FF646AB8802
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB8760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF646AB881E
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB8760: CloseHandle.KERNEL32 ref: 00007FF646AB8836
                                                                                                                                                                                                          • LocalFree.KERNEL32(?,00007FF646AB3C55), ref: 00007FF646AB916C
                                                                                                                                                                                                          • LocalFree.KERNEL32(?,00007FF646AB3C55), ref: 00007FF646AB9175
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                          • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                                                                                          • API String ID: 6828938-1529539262
                                                                                                                                                                                                          • Opcode ID: 44a76ac2d965b652da6d7152683ffc914eb32e79e00aec7a7a922ce7c9633e88
                                                                                                                                                                                                          • Instruction ID: 702e8323489f964ad7221e3df6f26ae13b47c2394ded001998fd0ca9d72cdbbc
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 44a76ac2d965b652da6d7152683ffc914eb32e79e00aec7a7a922ce7c9633e88
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 88216D21A0CF4681F750BB10E8152EAA265FF89B80F444036EA4E93796DF3ED885C760
                                                                                                                                                                                                          Function 00007FF646AB7E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • CreateDirectoryW.KERNELBASE(00000000,?,00007FF646AB352C,?,00000000,00007FF646AB3F23), ref: 00007FF646AB7F22
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CreateDirectory
                                                                                                                                                                                                          • String ID: %.*s$%s%c$\
                                                                                                                                                                                                          • API String ID: 4241100979-1685191245
                                                                                                                                                                                                          • Opcode ID: 8ca7fb79b4ea6b2c566bb37e9ebd00ba932afb87f6e77ad964f7d4209dd14296
                                                                                                                                                                                                          • Instruction ID: 9a82708fdc449c614e7bcfd2c244fa198ab62936b17c0f83a15d30f1cbdf31d0
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8ca7fb79b4ea6b2c566bb37e9ebd00ba932afb87f6e77ad964f7d4209dd14296
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4531D22161DEC945EA61BB20E8507EAA354EF84FE4F044231EF6D837C9DE2DD681C710
                                                                                                                                                                                                          Function 00007FF646ACCFD0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF646ACCFBB), ref: 00007FF646ACD0EC
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF646ACCFBB), ref: 00007FF646ACD177
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 953036326-0
                                                                                                                                                                                                          • Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
                                                                                                                                                                                                          • Instruction ID: db8144fa8de4560c9db26a591e74a51a30638b8b82208d5df199264a3feb93ce
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2A91B572F1CA5185F750BF6994502BDABA1BB44B88F14413ADE0F97A85CE3ED4C2D720
                                                                                                                                                                                                          Function 00007FF646ACF9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _get_daylight$_isindst
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4170891091-0
                                                                                                                                                                                                          • Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
                                                                                                                                                                                                          • Instruction ID: 5d4382dae873106612d260bcfe249a384a2a2cc08cdd79d4a10b884bf338f876
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0951F672F0C9118AFB18FF24D9516BCA7A1AF40358F504135EE2FD2AE5DF39A4818710
                                                                                                                                                                                                          Function 00007FF646AC57EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2780335769-0
                                                                                                                                                                                                          • Opcode ID: 6433626fc0a770ba4f6d83c09f3326f67990d509dea1b3a303c7df294cc1bd66
                                                                                                                                                                                                          • Instruction ID: eeb62928c636e0669b382bade804c40e460ad5be323f962b1659bec64547a717
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6433626fc0a770ba4f6d83c09f3326f67990d509dea1b3a303c7df294cc1bd66
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 39519E62E0CA418AFB50FFB1D4503BDA3B1AF48B98F144435EE0E97689DF39D8918720
                                                                                                                                                                                                          Function 00007FF646AC5698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1279662727-0
                                                                                                                                                                                                          • Opcode ID: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
                                                                                                                                                                                                          • Instruction ID: 003e7fb06907797d4426876347d0c4ceaf76d33be45db742ae55c21cd34c4069
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9C41A222D1CB8283E750BB219514379A260FF947A4F108334FA5E43AD6DF6DA8F08760
                                                                                                                                                                                                          Function 00007FF646ABCCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3251591375-0
                                                                                                                                                                                                          • Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
                                                                                                                                                                                                          • Instruction ID: 68e24dddbd21d9a77a6339aa77bfa84cc9758c376dcb79c8f6f9fa717f17e5a3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 14317CA4E4CE0B91FA54BB24A4227B99792AF41B84F440435DB5FCB2D7DE2FA4C5C231
                                                                                                                                                                                                          Function 00007FF646AC9AA0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1703294689-0
                                                                                                                                                                                                          • Opcode ID: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
                                                                                                                                                                                                          • Instruction ID: ec1450da2718350654a6f8dc5e83ee46aed51c5582562ee1a78996a9481ceaa4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E5D06C54F0CE4652EA98BF7058990B892526F88B41B141438DC0B8A393ED2EA88E8320
                                                                                                                                                                                                          Function 00007FF646AC01AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                          • Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
                                                                                                                                                                                                          • Instruction ID: a3783c103f76f5a150d3b5fcf152306cbe0f3b8844b431ddea41a13b1dbc13d8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E551D761B0DE5186EA24BE79940067AE291AF84BA8F144734DE7E877C5CF3FD4818620
                                                                                                                                                                                                          Function 00007FF646ACC1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorFileLastPointer
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2976181284-0
                                                                                                                                                                                                          • Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
                                                                                                                                                                                                          • Instruction ID: f830b1211c18eb29c1bc67a836b981ce4ee4ab7924ca5013b5d6ec107a6b7e74
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D81104A1B0CE4181DA10BB29A814169E361FB41BF4F544331EE7F8B7D8CE3DD0918710
                                                                                                                                                                                                          Function 00007FF646AC5994 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF646AC58A9), ref: 00007FF646AC59C7
                                                                                                                                                                                                          • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF646AC58A9), ref: 00007FF646AC59DD
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1707611234-0
                                                                                                                                                                                                          • Opcode ID: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
                                                                                                                                                                                                          • Instruction ID: 5a007183fe55d776fd48fa1e71c835cd4014b111bfaf987e81d1c2820e558cd3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4811A77261CA0282EB547B15A44113FF760FB84771F500235FAAEC19D8EF2DD494DB20
                                                                                                                                                                                                          Function 00007FF646ACA9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • RtlFreeHeap.NTDLL(?,?,?,00007FF646AD2D92,?,?,?,00007FF646AD2DCF,?,?,00000000,00007FF646AD3295,?,?,?,00007FF646AD31C7), ref: 00007FF646ACA9CE
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF646AD2D92,?,?,?,00007FF646AD2DCF,?,?,00000000,00007FF646AD3295,?,?,?,00007FF646AD31C7), ref: 00007FF646ACA9D8
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 485612231-0
                                                                                                                                                                                                          • Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
                                                                                                                                                                                                          • Instruction ID: 5170b3c0750fc4f413f491839f4301f1448e701da48262983d5f2953801ff956
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A5E08650F0CF0243FF187BB258461789151AF84B40F054034CD1EC22A1DE2F68C58370
                                                                                                                                                                                                          Function 00007FF646ACABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • CloseHandle.KERNELBASE(?,?,?,00007FF646ACAA45,?,?,00000000,00007FF646ACAAFA), ref: 00007FF646ACAC36
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF646ACAA45,?,?,00000000,00007FF646ACAAFA), ref: 00007FF646ACAC40
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CloseErrorHandleLast
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 918212764-0
                                                                                                                                                                                                          • Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
                                                                                                                                                                                                          • Instruction ID: 4421f65a1d5d932771d6c02c6a38c6ac6485ff798776fc5bca9598156b1a3e86
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5F219611F1CE4242FAA477A1949427996D2AF84B94F084235DB2FC77C6DE6EA8C58321
                                                                                                                                                                                                          Function 00007FF646ACBF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                          • Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
                                                                                                                                                                                                          • Instruction ID: ed8cf6e32a03d3f94da9f40b4b31d5b76b07cdec689a2c8ebc29546d551ad3c5
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5E41A17291CA018BEA34BB19A541279F3A4EF55B84F144131DA9FC7691CF2FE482CBA1
                                                                                                                                                                                                          Function 00007FF646AB7F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _fread_nolock
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 840049012-0
                                                                                                                                                                                                          • Opcode ID: c7509c5c59c4a666db98ff03363a6938e2dccbe5af1fc5850b6eda6e7b6e2098
                                                                                                                                                                                                          • Instruction ID: e88ecf1e667533f00b64861faddc77ab2317fbcbad9f1e1e5c88d0b9f487e311
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c7509c5c59c4a666db98ff03363a6938e2dccbe5af1fc5850b6eda6e7b6e2098
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A4219121B0DE9685FB54BA2665043BAD651BF45FC4F8C4430EF4D87B86CE7FE0818621
                                                                                                                                                                                                          Function 00007FF646ACB9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                          • Opcode ID: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
                                                                                                                                                                                                          • Instruction ID: 6e63662f9f859c76cc8bd77a0976d98c8a690125d1530e6c2cefc4eef86f082f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2431AE21A1CE468AF7517B55884137CAA60AF80B94F420135EA6F833E2CF7FE8C58775
                                                                                                                                                                                                          Function 00007FF646AC99D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3947729631-0
                                                                                                                                                                                                          • Opcode ID: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
                                                                                                                                                                                                          • Instruction ID: 44141691edc5fb6da086790566712c62181f1d305d7a84018295773ff131c47c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 65218E32E08B828AEB64FF64C4442FC73A0EB84718F441635D72E86AD5DF39D585CB60
                                                                                                                                                                                                          Function 00007FF646AC6004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                          • Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                          • Instruction ID: d6cd1648f345502d5c1341cf7a8f0021f5a7680b53877f4a911ded8a5316e984
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A7117522A1CE4189EE64BF51940117EE2A4BF45B84F444031FB4ED7B96DF7FE89087A0
                                                                                                                                                                                                          Function 00007FF646AD63C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                          • Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
                                                                                                                                                                                                          • Instruction ID: 81743825312f596e3e6acc6b0ddcb152fd889cf52da661fbec6b3b1d834786c3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7421507271CE4286DB61BF18D450379B6A1EB84B94F185234EA9EC76D9DF3ED4808B10
                                                                                                                                                                                                          Function 00007FF646AC042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                          • Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                          • Instruction ID: 34f793176986138ff5a0492500a7c0450bf4c5dc3551675a7404ce0c7b690199
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B601D621A0CF4140EA04FF569A0107AE691BF95FE0F084631EE6D97BD6CE3FE5918310
                                                                                                                                                                                                          Function 00007FF646AC7F6C Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                          • Opcode ID: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
                                                                                                                                                                                                          • Instruction ID: fccd77d4f0130cb4ac1e8ee914c3e2b24fc13042966e5b8347ccb094a1680fb2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8201CC20E0DE8348FE647B656581179D190AF06794F444635EA2FC26C6DF3FE4C0C272
                                                                                                                                                                                                          Function 00007FF646AC82A8 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                          • Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
                                                                                                                                                                                                          • Instruction ID: 6075334c80d5b26ddd4bd56e77df0aa313612b74e5c51b274e345fd4fa108db3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: DBE012A0E0CF078AFB143BB445D61799510EF56740F414571EA1BDA2C7DE2F68C99632
                                                                                                                                                                                                          Function 00007FF646ACEC08 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • HeapAlloc.KERNEL32(?,?,00000000,00007FF646ACB39A,?,?,?,00007FF646AC4F81,?,?,?,?,00007FF646ACA4FA), ref: 00007FF646ACEC5D
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AllocHeap
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4292702814-0
                                                                                                                                                                                                          • Opcode ID: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
                                                                                                                                                                                                          • Instruction ID: 978fe7990072de376f591108215e05fec5e15e31213779a5549db662b515ea57
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0FF06D54B0DB0685FE587B6258512B6CA956F85B80F4C5430CD0FC63D1DE1EF4C08270
                                                                                                                                                                                                          Function 00007FF646ACD66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • HeapAlloc.KERNEL32(?,?,?,00007FF646AC0D00,?,?,?,00007FF646AC236A,?,?,?,?,?,00007FF646AC3B59), ref: 00007FF646ACD6AA
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AllocHeap
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4292702814-0
                                                                                                                                                                                                          • Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
                                                                                                                                                                                                          • Instruction ID: 901096b45d9cde69264e8ed3c5aae3be45c3383c6456c806cd6efcfc95867fd2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
                                                                                                                                                                                                          • Instruction Fuzzy Hash: ACF05810B2DF0695FE647B615801279E2915F94BA0F080232DC2FC53C2DE2FA4C0E230

                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                          Function 00007FF646AB5820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB5830
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB5842
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB5879
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB588B
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB58A4
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB58B6
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB58CF
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB58E1
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB58FD
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB590F
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB592B
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB593D
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB5959
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB596B
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB5987
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB5999
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB59B5
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB59C7
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressErrorLastProc
                                                                                                                                                                                                          • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                          • API String ID: 199729137-653951865
                                                                                                                                                                                                          • Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
                                                                                                                                                                                                          • Instruction ID: 3bfb4b33ddc7db6e6cf35bd3b5391dd9991feebdaef6050e558f8e4131e1bf98
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0322C6A494DF4B91FA44FF65A9141B4A3A6AF09B85F845035CC1F82660FF3EB9C89330
                                                                                                                                                                                                          Function 00007FF646AD411C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                                                                                          • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                          • API String ID: 808467561-2761157908
                                                                                                                                                                                                          • Opcode ID: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
                                                                                                                                                                                                          • Instruction ID: 238cf1794539046850a9e5715494541eee2ce8662793f6ffc99d7affc7e837e2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: DCB2D472A1CB828BE764AF64D5407FDB7A2FB54388F405135DE0D97A84DF3AA980CB50
                                                                                                                                                                                                          Function 00007FF646ABAD1D Relevance: 12.0, Strings: 9, Instructions: 744COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
                                                                                                                                                                                                          • API String ID: 0-2665694366
                                                                                                                                                                                                          • Opcode ID: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
                                                                                                                                                                                                          • Instruction ID: 6e430fe2fded03d79e3933d65cabd871db8a4c70f8081729147b51acdb72ad7e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 20520772A18AA98BD7A4AF14D458B7D7BA9FB44740F014139E74AC3780DF3ED984CB50
                                                                                                                                                                                                          Function 00007FF646ABD19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3140674995-0
                                                                                                                                                                                                          • Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
                                                                                                                                                                                                          • Instruction ID: 92649db19a58825e99a4dac90a4638036bb8c7d084b49fae8ff6791a639c58e0
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 46311E72608F8586EB60AF60E8403EEB365FB84748F44443ADB4D87B94EF39D588C720
                                                                                                                                                                                                          Function 00007FF646ACA684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1239891234-0
                                                                                                                                                                                                          • Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
                                                                                                                                                                                                          • Instruction ID: 50dd96237e29b7b86551cdffe0ed105bee75ee508fc4e0750def38e2e7a9e7f6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 38316036618F8186DB60EF25E8402AEB3A4FB88758F540136EB9D83B58DF3DC185CB10
                                                                                                                                                                                                          Function 00007FF646AD18E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2227656907-0
                                                                                                                                                                                                          • Opcode ID: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
                                                                                                                                                                                                          • Instruction ID: 6b46c94d7df38dbe31fc08cd39529078ef482a1b3dcac93b16a71b437e0770a3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 31B1C926B1CE9241EB61BB6194085B9E392EB44BD4F444131EE5E87BD5EF3EE8C1C320
                                                                                                                                                                                                          Function 00007FF646ABD080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2933794660-0
                                                                                                                                                                                                          • Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
                                                                                                                                                                                                          • Instruction ID: 16d320fcbef588b419c15c560a1ae3d5b6c9ac3e4547a7c55e05ff67ae357075
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 23117036B58F058AEB40EF60E8442B973A4FB19758F040E35DE2D867A4DF3CD1988350
                                                                                                                                                                                                          Function 00007FF646AD3C80 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memcpy_s
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1502251526-0
                                                                                                                                                                                                          • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                          • Instruction ID: 544b82256ad39761c0f181a40b2af40bafc430d74428605fe4bf993ffdfc649b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6DC1E472B1CA8687D724AF19A04466AF7A2F795784F448134DF4E87784DF3EE840CB40
                                                                                                                                                                                                          Function 00007FF646ABA4E4 Relevance: 4.1, Strings: 3, Instructions: 398COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: $header crc mismatch$unknown header flags set
                                                                                                                                                                                                          • API String ID: 0-1127688429
                                                                                                                                                                                                          • Opcode ID: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
                                                                                                                                                                                                          • Instruction ID: 19952ea0c4c5bed1e76faf83485b71f39666ab5bca86ebfc3e28b39c1c85e402
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4BF17372A1CBD94BE795BF18C088B3ABAA9EF45B40F054538DB4987791CF3AD980C750
                                                                                                                                                                                                          Function 00007FF646AD9798 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ExceptionRaise_clrfp
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 15204871-0
                                                                                                                                                                                                          • Opcode ID: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
                                                                                                                                                                                                          • Instruction ID: e0547a7eef81b050adbd1b4bee9b4e67c14c08b0bcd103bd54b5a98712837e63
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2BB15B73A08B898BEB15EF29C84636C7BA1F784B48F148921DE5D837A4CF3AD491C710
                                                                                                                                                                                                          Function 00007FF646AC3A14 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: $
                                                                                                                                                                                                          • API String ID: 0-227171996
                                                                                                                                                                                                          • Opcode ID: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
                                                                                                                                                                                                          • Instruction ID: 719e7c8196e604ac4be49d909c2a6f808b1180dadf43ed653efd70093c60f4e8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 17E1AD36A0CE4686EB78BE29815017DB3A0FF45B48F244235DA4F87695DF2BE8D1C760
                                                                                                                                                                                                          Function 00007FF646ABA34B Relevance: 2.7, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: incorrect header check$invalid window size
                                                                                                                                                                                                          • API String ID: 0-900081337
                                                                                                                                                                                                          • Opcode ID: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
                                                                                                                                                                                                          • Instruction ID: 7229e12ce8bcb3388b0df57193bfebb4b87da9efe387b661ebdaffedb1bf51a4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 08918772A1CACA87E7A4BA14C488B3E7A99FB45750F114139DB5A867C0CF3EE5C4CB10
                                                                                                                                                                                                          Function 00007FF646ACDF60 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: e+000$gfff
                                                                                                                                                                                                          • API String ID: 0-3030954782
                                                                                                                                                                                                          • Opcode ID: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
                                                                                                                                                                                                          • Instruction ID: 3748e75db049f792ee92ac1b641954f9ac94799a3e919cd2cb9aedc024521ed1
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F9514962B1CAC586E724AF399801769EB91F744B94F489231CBA987AC5CF3FE485C710
                                                                                                                                                                                                          Function 00007FF646ACDACC Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: gfffffff
                                                                                                                                                                                                          • API String ID: 0-1523873471
                                                                                                                                                                                                          • Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                                                                                          • Instruction ID: 815ac2e141ada93c1a0a9efc73518c5577f255eab45b951d9507b85b29600c11
                                                                                                                                                                                                          • Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                                                                                          • Instruction Fuzzy Hash: ABA14762A0DBC546EB21FF29A4007A9BB91EB61B84F048032DE8E87785DE3EE541D711
                                                                                                                                                                                                          Function 00007FF646AC8804 Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID: TMP
                                                                                                                                                                                                          • API String ID: 3215553584-3125297090
                                                                                                                                                                                                          • Opcode ID: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
                                                                                                                                                                                                          • Instruction ID: 37a1ede52e4ee1efab9290635e2ee129af5ea431270292b75c3b126eff72c995
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 18519D11B0CE4241FB64BB26990157ADA91BF84BC4F484535DE0FC7BD6EE3EE4824322
                                                                                                                                                                                                          Function 00007FF646AD34F0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: HeapProcess
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 54951025-0
                                                                                                                                                                                                          • Opcode ID: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
                                                                                                                                                                                                          • Instruction ID: 1fe9de5e415e56e8fb9f8db231c9238f29be92a402fb7397717cc690b24946a0
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2CB09260E0BE02C2EA483B216C8222862A67F58700F9801B8C40C80330EE2E20E95761
                                                                                                                                                                                                          Function 00007FF646AC3610 Relevance: .3, Instructions: 327COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
                                                                                                                                                                                                          • Instruction ID: a6ded7ead745dc9cb84b1d58b351c103b4ca83ac9962fa9e8cccc248732ded58
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BDD1CD76A0CE4286EB78FE29815067DA3A0EF05B48F144235CE4F87694DF3BE881D760
                                                                                                                                                                                                          Function 00007FF646AB9870 Relevance: .3, Instructions: 287COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
                                                                                                                                                                                                          • Instruction ID: 782d8929298b8e1548dfcb4eb6ccdc722328f4cb7442cd8eb5f221247fa1927a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7DC17F762181E08BD289EB29E47947A73D1F78A30DB95406BEF87477C6CB3CA514DB20
                                                                                                                                                                                                          Function 00007FF646AC2C80 Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
                                                                                                                                                                                                          • Instruction ID: 4a0d54717cffa6a8f141ebbf1030e818853e6024a19cd5edd1c7744cc6a4de9a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 77B14B72A0CB8589EB65EF39C05027CBBA0EB4AB4CF244135DA4E97395CF3AD491C764
                                                                                                                                                                                                          Function 00007FF646ACE5E0 Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
                                                                                                                                                                                                          • Instruction ID: 0c134dd82c3d4734311c15ba296fe2374218874d2a8995f1e4ce6445d7b06679
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C581E472A1CB8186E774FF19944137AFA91FB45794F144235DB8E83B95CE3EE4808B10
                                                                                                                                                                                                          Function 00007FF646AD6488 Relevance: .2, Instructions: 183COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                          • Opcode ID: b78332369169aed8be6dd13cc6d08ed8a401c1151d3c5d6e5b3c154adaf735d2
                                                                                                                                                                                                          • Instruction ID: 329137ece246195734230063f949a766480a1c9eb33865e5f9eff3dfd704f207
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b78332369169aed8be6dd13cc6d08ed8a401c1151d3c5d6e5b3c154adaf735d2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3861EE22F0C99246F768BA28845477DE682AF41760F1D5239DE1DC76D5DE7FE8C08B20
                                                                                                                                                                                                          Function 00007FF646AC1DC4 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                          • Instruction ID: 3a9c1bc7c4ec0c3d041ab4218418525cec4764385290f5e017ead95d7e4c3e96
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                          • Instruction Fuzzy Hash: AF516536B1CA5286E724AB29D058238B7A1EB45B58F244131DF4E97795CF3BEC83C790
                                                                                                                                                                                                          Function 00007FF646AC21D4 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                          • Instruction ID: 40b04aa8517b7d0541353a8c38609ae6eb38e73c5577172ce582f5484efbfe3b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 99516576A2CE5186E764AB29C054238B7A0EB94B6CF244131CE4E977D4CF3BE883C750
                                                                                                                                                                                                          Function 00007FF646AC19B4 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                          • Instruction ID: f8808582b08c6c42f9f0f0f34f3798b9a089780b8858603f06942f2bbd53d2e0
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5C518676B1CE5186E724AB29C048238B7A0EB84B58F244131CB4E97795DF3BEC97CB50
                                                                                                                                                                                                          Function 00007FF646AC1FD0 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                          • Instruction ID: 9601b2500b3cc9becc54417d4ef027d7c0bcf3ab90493288a4691cfba441db5c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3A515276A1CE5185E724AB29C450239B7A1EB55B5CF248132CE4E977A4CF3BEC82C760
                                                                                                                                                                                                          Function 00007FF646AC17B0 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                          • Instruction ID: 709efac6b9a81d802921c39a5d477ff3ec1e7e0540ff52177a309e328c42ee6f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E1518036B1CA5186E764AB29D04863CA7A1EB44B58F245131CB4E97794CF3BEC93C7A0
                                                                                                                                                                                                          Function 00007FF646AC1BC0 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                          • Instruction ID: efcdb5c687ddd6d8aed77d9e28bfbfb9df54b9ef5ea7b128e45fc42483d5c9fe
                                                                                                                                                                                                          • Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F2519F36B1CE5186E725AB29C048238A7A1EB45B58F644131DF4E977A8CF3BEC93C750
                                                                                                                                                                                                          Function 00007FF646AC5DA0 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                          • Instruction ID: 3efb26b6b06398aa685425efde007546dab04c9669551e04e95c46003fe06208
                                                                                                                                                                                                          • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B241A9A2C0DF4A48F969B92C49146B8D6C09F63BA0E585274FD9BD33C3DD0E6DE68121
                                                                                                                                                                                                          Function 00007FF646AC9F10 Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 485612231-0
                                                                                                                                                                                                          • Opcode ID: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
                                                                                                                                                                                                          • Instruction ID: bd2ab6b473f046e9285b4bd4d6bc22db7269027fe494d8323e3ddbe34f9dae9e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1E41A562718E5581EF04EF6ADA14169B391FB48FD0B499436DE0ED7B58DE3ED5818300
                                                                                                                                                                                                          Function 00007FF646AC8154 Relevance: .1, Instructions: 98COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
                                                                                                                                                                                                          • Instruction ID: 27584ecdc0612c3cdbe58ddb31ae8ac9bb14fc14cba006be8ce2325e3b58b328
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FF31A032A0CF4281E764BF25A84413EAAD5BB85B90F144239EA5EA3B95DF3DD0428314
                                                                                                                                                                                                          Function 00007FF646AD95E0 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
                                                                                                                                                                                                          • Instruction ID: a70f17e566da095b517f5b80477cb351915d9230fc77d27010dfe4c86a52e938
                                                                                                                                                                                                          • Opcode Fuzzy Hash: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 28F0687171C6558ADB98EF69A402629B7D1F7083C0F408139D58DC3B04DE3DD0A19F54
                                                                                                                                                                                                          Function 00007FF646ABD37C Relevance: .0, Instructions: 2COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
                                                                                                                                                                                                          • Instruction ID: f5e2cce8705aaed852fa522966dbd73247ac4af76d8fc84458bd2bf7c31e5987
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2CA0026290CC0ED0E684BB00EC90035E331FB61704B400076E51EC10B19F3EA484D320
                                                                                                                                                                                                          Function 00007FF646AB76B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressErrorLastProc
                                                                                                                                                                                                          • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                          • API String ID: 199729137-3427451314
                                                                                                                                                                                                          • Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
                                                                                                                                                                                                          • Instruction ID: 714d873f52792af51d2eb95879a31041a4c2e9fb29adf144e46d7ae3e9b5053e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C202C664A4DF0B91FA95FB55A9145B4E3A2BF08B94F845036DD1E82260EF7EF5C88330
                                                                                                                                                                                                          Function 00007FF646AB81C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB9400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF646AB45E4,00000000,00007FF646AB1985), ref: 00007FF646AB9439
                                                                                                                                                                                                          • ExpandEnvironmentStringsW.KERNEL32(?,00007FF646AB88A7,?,?,00000000,00007FF646AB3CBB), ref: 00007FF646AB821C
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB2810: MessageBoxW.USER32 ref: 00007FF646AB28EA
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                          • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                                                                                          • API String ID: 1662231829-930877121
                                                                                                                                                                                                          • Opcode ID: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
                                                                                                                                                                                                          • Instruction ID: 8bb942d9accb12893743d5663a9705109e68a0ad1f84d1eaa7007a96fb313aa4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8051B551A2CE4681FB50FB24E8516BAE261EF94B84F444032EB0EC26D5EE3EE584C770
                                                                                                                                                                                                          Function 00007FF646AB2180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                          • String ID: P%
                                                                                                                                                                                                          • API String ID: 2147705588-2959514604
                                                                                                                                                                                                          • Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                          • Instruction ID: 8f999aa9f5823572a3b6343ba8003cdef3f383c2b888c49ce5458c15d0946eff
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 89510766618BA186D674AF22E4181BAF7A1F798B65F004121EFDE83794DF3DD085CB20
                                                                                                                                                                                                          Function 00007FF646AB80B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                                                                                                                                                          • String ID: Needs to remove its temporary files.
                                                                                                                                                                                                          • API String ID: 3975851968-2863640275
                                                                                                                                                                                                          • Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
                                                                                                                                                                                                          • Instruction ID: 49fb1d1a2cd9831c95365f66379ace5cf215a7cfb8f841da46c25e108772c34f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 30218B61A0DE4682E781BB7AB854169E261EF88F90F484231DF2EC3798DE2DD5C58231
                                                                                                                                                                                                          Function 00007FF646AC6300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID: -$:$f$p$p
                                                                                                                                                                                                          • API String ID: 3215553584-2013873522
                                                                                                                                                                                                          • Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                          • Instruction ID: aa2407f8c1ed831867b3ad40dca8b114fb89a499afc9eb9ec86097677855a780
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 53129F62B0C95386FB24FB14D1582B9F6A1FB80750F9C5535E68B86AC4DF3EE5C09B20
                                                                                                                                                                                                          Function 00007FF646AC1038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID: f$f$p$p$f
                                                                                                                                                                                                          • API String ID: 3215553584-1325933183
                                                                                                                                                                                                          • Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                          • Instruction ID: 28290d89d08414d8567abeafee8764f8486b2777e875aa6f8eefec77dc04a77b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F9127271F0C98385FB60BA15E15C679E2A1EB40758F984035D79B866C4DF7EECC09B24
                                                                                                                                                                                                          Function 00007FF646AB1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                          • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                          • API String ID: 2050909247-3659356012
                                                                                                                                                                                                          • Opcode ID: 459c70ac1d7639bc8463e208505d68a8d1b4527688a9ba0853ea1617660c4a39
                                                                                                                                                                                                          • Instruction ID: 75acdbc43d5ab413e49369bbaf7646ea72df2cf47cc4fe4bc891f38b3f50b0f9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 459c70ac1d7639bc8463e208505d68a8d1b4527688a9ba0853ea1617660c4a39
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1F41A061B0CE5686EA00FB12A8046B9E391FF54FC4F444432EE0D8779ADF3EE5858760
                                                                                                                                                                                                          Function 00007FF646AB1470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                          • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                          • API String ID: 2050909247-3659356012
                                                                                                                                                                                                          • Opcode ID: 0b283387f8163d2c1451a1fd9c7ee0611bebd7135be36a4017c4ebfd3c397b14
                                                                                                                                                                                                          • Instruction ID: f56dee9665f3d7c6bce260a51f4e99b799b89c0c3015a8798b2d1cd23bd2389b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0b283387f8163d2c1451a1fd9c7ee0611bebd7135be36a4017c4ebfd3c397b14
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5441BF62A0CE4695EB00FF2194411B9E391FF44B88F444532EE4E87B99DE3EE986C764
                                                                                                                                                                                                          Function 00007FF646ABEA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                          • String ID: csm$csm$csm
                                                                                                                                                                                                          • API String ID: 849930591-393685449
                                                                                                                                                                                                          • Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
                                                                                                                                                                                                          • Instruction ID: 4bfb47a96ec4a45f6f35c18dc0a998d94f19ea201aeb451d2be834f586817538
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 44D18132A0CB4986EB20BB25D4413ADB7A0FB45B88F144136EF4D9BB96DF39E490C750
                                                                                                                                                                                                          Function 00007FF646AB2C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF646AB3706,?,00007FF646AB3804), ref: 00007FF646AB2C9E
                                                                                                                                                                                                          • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF646AB3706,?,00007FF646AB3804), ref: 00007FF646AB2D63
                                                                                                                                                                                                          • MessageBoxW.USER32 ref: 00007FF646AB2D99
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Message$CurrentFormatProcess
                                                                                                                                                                                                          • String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
                                                                                                                                                                                                          • API String ID: 3940978338-251083826
                                                                                                                                                                                                          • Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
                                                                                                                                                                                                          • Instruction ID: 1815dee7cb6c81bd9e244ddeef3f08de92b89a1fc78b08fc108bba6b9799667a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7231C562B0CE4542E620BB25B8546BBA795BF88BD8F400136EF4DD3759DE3DD58AC310
                                                                                                                                                                                                          Function 00007FF646ABDD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,?,?,00007FF646ABDFEA,?,?,?,00007FF646ABDCDC,?,?,?,00007FF646ABD8D9), ref: 00007FF646ABDDBD
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF646ABDFEA,?,?,?,00007FF646ABDCDC,?,?,?,00007FF646ABD8D9), ref: 00007FF646ABDDCB
                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,?,?,00007FF646ABDFEA,?,?,?,00007FF646ABDCDC,?,?,?,00007FF646ABD8D9), ref: 00007FF646ABDDF5
                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,?,00007FF646ABDFEA,?,?,?,00007FF646ABDCDC,?,?,?,00007FF646ABD8D9), ref: 00007FF646ABDE63
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,?,?,00007FF646ABDFEA,?,?,?,00007FF646ABDCDC,?,?,?,00007FF646ABD8D9), ref: 00007FF646ABDE6F
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                          • String ID: api-ms-
                                                                                                                                                                                                          • API String ID: 2559590344-2084034818
                                                                                                                                                                                                          • Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
                                                                                                                                                                                                          • Instruction ID: ba447dd26a55f1580cd122c3252bf3c7c0b2209d998c564449d5e35bd34a7759
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6C317E21B1EE4A91EE52BB02A800579E394FF59FA0F594536EE1D87380EF3DE4848624
                                                                                                                                                                                                          Function 00007FF646AB6350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                          • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                                                                                          • API String ID: 2050909247-2434346643
                                                                                                                                                                                                          • Opcode ID: c6b32316bfe7a0aff6899d53276924ef6fe1744c5bc58fcca4aca07baf8add6e
                                                                                                                                                                                                          • Instruction ID: 7ee21ffe7dc67eb685b9e8cfd04273cce96db1e623073fe23fc909731debaf24
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c6b32316bfe7a0aff6899d53276924ef6fe1744c5bc58fcca4aca07baf8add6e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 60416171B1CE8A91EA11FB20E5152E9E315FB44B84F800132EB5D83696EF3EE685C760
                                                                                                                                                                                                          Function 00007FF646AB2A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF646AB351A,?,00000000,00007FF646AB3F23), ref: 00007FF646AB2AA0
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                          • String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                          • API String ID: 2050909247-2900015858
                                                                                                                                                                                                          • Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
                                                                                                                                                                                                          • Instruction ID: c2813bd725b3eccd40631ed21aafc63be86ae157b3e2fe12baad35545d490715
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2F218172A1CB8182E660BB51F8417E6A394FB887C4F400136FE8D83659DF3DD689C750
                                                                                                                                                                                                          Function 00007FF646ACB1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Value$ErrorLast
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2506987500-0
                                                                                                                                                                                                          • Opcode ID: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
                                                                                                                                                                                                          • Instruction ID: 5485b52b4cc808fed16e114185bb9831f8efa67bb9f261050c3c035b5b671ca4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 19216F20E0DE4641FA647761966513DD1429F54BB0F044734D93FCBAD6EE2FB4C58321
                                                                                                                                                                                                          Function 00007FF646AD7DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                          • String ID: CONOUT$
                                                                                                                                                                                                          • API String ID: 3230265001-3130406586
                                                                                                                                                                                                          • Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
                                                                                                                                                                                                          • Instruction ID: 873558190367a4d2a237d141310b78e621a26cc4aadf2a4411ebacf0bb35fd4f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 62116021B1CE4286E750BB52E854369A6A1FB88FE4F044234EE5DC77A4DF7ED8848750
                                                                                                                                                                                                          Function 00007FF646AB8560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF646AB9216), ref: 00007FF646AB8592
                                                                                                                                                                                                          • K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF646AB9216), ref: 00007FF646AB85E9
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB9400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF646AB45E4,00000000,00007FF646AB1985), ref: 00007FF646AB9439
                                                                                                                                                                                                          • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF646AB9216), ref: 00007FF646AB8678
                                                                                                                                                                                                          • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF646AB9216), ref: 00007FF646AB86E4
                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,00000000,00007FF646AB9216), ref: 00007FF646AB86F5
                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,00000000,00007FF646AB9216), ref: 00007FF646AB870A
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3462794448-0
                                                                                                                                                                                                          • Opcode ID: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
                                                                                                                                                                                                          • Instruction ID: ad8de16c187df3f2852ea0ae3ac4c055481e7318f227933dd2571555c14f3504
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2141B462B1DA8A81EB30BB15A5406AAA394FF84FC8F440135DF8DD7B89DE3DD581C721
                                                                                                                                                                                                          Function 00007FF646ACB338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF646AC4F81,?,?,?,?,00007FF646ACA4FA,?,?,?,?,00007FF646AC71FF), ref: 00007FF646ACB347
                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF646AC4F81,?,?,?,?,00007FF646ACA4FA,?,?,?,?,00007FF646AC71FF), ref: 00007FF646ACB37D
                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF646AC4F81,?,?,?,?,00007FF646ACA4FA,?,?,?,?,00007FF646AC71FF), ref: 00007FF646ACB3AA
                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF646AC4F81,?,?,?,?,00007FF646ACA4FA,?,?,?,?,00007FF646AC71FF), ref: 00007FF646ACB3BB
                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF646AC4F81,?,?,?,?,00007FF646ACA4FA,?,?,?,?,00007FF646AC71FF), ref: 00007FF646ACB3CC
                                                                                                                                                                                                          • SetLastError.KERNEL32(?,?,?,00007FF646AC4F81,?,?,?,?,00007FF646ACA4FA,?,?,?,?,00007FF646AC71FF), ref: 00007FF646ACB3E7
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Value$ErrorLast
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2506987500-0
                                                                                                                                                                                                          • Opcode ID: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
                                                                                                                                                                                                          • Instruction ID: 4a71e147efff7ddf5ec5792a9eec7515b8802806d8ed92a319dcc9e0278aedb9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 94116D20B0DE4282FA547721969113DE182AF44BB0F044734E93FCABD6EE2FA4C58331
                                                                                                                                                                                                          Function 00007FF646AB2910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF646AB1B6A), ref: 00007FF646AB295E
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                          • String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
                                                                                                                                                                                                          • API String ID: 2050909247-2962405886
                                                                                                                                                                                                          • Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
                                                                                                                                                                                                          • Instruction ID: d37e2d4d2308dea67e29211079533e7d7725b0c4c17ce40f7ef0c1dc1b714c33
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0B31C762B1CA8552E760B761A8406F6A695BF88BD4F400132FE8DC3759DF3DD586C610
                                                                                                                                                                                                          Function 00007FF646AB2390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                          • String ID: Unhandled exception in script
                                                                                                                                                                                                          • API String ID: 3081866767-2699770090
                                                                                                                                                                                                          • Opcode ID: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
                                                                                                                                                                                                          • Instruction ID: 1f4a9a6a93d6be28d5ca47a1fe6d4408e396623dd6e333d495b9e3931d868974
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8D31607261CA8189EB60FF21E8552F9A360FF88788F440135EA4E8BB49DF3DD184C710
                                                                                                                                                                                                          Function 00007FF646AB2B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF646AB918F,?,00007FF646AB3C55), ref: 00007FF646AB2BA0
                                                                                                                                                                                                          • MessageBoxW.USER32 ref: 00007FF646AB2C2A
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentMessageProcess
                                                                                                                                                                                                          • String ID: WARNING$Warning$[PYI-%d:%ls]
                                                                                                                                                                                                          • API String ID: 1672936522-3797743490
                                                                                                                                                                                                          • Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
                                                                                                                                                                                                          • Instruction ID: bc119789994dea0b09f3c0065e460ed68dafabd97455bb7fd221f3f59a000547
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6D21A16270CF4182E750BB54F8847EAA3A4FB887C4F400136EE8D97659DE3DD689C710
                                                                                                                                                                                                          Function 00007FF646AB2710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF646AB1B99), ref: 00007FF646AB2760
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                          • String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                          • API String ID: 2050909247-1591803126
                                                                                                                                                                                                          • Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
                                                                                                                                                                                                          • Instruction ID: 5277d9acfab89ab9d99eefbe351da8155980cb4421cfd4bf95e27f7c4d2a6c8b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1A217C72A1CB8582E660BB50B8817E6A3A4FB887C4F400136EE8D83659DF7DD6898750
                                                                                                                                                                                                          Function 00007FF646AC9AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                          • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                          • API String ID: 4061214504-1276376045
                                                                                                                                                                                                          • Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
                                                                                                                                                                                                          • Instruction ID: 4cab9f14f70f979fc23faefe4030f7606b165a6ff013825362236a9b19570db4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 91F0C261B0CF0681FB50FB20E454379A320EF49761F440235CA6E861E4CF2ED0C8C320
                                                                                                                                                                                                          Function 00007FF646AD93D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _set_statfp
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1156100317-0
                                                                                                                                                                                                          • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                          • Instruction ID: 12fd4369076be84bdc41967321dd05b3af15b2017aa65e09af264655ccb87287
                                                                                                                                                                                                          • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0C1191B2E5CE1301F754B124D456375A0466F59374F050634EE7E8A2D7CE2EE9C14124
                                                                                                                                                                                                          Function 00007FF646ACB400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • FlsGetValue.KERNEL32(?,?,?,00007FF646ACA613,?,?,00000000,00007FF646ACA8AE,?,?,?,?,?,00007FF646ACA83A), ref: 00007FF646ACB41F
                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF646ACA613,?,?,00000000,00007FF646ACA8AE,?,?,?,?,?,00007FF646ACA83A), ref: 00007FF646ACB43E
                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF646ACA613,?,?,00000000,00007FF646ACA8AE,?,?,?,?,?,00007FF646ACA83A), ref: 00007FF646ACB466
                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF646ACA613,?,?,00000000,00007FF646ACA8AE,?,?,?,?,?,00007FF646ACA83A), ref: 00007FF646ACB477
                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF646ACA613,?,?,00000000,00007FF646ACA8AE,?,?,?,?,?,00007FF646ACA83A), ref: 00007FF646ACB488
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Value
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3702945584-0
                                                                                                                                                                                                          • Opcode ID: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
                                                                                                                                                                                                          • Instruction ID: ab841c59357fbc51218342ff9f52246f9c9d86c21f1757fdbedd7b2e82a45e22
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 35116020F0DE4281FA58B765A651179E142AF847B0F488734E93FDA6D6EE2FF4C58321
                                                                                                                                                                                                          Function 00007FF646ACB294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Value
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3702945584-0
                                                                                                                                                                                                          • Opcode ID: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
                                                                                                                                                                                                          • Instruction ID: 86671ee24139577d78aba48cedbc953abf6e272e14e05e0a083e1c436438244b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 65111520E0DE0786FA687365546227AD1425F55720F484734D93FCA6D2ED2FB4C58232
                                                                                                                                                                                                          Function 00007FF646AC6010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID: verbose
                                                                                                                                                                                                          • API String ID: 3215553584-579935070
                                                                                                                                                                                                          • Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                          • Instruction ID: b7f936ef77a05fbbf5bcbdb9318f582ee60864c70ac4e53c8cb264772f776e68
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D091BD22B0CE4681F761FF28D46877DB391AB40B94F489136DA5B873C5DE3EE8858321
                                                                                                                                                                                                          Function 00007FF646ACFC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                          • API String ID: 3215553584-1196891531
                                                                                                                                                                                                          • Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
                                                                                                                                                                                                          • Instruction ID: e83a27682eb624cd7a69e608bc88cd276ad15e97e9e6ee65e58b27b9216eda8a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9A819132E0CA4285F7657F298150278B6E0AF12B88F558035DA0BD7299DF2FE9C19761
                                                                                                                                                                                                          Function 00007FF646ABD6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                          • String ID: csm
                                                                                                                                                                                                          • API String ID: 2395640692-1018135373
                                                                                                                                                                                                          • Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
                                                                                                                                                                                                          • Instruction ID: f828acd0bc2dcb960bfc5a8e9d4a57377a6c33b733f08c646bd0f2cee17a734c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 88518D32A1DA468ADB14BF15E444A78A791EB44F98F108136DB4E87788EF7EE8C1C710
                                                                                                                                                                                                          Function 00007FF646ABEF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                          • String ID: MOC$RCC
                                                                                                                                                                                                          • API String ID: 3544855599-2084237596
                                                                                                                                                                                                          • Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
                                                                                                                                                                                                          • Instruction ID: dae0add7e3fb6d68b07cc8d1a71a599aaa782982d38f98aaaa4431fecfb95fb4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
                                                                                                                                                                                                          • Instruction Fuzzy Hash: AA61807290CBC981EB60AB15E4403AAF7A0FB85B84F084625EB9D47B55DF7DD1D0CB20
                                                                                                                                                                                                          Function 00007FF646ABF2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                          • String ID: csm$csm
                                                                                                                                                                                                          • API String ID: 3896166516-3733052814
                                                                                                                                                                                                          • Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
                                                                                                                                                                                                          • Instruction ID: f86d0bfa028b3355662eaf225ee7f0f9ea563091d72a369f551eeacd452bd8a3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 79518F3290CA8A86EB64BF259144368F6A0FB54F94F188236DB5D87B95CF3EE490C711
                                                                                                                                                                                                          Function 00007FF646AB2810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Message
                                                                                                                                                                                                          • String ID: ERROR$Error$[PYI-%d:%ls]
                                                                                                                                                                                                          • API String ID: 2030045667-255084403
                                                                                                                                                                                                          • Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
                                                                                                                                                                                                          • Instruction ID: 9e8d19d2ed1f2bc9a69fc9b3d6ec2212395e429851e979d2b3735ae190349c10
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 50219FA2B0CB4182E650BB54F8447EAA3A4FB88784F400136EE8D93659DE3DD689C710
                                                                                                                                                                                                          Function 00007FF646ACC610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2718003287-0
                                                                                                                                                                                                          • Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
                                                                                                                                                                                                          • Instruction ID: 0dba6a515fa2e01f3673ed82e3a01550e4808a6e0913874a808adb3bc7c19de5
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 42D114B2B1CE808AE710EF65D4442AC77B2FB44B98B448235DE5F97B89DE39D046C350
                                                                                                                                                                                                          Function 00007FF646AB20C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1956198572-0
                                                                                                                                                                                                          • Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                          • Instruction ID: 47707f41c947277ee21eb20f1cba9eb01b94d3b999dd30700cc6c654e67de4f0
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F111A971A1C94642F694F769F5442B99292EB89B84F488031DF4947B9DCD2FD8D5C220
                                                                                                                                                                                                          Function 00007FF646AD5B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID: ?
                                                                                                                                                                                                          • API String ID: 1286766494-1684325040
                                                                                                                                                                                                          • Opcode ID: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
                                                                                                                                                                                                          • Instruction ID: 1ad96de91a2e71baa94c0c0fa1f11e64dfbd77817f8c3bc05a208d5144c89007
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 33412B12A0CA8245FB24BB25E405379E691EF90BA4F144235EF5D86AD5DF3ED8C1C710
                                                                                                                                                                                                          Function 00007FF646AC9084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _invalid_parameter_noinfo.LIBCMT ref: 00007FF646AC90B6
                                                                                                                                                                                                            • Part of subcall function 00007FF646ACA9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF646AD2D92,?,?,?,00007FF646AD2DCF,?,?,00000000,00007FF646AD3295,?,?,?,00007FF646AD31C7), ref: 00007FF646ACA9CE
                                                                                                                                                                                                            • Part of subcall function 00007FF646ACA9B8: GetLastError.KERNEL32(?,?,?,00007FF646AD2D92,?,?,?,00007FF646AD2DCF,?,?,00000000,00007FF646AD3295,?,?,?,00007FF646AD31C7), ref: 00007FF646ACA9D8
                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF646ABCC15), ref: 00007FF646AC90D4
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID: C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                          • API String ID: 3580290477-2817503745
                                                                                                                                                                                                          • Opcode ID: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
                                                                                                                                                                                                          • Instruction ID: b9cd7c38ff6c84f88980d320efce69b329563604248803c2d62eb1080271ffe3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6B416032A0CF5286EB54FF25A4420BDA795EF457D4B554035EA4F83B85DE3EE4C18360
                                                                                                                                                                                                          Function 00007FF646ACCCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorFileLastWrite
                                                                                                                                                                                                          • String ID: U
                                                                                                                                                                                                          • API String ID: 442123175-4171548499
                                                                                                                                                                                                          • Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
                                                                                                                                                                                                          • Instruction ID: d80dacdd379b6231e40d1a1cfeaf56bfd43486245b47f24f5af2b85ff2a7b5d5
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4E41B472B1CA4581DB61AF25E4443AAA7A1FB88794F444035EE4EC7B98EF3DD481C750
                                                                                                                                                                                                          Function 00007FF646ACF628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentDirectory
                                                                                                                                                                                                          • String ID: :
                                                                                                                                                                                                          • API String ID: 1611563598-336475711
                                                                                                                                                                                                          • Opcode ID: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
                                                                                                                                                                                                          • Instruction ID: 8beab3b547bb5766f344f132f6ee627726beca0c861ab153c26e978782805346
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6B21B662A0CE8182FB20BB15D04426DB3B1FF84B44F954035DA9E83694DF7EE9C58761
                                                                                                                                                                                                          Function 00007FF646ABFDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                          • String ID: csm
                                                                                                                                                                                                          • API String ID: 2573137834-1018135373
                                                                                                                                                                                                          • Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
                                                                                                                                                                                                          • Instruction ID: 7d9e53c96976b0a9da84be20f7235d8270a38c20977b9f41d312cad6607664ba
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8311193261CF8582EB61AB15F440269B7E5FB88B88F584234DF8D47B69DF3DD5918B00
                                                                                                                                                                                                          Function 00007FF646AD07AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.2268055145.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268031814.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268088150.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268116056.00007FF646AF2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.2268159479.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID: :
                                                                                                                                                                                                          • API String ID: 2595371189-336475711
                                                                                                                                                                                                          • Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
                                                                                                                                                                                                          • Instruction ID: 9151ae9870f228d7b05f5a075ce259a5260c193ca323c73bcf92ff579b76113a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3D01676291CE0785FB60BF60A46627EA3A0FF44744F840135D95DC6695DF3EE5848B34

                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                          Execution Coverage:3.3%
                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                          Signature Coverage:0%
                                                                                                                                                                                                          Total number of Nodes:554
                                                                                                                                                                                                          Total number of Limit Nodes:14
                                                                                                                                                                                                          execution_graph 27690 7ff646ab2fe0 27691 7ff646ab2ff0 27690->27691 27692 7ff646ab3041 27691->27692 27693 7ff646ab302b 27691->27693 27695 7ff646ab3061 27692->27695 27705 7ff646ab3077 __std_exception_destroy 27692->27705 27744 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 27693->27744 27745 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 27695->27745 27698 7ff646ab3037 __std_exception_destroy 27746 7ff646abc5c0 27698->27746 27701 7ff646ab3349 27756 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 27701->27756 27703 7ff646ab3333 27755 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 27703->27755 27705->27698 27705->27701 27705->27703 27706 7ff646ab330d 27705->27706 27708 7ff646ab3207 27705->27708 27710 7ff646ab1470 27705->27710 27754 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 27706->27754 27734 7ff646ab2500 27708->27734 27757 7ff646ab45b0 27710->27757 27713 7ff646ab14bc 27767 7ff646ac0744 27713->27767 27714 7ff646ab149b 27791 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 27714->27791 27717 7ff646ab14ab 27717->27705 27718 7ff646ab14d1 27719 7ff646ab14d5 _get_daylight 27718->27719 27720 7ff646ab14f8 27718->27720 27792 7ff646ab2910 11 API calls __FrameHandler3::FrameUnwindToEmptyState 27719->27792 27722 7ff646ab1532 27720->27722 27723 7ff646ab1508 _get_daylight 27720->27723 27724 7ff646ab1538 27722->27724 27727 7ff646ab154b 27722->27727 27793 7ff646ab2910 11 API calls __FrameHandler3::FrameUnwindToEmptyState 27723->27793 27771 7ff646ab1210 27724->27771 27729 7ff646ab14f3 __std_exception_destroy 27727->27729 27732 7ff646ab15d6 _get_daylight 27727->27732 27794 7ff646ac040c 27727->27794 27787 7ff646ac00bc 27729->27787 27730 7ff646ab15c4 27730->27705 27797 7ff646ab2910 11 API calls __FrameHandler3::FrameUnwindToEmptyState 27732->27797 27735 7ff646ab2536 27734->27735 27736 7ff646ab252c 27734->27736 27738 7ff646ab9400 2 API calls 27735->27738 27739 7ff646ab254b 27735->27739 27737 7ff646ab9400 2 API calls 27736->27737 27737->27735 27738->27739 27741 7ff646ab9400 2 API calls 27739->27741 27742 7ff646ab2560 27739->27742 27741->27742 28001 7ff646ab2390 27742->28001 27743 7ff646ab257c __std_exception_destroy 27743->27698 27744->27698 27745->27698 27747 7ff646abc5c9 27746->27747 27748 7ff646ab31fa 27747->27748 27749 7ff646abc950 IsProcessorFeaturePresent 27747->27749 27750 7ff646abc96f capture_previous_context 27749->27750 27751 7ff646abc968 27749->27751 28015 7ff646abc910 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 27750->28015 27751->27750 27754->27698 27755->27698 27756->27698 27758 7ff646ab45bc 27757->27758 27798 7ff646ab9400 27758->27798 27760 7ff646ab45e4 27761 7ff646ab9400 2 API calls 27760->27761 27762 7ff646ab45f7 27761->27762 27803 7ff646ac6004 27762->27803 27764 7ff646ab4606 27765 7ff646abc5c0 __FrameHandler3::FrameUnwindToEmptyState 6 API calls 27764->27765 27766 7ff646ab1493 27765->27766 27766->27713 27766->27714 27768 7ff646ac0774 27767->27768 27868 7ff646ac04d4 27768->27868 27770 7ff646ac078d 27770->27718 27772 7ff646ab1268 27771->27772 27773 7ff646ab126f 27772->27773 27774 7ff646ab1297 27772->27774 27873 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 27773->27873 27777 7ff646ab12b1 _get_daylight 27774->27777 27778 7ff646ab12d4 27774->27778 27776 7ff646ab1282 27776->27729 27874 7ff646ab2910 11 API calls __FrameHandler3::FrameUnwindToEmptyState 27777->27874 27780 7ff646ab12e6 _get_daylight 27778->27780 27786 7ff646ab1309 _fread_nolock 27778->27786 27875 7ff646ab2910 11 API calls __FrameHandler3::FrameUnwindToEmptyState 27780->27875 27781 7ff646ac040c _fread_nolock 19 API calls 27781->27786 27783 7ff646ab12cf __std_exception_destroy 27783->27729 27784 7ff646ab13cf 27876 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 27784->27876 27786->27781 27786->27783 27786->27784 27788 7ff646ac00ec 27787->27788 27877 7ff646abfe98 27788->27877 27790 7ff646ac0105 27790->27730 27791->27717 27792->27729 27793->27729 27936 7ff646ac042c 27794->27936 27796 7ff646ac0424 27796->27727 27797->27729 27799 7ff646ab9446 27798->27799 27800 7ff646ab9422 MultiByteToWideChar 27798->27800 27801 7ff646ab9463 MultiByteToWideChar 27799->27801 27802 7ff646ab945c __std_exception_destroy 27799->27802 27800->27799 27800->27802 27801->27802 27802->27760 27804 7ff646ac5f38 27803->27804 27805 7ff646ac5f5e _get_daylight 27804->27805 27807 7ff646ac5f91 27804->27807 27806 7ff646ac5f63 _invalid_parameter_noinfo 27805->27806 27809 7ff646ac5f6e _get_daylight 27806->27809 27807->27809 27810 7ff646acff3c 27807->27810 27809->27764 27811 7ff646acff62 27810->27811 27812 7ff646acff96 27811->27812 27814 7ff646ad6dc4 27811->27814 27812->27809 27817 7ff646ad63c4 27814->27817 27818 7ff646ad63db _get_daylight 27817->27818 27821 7ff646ad63f9 27817->27821 27819 7ff646ad63e0 _invalid_parameter_noinfo 27818->27819 27822 7ff646ad63ee 27819->27822 27820 7ff646ad6415 27826 7ff646ad69d4 27820->27826 27821->27818 27821->27820 27822->27812 27824 7ff646ad6440 27824->27822 27848 7ff646ac8568 LeaveCriticalSection 27824->27848 27849 7ff646ad6708 27826->27849 27828 7ff646ad6a1b 27831 7ff646ad6a49 _fread_nolock _get_daylight 27828->27831 27859 7ff646ac8590 27828->27859 27830 7ff646ad6a66 27830->27831 27832 7ff646ad6a86 CreateFileW 27830->27832 27831->27824 27833 7ff646ad6af1 27832->27833 27834 7ff646ad6b6c GetFileType 27832->27834 27837 7ff646ad6b39 GetLastError 27833->27837 27839 7ff646ad6aff CreateFileW 27833->27839 27835 7ff646ad6bca 27834->27835 27836 7ff646ad6b79 GetLastError 27834->27836 27843 7ff646ad6c40 27835->27843 27865 7ff646ad6910 13 API calls 2 library calls 27835->27865 27864 7ff646ac4eec __free_lconv_mon 27836->27864 27837->27831 27839->27834 27839->27837 27840 7ff646ad6b88 CloseHandle 27840->27831 27841 7ff646ad6bba _get_daylight 27840->27841 27841->27831 27843->27831 27844 7ff646ad6d0c CloseHandle CreateFileW 27843->27844 27844->27841 27845 7ff646ad6d53 GetLastError 27844->27845 27846 7ff646ad6d60 _fread_nolock 27845->27846 27866 7ff646ac86d0 SetStdHandle _fread_nolock _get_daylight 27846->27866 27850 7ff646ad6734 _get_daylight 27849->27850 27854 7ff646ad6752 _get_daylight 27849->27854 27851 7ff646ad6743 _invalid_parameter_noinfo 27850->27851 27850->27854 27851->27854 27852 7ff646ad681f 27858 7ff646ad6876 27852->27858 27867 7ff646ac9be8 _invalid_parameter_noinfo _get_daylight 27852->27867 27853 7ff646ad67d0 _get_daylight 27853->27852 27856 7ff646ad6812 _invalid_parameter_noinfo 27853->27856 27854->27853 27857 7ff646ad67c1 _invalid_parameter_noinfo 27854->27857 27856->27852 27857->27853 27858->27828 27861 7ff646ac85b3 27859->27861 27860 7ff646ac85dc 27860->27830 27861->27860 27862 7ff646ac8632 EnterCriticalSection 27861->27862 27862->27860 27863 7ff646ac8641 LeaveCriticalSection 27862->27863 27863->27861 27864->27840 27865->27843 27866->27841 27867->27858 27869 7ff646ac04fe 27868->27869 27871 7ff646ac0525 27869->27871 27872 7ff646aca884 12 API calls 27869->27872 27871->27770 27872->27871 27873->27776 27874->27783 27875->27783 27876->27783 27878 7ff646abfeb3 27877->27878 27880 7ff646abfee1 27877->27880 27893 7ff646aca884 12 API calls 27878->27893 27882 7ff646abfed3 27880->27882 27883 7ff646abff14 27880->27883 27882->27790 27884 7ff646abff2f 27883->27884 27886 7ff646abff54 27883->27886 27905 7ff646aca884 12 API calls 27884->27905 27891 7ff646abff4f 27886->27891 27894 7ff646acadf8 27886->27894 27888 7ff646abff71 27898 7ff646acaa6c 27888->27898 27891->27882 27893->27882 27895 7ff646acae0c 27894->27895 27897 7ff646acae20 27894->27897 27896 7ff646aca9b8 __free_lconv_mon 2 API calls 27895->27896 27895->27897 27896->27897 27897->27888 27901 7ff646abff83 27898->27901 27902 7ff646acaa98 27898->27902 27899 7ff646acaafc 27916 7ff646aca884 12 API calls 27899->27916 27901->27891 27906 7ff646aca9b8 27901->27906 27902->27899 27903 7ff646acaac8 27902->27903 27910 7ff646aca9f4 27903->27910 27905->27891 27907 7ff646aca9e5 __free_lconv_mon _get_daylight 27906->27907 27908 7ff646aca9bd RtlFreeHeap 27906->27908 27907->27891 27908->27907 27909 7ff646aca9d8 GetLastError 27908->27909 27909->27907 27911 7ff646acaa10 27910->27911 27912 7ff646acaa45 27911->27912 27917 7ff646acabc8 27911->27917 27930 7ff646ac8568 LeaveCriticalSection 27912->27930 27916->27901 27931 7ff646ac878c 27917->27931 27919 7ff646acabe4 27920 7ff646acabea 27919->27920 27921 7ff646acac27 27919->27921 27923 7ff646ac878c _invalid_parameter_noinfo 27919->27923 27935 7ff646ac86d0 SetStdHandle _fread_nolock _get_daylight 27920->27935 27921->27920 27924 7ff646ac878c _invalid_parameter_noinfo 27921->27924 27925 7ff646acac1a 27923->27925 27926 7ff646acac33 CloseHandle 27924->27926 27927 7ff646ac878c _invalid_parameter_noinfo 27925->27927 27926->27920 27928 7ff646acac40 GetLastError 27926->27928 27927->27921 27928->27920 27929 7ff646acac4f 27929->27912 27932 7ff646ac87aa _fread_nolock _get_daylight 27931->27932 27933 7ff646ac8795 _fread_nolock _get_daylight 27931->27933 27932->27933 27934 7ff646ac87ed _invalid_parameter_noinfo 27932->27934 27933->27919 27934->27933 27935->27929 27937 7ff646ac0456 27936->27937 27942 7ff646ac0485 27936->27942 27938 7ff646ac0465 _fread_nolock _get_daylight 27937->27938 27939 7ff646ac04a2 27937->27939 27937->27942 27940 7ff646ac047a _invalid_parameter_noinfo 27938->27940 27943 7ff646ac01ac 27939->27943 27940->27942 27942->27796 27945 7ff646ac01f5 27943->27945 27947 7ff646ac01db _fread_nolock _get_daylight 27943->27947 27944 7ff646ac01f0 _invalid_parameter_noinfo 27944->27945 27945->27942 27947->27945 27949 7ff646ac01e5 _fread_nolock _get_daylight 27947->27949 27950 7ff646ac02e1 _invalid_parameter_noinfo 27947->27950 27951 7ff646acbacc 27947->27951 27980 7ff646acbf1c 27947->27980 27949->27944 27950->27947 27952 7ff646acbaf4 _fread_nolock _get_daylight 27951->27952 27953 7ff646acbb0d 27951->27953 27952->27947 27953->27952 27954 7ff646acbb61 _fread_nolock _get_daylight 27953->27954 27956 7ff646acbb92 27953->27956 27955 7ff646acbef9 _invalid_parameter_noinfo 27954->27955 27955->27952 27957 7ff646acbbb9 27956->27957 27958 7ff646acbbf3 27956->27958 27961 7ff646acbbc6 _fread_nolock _get_daylight 27956->27961 27957->27961 27969 7ff646acbbe2 27957->27969 27986 7ff646acd66c 27958->27986 27960 7ff646acbc04 27962 7ff646aca9b8 __free_lconv_mon 2 API calls 27960->27962 27963 7ff646acbbd2 _invalid_parameter_noinfo 27961->27963 27964 7ff646acbc0e 27962->27964 27979 7ff646acbc1d _fread_nolock _get_daylight 27963->27979 27966 7ff646aca9b8 __free_lconv_mon 2 API calls 27964->27966 27965 7ff646acbd8e 27967 7ff646acbd93 ReadFile 27965->27967 27966->27969 27970 7ff646acbead GetLastError 27967->27970 27971 7ff646acbdb9 27967->27971 27968 7ff646acbd21 GetConsoleMode 27968->27965 27972 7ff646acbd35 27968->27972 27969->27965 27969->27968 27969->27979 27970->27979 27971->27970 27974 7ff646acbd82 27971->27974 27972->27967 27975 7ff646acbd3f ReadConsoleW 27972->27975 27973 7ff646aca9b8 __free_lconv_mon 2 API calls 27973->27952 27977 7ff646acbdf2 27974->27977 27974->27979 27975->27974 27976 7ff646acbd63 GetLastError 27975->27976 27976->27979 27990 7ff646acb6e4 ReadFile GetLastError MultiByteToWideChar _fread_nolock _get_daylight 27977->27990 27979->27973 27981 7ff646acbf39 _get_daylight 27980->27981 27984 7ff646acbf64 27980->27984 27982 7ff646acbf3e _invalid_parameter_noinfo 27981->27982 27983 7ff646acbf49 27982->27983 27983->27947 27984->27983 27991 7ff646acb9ac 27984->27991 27988 7ff646acd6b5 _get_daylight 27986->27988 27989 7ff646acd67b _fread_nolock 27986->27989 27987 7ff646acd69e HeapAlloc 27987->27988 27987->27989 27988->27960 27989->27987 27989->27988 27990->27979 27992 7ff646acba06 27991->27992 27993 7ff646acb9d6 _fread_nolock _get_daylight 27991->27993 27994 7ff646acba1f _fread_nolock _get_daylight 27992->27994 27995 7ff646acba7b 27992->27995 27993->27983 27996 7ff646acba32 _invalid_parameter_noinfo 27994->27996 27997 7ff646acbacc _fread_nolock 13 API calls 27995->27997 27998 7ff646acba98 _fread_nolock _get_daylight 27995->27998 27996->27993 27997->27998 28000 7ff646ac8568 LeaveCriticalSection 27998->28000 28013 7ff646abc8c0 28001->28013 28004 7ff646ab23e5 _fread_nolock 28005 7ff646ab246b DialogBoxIndirectParamW 28004->28005 28006 7ff646ab24a1 __std_exception_destroy 28005->28006 28007 7ff646ab24c1 DeleteObject 28006->28007 28008 7ff646ab24c7 28006->28008 28007->28008 28009 7ff646ab24d3 DestroyIcon 28008->28009 28010 7ff646ab24d9 28008->28010 28009->28010 28011 7ff646abc5c0 __FrameHandler3::FrameUnwindToEmptyState 6 API calls 28010->28011 28012 7ff646ab24ea 28011->28012 28012->27743 28014 7ff646ab23a9 GetModuleHandleW 28013->28014 28014->28004 28016 7ff646ab20c0 28017 7ff646ab20d5 28016->28017 28018 7ff646ab213b GetWindowLongPtrW 28016->28018 28022 7ff646ab210a SetWindowLongPtrW 28017->28022 28023 7ff646ab20e2 28017->28023 28026 7ff646ab2180 GetDC 28018->28026 28020 7ff646ab20f4 EndDialog 28024 7ff646ab20fa 28020->28024 28025 7ff646ab2124 28022->28025 28023->28020 28023->28024 28027 7ff646ab224d 28026->28027 28028 7ff646ab21bd 28026->28028 28031 7ff646ab2252 MoveWindow MoveWindow MoveWindow MoveWindow 28027->28031 28029 7ff646ab21ef SelectObject 28028->28029 28030 7ff646ab21fb DrawTextW 28028->28030 28029->28030 28032 7ff646ab2231 ReleaseDC 28030->28032 28033 7ff646ab2225 SelectObject 28030->28033 28034 7ff646abc5c0 __FrameHandler3::FrameUnwindToEmptyState 6 API calls 28031->28034 28032->28031 28033->28032 28035 7ff646ab2158 InvalidateRect 28034->28035 28035->28024 28036 7ff646acc084 28038 7ff646acc0db 28036->28038 28044 7ff646acc0ad 28036->28044 28037 7ff646acc0f4 28051 7ff646aca884 12 API calls 28037->28051 28038->28037 28040 7ff646acc14b 28038->28040 28041 7ff646acc169 28040->28041 28045 7ff646acc1a4 28040->28045 28052 7ff646ac8568 LeaveCriticalSection 28041->28052 28046 7ff646ac878c _invalid_parameter_noinfo 28045->28046 28047 7ff646acc1cb 28046->28047 28048 7ff646acc1e2 SetFilePointerEx 28047->28048 28050 7ff646acc1d1 28047->28050 28049 7ff646acc1fa GetLastError 28048->28049 28048->28050 28049->28050 28050->28041 28051->28044 28053 7ff646ac99d1 28054 7ff646ac99d6 28053->28054 28055 7ff646ac99fd GetModuleHandleW 28054->28055 28056 7ff646ac9a47 28054->28056 28055->28056 28057 7ff646ac9a0a 28055->28057 28057->28056 28058 7ff646ac5698 28059 7ff646ac56cf 28058->28059 28062 7ff646ac56b2 _fread_nolock _get_daylight 28058->28062 28060 7ff646ac56e2 CreateFileW 28059->28060 28059->28062 28061 7ff646ac5716 28060->28061 28068 7ff646ac574c _fread_nolock 28060->28068 28069 7ff646ac57ec 10 API calls 3 library calls 28061->28069 28065 7ff646ac56bf _invalid_parameter_noinfo 28062->28065 28064 7ff646ac5724 28066 7ff646ac5741 CloseHandle 28064->28066 28067 7ff646ac572b CloseHandle 28064->28067 28065->28068 28066->28068 28067->28068 28069->28064 28070 7ff646abccac 28079 7ff646abce7c 28070->28079 28072 7ff646abcd0b 28073 7ff646abcd91 __scrt_get_show_window_mode 28074 7ff646abcd9e 28073->28074 28085 7ff646ab1000 28074->28085 28076 7ff646abccc0 __scrt_acquire_startup_lock __scrt_release_startup_lock 28076->28072 28076->28073 28077 7ff646abcdb2 28077->28072 28161 7ff646abd000 __vcrt_uninitialize_ptd __vcrt_uninitialize_locks 28077->28161 28080 7ff646abce84 28079->28080 28081 7ff646abce90 __scrt_dllmain_crt_thread_attach 28080->28081 28082 7ff646abce9d 28081->28082 28084 7ff646abce99 28081->28084 28082->28084 28162 7ff646abd8f8 __vcrt_uninitialize_ptd __vcrt_uninitialize_locks 28082->28162 28084->28076 28086 7ff646ab1009 28085->28086 28163 7ff646ab36b0 28086->28163 28090 7ff646abc5c0 __FrameHandler3::FrameUnwindToEmptyState 6 API calls 28092 7ff646ab3ca7 28090->28092 28092->28077 28093 7ff646ab45b0 40 API calls 28094 7ff646ab392b 28093->28094 28095 7ff646ab396a 28094->28095 28222 7ff646ab7f80 28094->28222 28231 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28095->28231 28098 7ff646ab395d 28100 7ff646ab3962 28098->28100 28102 7ff646ab3984 28098->28102 28099 7ff646ab3808 __std_exception_destroy 28099->28090 28101 7ff646ac00bc 17 API calls 28100->28101 28101->28095 28102->28102 28103 7ff646ab1950 63 API calls 28102->28103 28104 7ff646ab39ce 28103->28104 28105 7ff646ab39de 28104->28105 28107 7ff646ab383c __std_exception_destroy 28104->28107 28232 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28105->28232 28108 7ff646ab3b2f 28107->28108 28110 7ff646ab3a60 __std_exception_destroy 28107->28110 28233 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28108->28233 28111 7ff646ab3c50 28110->28111 28116 7ff646ab3cd4 28110->28116 28128 7ff646ab3d2b __std_exception_destroy 28110->28128 28234 7ff646ab90e0 15 API calls __FrameHandler3::FrameUnwindToEmptyState 28111->28234 28113 7ff646ab3c55 28114 7ff646ab3c61 28113->28114 28115 7ff646ab3cb3 28113->28115 28235 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28114->28235 28236 7ff646ab8850 18 API calls 2 library calls 28115->28236 28116->28114 28118 7ff646ab3ced 28116->28118 28127 7ff646ab3d12 28118->28127 28118->28128 28119 7ff646ab3dc4 28122 7ff646ab9400 2 API calls 28119->28122 28120 7ff646ab3cbb 28123 7ff646ab3cbf 28120->28123 28124 7ff646ab3cc8 28120->28124 28126 7ff646ab3dd7 SetDllDirectoryW 28122->28126 28123->28114 28124->28128 28125 7ff646ab3da7 SetDllDirectoryW LoadLibraryExW 28125->28119 28146 7ff646ab3e0a __std_exception_destroy 28126->28146 28158 7ff646ab3e5a 28126->28158 28237 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28127->28237 28128->28119 28128->28125 28131 7ff646ab3ffc 28133 7ff646ab4029 28131->28133 28134 7ff646ab4006 PostMessageW GetMessageW 28131->28134 28132 7ff646ab3f1b 28241 7ff646ab33c0 67 API calls 2 library calls 28132->28241 28211 7ff646ab3360 28133->28211 28134->28133 28136 7ff646ab3f23 28136->28099 28137 7ff646ab3f2b 28136->28137 28242 7ff646ab90c0 LocalFree 28137->28242 28140 7ff646ab4039 28218 7ff646ab3670 28140->28218 28146->28158 28238 7ff646ab6db0 11 API calls _get_daylight 28146->28238 28148 7ff646ab404f 28153 7ff646ab3e6c 28156 7ff646ab3e85 28153->28156 28239 7ff646ab6df0 67 API calls __FrameHandler3::FrameUnwindToEmptyState 28153->28239 28156->28158 28240 7ff646ab6fb0 FreeLibrary 28156->28240 28158->28131 28158->28132 28161->28072 28162->28084 28164 7ff646abc8c0 28163->28164 28165 7ff646ab36bc GetModuleFileNameW 28164->28165 28166 7ff646ab3710 28165->28166 28167 7ff646ab36eb GetLastError 28165->28167 28244 7ff646ab92f0 FindFirstFileExW 28166->28244 28168 7ff646ab3706 28167->28168 28171 7ff646abc5c0 __FrameHandler3::FrameUnwindToEmptyState 6 API calls 28168->28171 28170 7ff646ab374c 28170->28168 28250 7ff646ab2810 7 API calls __FrameHandler3::FrameUnwindToEmptyState 28170->28250 28173 7ff646ab37b5 28171->28173 28172 7ff646ab371a 28172->28170 28174 7ff646ab3734 28172->28174 28173->28099 28177 7ff646ab1950 28173->28177 28249 7ff646ab2810 7 API calls __FrameHandler3::FrameUnwindToEmptyState 28174->28249 28178 7ff646ab45b0 40 API calls 28177->28178 28179 7ff646ab1985 28178->28179 28180 7ff646ab1c43 28179->28180 28181 7ff646ab7f80 36 API calls 28179->28181 28182 7ff646abc5c0 __FrameHandler3::FrameUnwindToEmptyState 6 API calls 28180->28182 28183 7ff646ab19cb 28181->28183 28184 7ff646ab1c5e 28182->28184 28185 7ff646ac0744 12 API calls 28183->28185 28210 7ff646ab1a03 28183->28210 28184->28093 28184->28107 28187 7ff646ab19e5 28185->28187 28186 7ff646ac00bc 17 API calls 28186->28180 28188 7ff646ab1a08 28187->28188 28189 7ff646ab19e9 _get_daylight 28187->28189 28190 7ff646ac040c _fread_nolock 19 API calls 28188->28190 28251 7ff646ab2910 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28189->28251 28191 7ff646ab1a20 28190->28191 28192 7ff646ab1a45 28191->28192 28193 7ff646ab1a26 _get_daylight 28191->28193 28196 7ff646ab1a5c _get_daylight 28192->28196 28197 7ff646ab1a7b 28192->28197 28252 7ff646ab2910 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28193->28252 28253 7ff646ab2910 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28196->28253 28199 7ff646ac0744 12 API calls 28197->28199 28200 7ff646ab1b01 28199->28200 28201 7ff646ab1b35 28200->28201 28202 7ff646ab1b16 _get_daylight 28200->28202 28203 7ff646ac040c _fread_nolock 19 API calls 28201->28203 28254 7ff646ab2910 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28202->28254 28204 7ff646ab1b4a 28203->28204 28205 7ff646ab1b50 _get_daylight 28204->28205 28208 7ff646ab1b6f 28204->28208 28255 7ff646ab2910 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28205->28255 28208->28210 28256 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28208->28256 28210->28186 28257 7ff646ab6350 28211->28257 28215 7ff646ab3381 28217 7ff646ab338d 28215->28217 28314 7ff646ab6040 28215->28314 28217->28140 28219 7ff646ab367e 28218->28219 28220 7ff646ab368f 28219->28220 28365 7ff646ab9050 FreeLibrary 28219->28365 28243 7ff646ab6fb0 FreeLibrary 28220->28243 28223 7ff646ab7fa4 28222->28223 28224 7ff646ab807b __std_exception_destroy 28223->28224 28225 7ff646ac0744 12 API calls 28223->28225 28224->28098 28226 7ff646ab7fc0 28225->28226 28226->28224 28366 7ff646ac7938 28226->28366 28228 7ff646ac0744 12 API calls 28230 7ff646ab7fd5 28228->28230 28229 7ff646ac040c _fread_nolock 19 API calls 28229->28230 28230->28224 28230->28228 28230->28229 28231->28099 28232->28099 28233->28099 28234->28113 28235->28099 28236->28120 28237->28099 28238->28153 28239->28156 28240->28158 28241->28136 28243->28148 28245 7ff646ab9342 28244->28245 28246 7ff646ab932f FindClose 28244->28246 28247 7ff646abc5c0 __FrameHandler3::FrameUnwindToEmptyState 6 API calls 28245->28247 28246->28245 28248 7ff646ab9363 28247->28248 28248->28172 28249->28168 28250->28168 28251->28210 28252->28210 28253->28210 28254->28210 28255->28210 28256->28210 28258 7ff646ab6365 28257->28258 28259 7ff646ab63aa 28258->28259 28262 7ff646ab63cd 28258->28262 28333 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28259->28333 28261 7ff646ab6403 28323 7ff646ab4550 28261->28323 28262->28261 28334 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28262->28334 28265 7ff646abc5c0 __FrameHandler3::FrameUnwindToEmptyState 6 API calls 28267 7ff646ab336e 28265->28267 28267->28217 28281 7ff646ab64f0 28267->28281 28268 7ff646ab641b 28270 7ff646ab6459 28268->28270 28271 7ff646ab6439 28268->28271 28269 7ff646ab9070 3 API calls 28269->28268 28329 7ff646ab9070 28270->28329 28335 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28271->28335 28274 7ff646ab6466 28275 7ff646ab64b1 28274->28275 28276 7ff646ab6472 28274->28276 28336 7ff646ab5820 86 API calls 28275->28336 28277 7ff646ab9400 2 API calls 28276->28277 28279 7ff646ab648a GetLastError 28277->28279 28280 7ff646ab63c3 28279->28280 28280->28265 28337 7ff646ab53f0 28281->28337 28283 7ff646ab6516 28284 7ff646ab651e 28283->28284 28285 7ff646ab652f 28283->28285 28355 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28284->28355 28341 7ff646ab4c80 28285->28341 28289 7ff646ab654c 28293 7ff646ab655c 28289->28293 28295 7ff646ab656d 28289->28295 28290 7ff646ab653b 28356 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28290->28356 28292 7ff646ab652a 28292->28215 28357 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28293->28357 28296 7ff646ab658c 28295->28296 28297 7ff646ab659d 28295->28297 28358 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28296->28358 28299 7ff646ab65ac 28297->28299 28300 7ff646ab65bd 28297->28300 28359 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28299->28359 28345 7ff646ab4d40 28300->28345 28304 7ff646ab65cc 28360 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28304->28360 28305 7ff646ab65dd 28307 7ff646ab65ec 28305->28307 28308 7ff646ab65fd 28305->28308 28361 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28307->28361 28310 7ff646ab660f 28308->28310 28312 7ff646ab6620 28308->28312 28362 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28310->28362 28312->28292 28363 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28312->28363 28315 7ff646ab6060 28314->28315 28315->28315 28316 7ff646ab6089 28315->28316 28321 7ff646ab60a0 __std_exception_destroy 28315->28321 28364 7ff646ab2710 11 API calls __FrameHandler3::FrameUnwindToEmptyState 28316->28364 28318 7ff646ab6095 28318->28217 28319 7ff646ab61ab 28319->28217 28320 7ff646ab1470 62 API calls 28320->28321 28321->28319 28321->28320 28322 7ff646ab2710 11 API calls 28321->28322 28322->28321 28324 7ff646ab455a 28323->28324 28325 7ff646ab9400 2 API calls 28324->28325 28326 7ff646ab457f 28325->28326 28327 7ff646abc5c0 __FrameHandler3::FrameUnwindToEmptyState 6 API calls 28326->28327 28328 7ff646ab45a7 28327->28328 28328->28268 28328->28269 28330 7ff646ab9400 2 API calls 28329->28330 28331 7ff646ab9084 LoadLibraryExW 28330->28331 28332 7ff646ab90a3 __std_exception_destroy 28331->28332 28332->28274 28333->28280 28334->28261 28335->28280 28336->28280 28340 7ff646ab541c 28337->28340 28338 7ff646ab5424 __std_exception_destroy 28338->28283 28339 7ff646ab47c0 6 API calls 28339->28340 28340->28338 28340->28339 28342 7ff646ab4cb0 28341->28342 28343 7ff646abc5c0 __FrameHandler3::FrameUnwindToEmptyState 6 API calls 28342->28343 28344 7ff646ab4d1a 28343->28344 28344->28289 28344->28290 28348 7ff646ab4d55 28345->28348 28346 7ff646abc5c0 __FrameHandler3::FrameUnwindToEmptyState 6 API calls 28347 7ff646ab4e6e 28346->28347 28347->28304 28347->28305 28349 7ff646ab9400 2 API calls 28348->28349 28354 7ff646ab4e23 __std_exception_destroy 28348->28354 28350 7ff646ab4df6 28349->28350 28351 7ff646ab9400 2 API calls 28350->28351 28352 7ff646ab4e0d 28351->28352 28353 7ff646ab9400 2 API calls 28352->28353 28353->28354 28354->28346 28355->28292 28356->28292 28357->28292 28358->28292 28359->28292 28360->28292 28361->28292 28362->28292 28363->28292 28364->28318 28365->28220 28367 7ff646ac7968 28366->28367 28370 7ff646ac7444 28367->28370 28369 7ff646ac7981 28369->28230 28371 7ff646ac745f 28370->28371 28373 7ff646ac748e 28370->28373 28384 7ff646aca884 12 API calls 28371->28384 28376 7ff646ac74b0 28373->28376 28375 7ff646ac747f 28375->28369 28377 7ff646ac74cb 28376->28377 28379 7ff646ac74f4 28376->28379 28385 7ff646aca884 12 API calls 28377->28385 28380 7ff646ac74eb 28379->28380 28381 7ff646ac7576 28379->28381 28380->28375 28386 7ff646ac775c 7 API calls __FrameHandler3::FrameUnwindToEmptyState 28381->28386 28383 7ff646ac7584 28383->28380 28384->28375 28385->28380 28386->28383 28387 7ff646abb88c 28388 7ff646abab8a 28387->28388 28390 7ff646abac06 28388->28390 28391 7ff646abbe00 28388->28391 28392 7ff646abbe23 28391->28392 28393 7ff646abbe41 _fread_nolock 28391->28393 28394 7ff646acd66c HeapAlloc 28392->28394 28393->28390 28394->28393

                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                          Function 00007FF646AB1000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 0 7ff646ab1000-7ff646ab3806 call 7ff646abfe88 call 7ff646abfe90 call 7ff646abc8c0 call 7ff646ac5460 call 7ff646ac54f4 call 7ff646ab36b0 14 7ff646ab3814-7ff646ab3836 call 7ff646ab1950 0->14 15 7ff646ab3808-7ff646ab380f 0->15 21 7ff646ab383c-7ff646ab3856 call 7ff646ab1c80 14->21 22 7ff646ab391b-7ff646ab3931 call 7ff646ab45b0 14->22 16 7ff646ab3c97-7ff646ab3cb2 call 7ff646abc5c0 15->16 26 7ff646ab385b-7ff646ab389b call 7ff646ab8a20 21->26 27 7ff646ab3933-7ff646ab3960 call 7ff646ab7f80 22->27 28 7ff646ab396a-7ff646ab397f call 7ff646ab2710 22->28 35 7ff646ab38c1-7ff646ab38cc call 7ff646ac4fa0 26->35 36 7ff646ab389d-7ff646ab38a3 26->36 38 7ff646ab3984-7ff646ab39a6 call 7ff646ab1c80 27->38 39 7ff646ab3962-7ff646ab3965 call 7ff646ac00bc 27->39 40 7ff646ab3c8f 28->40 48 7ff646ab38d2-7ff646ab38e1 call 7ff646ab8a20 35->48 49 7ff646ab39fc-7ff646ab3a2a call 7ff646ab8b30 call 7ff646ab8b90 * 3 35->49 41 7ff646ab38af-7ff646ab38bd call 7ff646ab8b90 36->41 42 7ff646ab38a5-7ff646ab38ad 36->42 53 7ff646ab39b0-7ff646ab39b9 38->53 39->28 40->16 41->35 42->41 58 7ff646ab39f4-7ff646ab39f7 call 7ff646ac4fa0 48->58 59 7ff646ab38e7-7ff646ab38ed 48->59 76 7ff646ab3a2f-7ff646ab3a3e call 7ff646ab8a20 49->76 53->53 56 7ff646ab39bb-7ff646ab39d8 call 7ff646ab1950 53->56 56->26 65 7ff646ab39de-7ff646ab39ef call 7ff646ab2710 56->65 58->49 63 7ff646ab38f0-7ff646ab38fc 59->63 66 7ff646ab38fe-7ff646ab3903 63->66 67 7ff646ab3905-7ff646ab3908 63->67 65->40 66->63 66->67 67->58 70 7ff646ab390e-7ff646ab3916 call 7ff646ac4fa0 67->70 70->76 79 7ff646ab3a44-7ff646ab3a47 76->79 80 7ff646ab3b45-7ff646ab3b53 76->80 79->80 81 7ff646ab3a4d-7ff646ab3a50 79->81 82 7ff646ab3b59-7ff646ab3b5d 80->82 83 7ff646ab3a67 80->83 84 7ff646ab3b14-7ff646ab3b17 81->84 85 7ff646ab3a56-7ff646ab3a5a 81->85 86 7ff646ab3a6b-7ff646ab3a90 call 7ff646ac4fa0 82->86 83->86 88 7ff646ab3b2f-7ff646ab3b40 call 7ff646ab2710 84->88 89 7ff646ab3b19-7ff646ab3b1d 84->89 85->84 87 7ff646ab3a60 85->87 95 7ff646ab3a92-7ff646ab3aa6 call 7ff646ab8b30 86->95 96 7ff646ab3aab-7ff646ab3ac0 86->96 87->83 97 7ff646ab3c7f-7ff646ab3c87 88->97 89->88 91 7ff646ab3b1f-7ff646ab3b2a 89->91 91->86 95->96 99 7ff646ab3be8-7ff646ab3bfa call 7ff646ab8a20 96->99 100 7ff646ab3ac6-7ff646ab3aca 96->100 97->40 109 7ff646ab3c2e 99->109 110 7ff646ab3bfc-7ff646ab3c02 99->110 102 7ff646ab3ad0-7ff646ab3ae8 call 7ff646ac52c0 100->102 103 7ff646ab3bcd-7ff646ab3be2 call 7ff646ab1940 100->103 113 7ff646ab3b62-7ff646ab3b7a call 7ff646ac52c0 102->113 114 7ff646ab3aea-7ff646ab3b02 call 7ff646ac52c0 102->114 103->99 103->100 115 7ff646ab3c31-7ff646ab3c40 call 7ff646ac4fa0 109->115 111 7ff646ab3c1e-7ff646ab3c2c 110->111 112 7ff646ab3c04-7ff646ab3c1c 110->112 111->115 112->115 122 7ff646ab3b87-7ff646ab3b9f call 7ff646ac52c0 113->122 123 7ff646ab3b7c-7ff646ab3b80 113->123 114->103 124 7ff646ab3b08-7ff646ab3b0f 114->124 125 7ff646ab3d41-7ff646ab3d63 call 7ff646ab44d0 115->125 126 7ff646ab3c46-7ff646ab3c4a 115->126 135 7ff646ab3ba1-7ff646ab3ba5 122->135 136 7ff646ab3bac-7ff646ab3bc4 call 7ff646ac52c0 122->136 123->122 124->103 139 7ff646ab3d71-7ff646ab3d82 call 7ff646ab1c80 125->139 140 7ff646ab3d65-7ff646ab3d6f call 7ff646ab4620 125->140 128 7ff646ab3c50-7ff646ab3c5f call 7ff646ab90e0 126->128 129 7ff646ab3cd4-7ff646ab3ce6 call 7ff646ab8a20 126->129 142 7ff646ab3c61 128->142 143 7ff646ab3cb3-7ff646ab3cbd call 7ff646ab8850 128->143 144 7ff646ab3d35-7ff646ab3d3c 129->144 145 7ff646ab3ce8-7ff646ab3ceb 129->145 135->136 136->103 157 7ff646ab3bc6 136->157 148 7ff646ab3d87-7ff646ab3d96 139->148 140->148 151 7ff646ab3c68 call 7ff646ab2710 142->151 162 7ff646ab3cbf-7ff646ab3cc6 143->162 163 7ff646ab3cc8-7ff646ab3ccf 143->163 144->151 145->144 152 7ff646ab3ced-7ff646ab3d10 call 7ff646ab1c80 145->152 154 7ff646ab3dc4-7ff646ab3dda call 7ff646ab9400 148->154 155 7ff646ab3d98-7ff646ab3d9f 148->155 164 7ff646ab3c6d-7ff646ab3c77 151->164 168 7ff646ab3d12-7ff646ab3d26 call 7ff646ab2710 call 7ff646ac4fa0 152->168 169 7ff646ab3d2b-7ff646ab3d33 call 7ff646ac4fa0 152->169 172 7ff646ab3de8-7ff646ab3e04 SetDllDirectoryW 154->172 173 7ff646ab3ddc 154->173 155->154 160 7ff646ab3da1-7ff646ab3da5 155->160 157->103 160->154 166 7ff646ab3da7-7ff646ab3dbe SetDllDirectoryW LoadLibraryExW 160->166 162->151 163->148 164->97 166->154 168->164 169->148 176 7ff646ab3f01-7ff646ab3f08 172->176 177 7ff646ab3e0a-7ff646ab3e19 call 7ff646ab8a20 172->177 173->172 179 7ff646ab3f0e-7ff646ab3f15 176->179 180 7ff646ab3ffc-7ff646ab4004 176->180 189 7ff646ab3e32-7ff646ab3e3c call 7ff646ac4fa0 177->189 190 7ff646ab3e1b-7ff646ab3e21 177->190 179->180 183 7ff646ab3f1b-7ff646ab3f25 call 7ff646ab33c0 179->183 184 7ff646ab4029-7ff646ab403e call 7ff646ab36a0 call 7ff646ab3360 call 7ff646ab3670 180->184 185 7ff646ab4006-7ff646ab4023 PostMessageW GetMessageW 180->185 183->164 197 7ff646ab3f2b-7ff646ab3f3f call 7ff646ab90c0 183->197 211 7ff646ab4043-7ff646ab405b call 7ff646ab6fb0 call 7ff646ab6d60 184->211 185->184 199 7ff646ab3ef2-7ff646ab3efc call 7ff646ab8b30 189->199 200 7ff646ab3e42-7ff646ab3e48 189->200 194 7ff646ab3e23-7ff646ab3e2b 190->194 195 7ff646ab3e2d-7ff646ab3e2f 190->195 194->195 195->189 209 7ff646ab3f41-7ff646ab3f5e PostMessageW GetMessageW 197->209 210 7ff646ab3f64-7ff646ab3fa7 call 7ff646ab8b30 call 7ff646ab8bd0 call 7ff646ab6fb0 call 7ff646ab6d60 call 7ff646ab8ad0 197->210 199->176 200->199 204 7ff646ab3e4e-7ff646ab3e54 200->204 207 7ff646ab3e5f-7ff646ab3e61 204->207 208 7ff646ab3e56-7ff646ab3e58 204->208 207->176 212 7ff646ab3e67-7ff646ab3e83 call 7ff646ab6db0 call 7ff646ab7330 207->212 208->212 213 7ff646ab3e5a 208->213 209->210 248 7ff646ab3fe9-7ff646ab3ff7 call 7ff646ab1900 210->248 249 7ff646ab3fa9-7ff646ab3fb3 call 7ff646ab9200 210->249 228 7ff646ab3e8e-7ff646ab3e95 212->228 229 7ff646ab3e85-7ff646ab3e8c 212->229 213->176 232 7ff646ab3eaf-7ff646ab3eb9 call 7ff646ab71a0 228->232 233 7ff646ab3e97-7ff646ab3ea4 call 7ff646ab6df0 228->233 231 7ff646ab3edb-7ff646ab3ef0 call 7ff646ab2a50 call 7ff646ab6fb0 call 7ff646ab6d60 229->231 231->176 243 7ff646ab3ec4-7ff646ab3ed2 call 7ff646ab74e0 232->243 244 7ff646ab3ebb-7ff646ab3ec2 232->244 233->232 242 7ff646ab3ea6-7ff646ab3ead 233->242 242->231 243->176 257 7ff646ab3ed4 243->257 244->231 248->164 249->248 259 7ff646ab3fb5-7ff646ab3fca 249->259 257->231 260 7ff646ab3fe4 call 7ff646ab2a50 259->260 261 7ff646ab3fcc-7ff646ab3fdf call 7ff646ab2710 call 7ff646ab1900 259->261 260->248 261->164
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                          • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
                                                                                                                                                                                                          • API String ID: 2776309574-4232158417
                                                                                                                                                                                                          • Opcode ID: c0a66ebca772141f760a29a0dd77fc68e5502f7a94feb123d2d63e937376cc0c
                                                                                                                                                                                                          • Instruction ID: e663eb8b3e3a5c81446f7c51d033023ef0ae220e8eabbe53520916e19b31bc26
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c0a66ebca772141f760a29a0dd77fc68e5502f7a94feb123d2d63e937376cc0c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 54328F61A0CE8A91FB15FB2594543B9E791AF45B80F844036DB5EC32D6EF2EE5D8C320
                                                                                                                                                                                                          Function 00007FF646AD69D4 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 475 7ff646ad69d4-7ff646ad6a47 call 7ff646ad6708 478 7ff646ad6a61-7ff646ad6a6b call 7ff646ac8590 475->478 479 7ff646ad6a49-7ff646ad6a52 call 7ff646ac4f58 475->479 485 7ff646ad6a6d-7ff646ad6a84 call 7ff646ac4f58 call 7ff646ac4f78 478->485 486 7ff646ad6a86-7ff646ad6aef CreateFileW 478->486 484 7ff646ad6a55-7ff646ad6a5c call 7ff646ac4f78 479->484 498 7ff646ad6da2-7ff646ad6dc2 484->498 485->484 489 7ff646ad6af1-7ff646ad6af7 486->489 490 7ff646ad6b6c-7ff646ad6b77 GetFileType 486->490 495 7ff646ad6b39-7ff646ad6b67 GetLastError call 7ff646ac4eec 489->495 496 7ff646ad6af9-7ff646ad6afd 489->496 492 7ff646ad6bca-7ff646ad6bd1 490->492 493 7ff646ad6b79-7ff646ad6bb4 GetLastError call 7ff646ac4eec CloseHandle 490->493 501 7ff646ad6bd3-7ff646ad6bd7 492->501 502 7ff646ad6bd9-7ff646ad6bdc 492->502 493->484 509 7ff646ad6bba-7ff646ad6bc5 call 7ff646ac4f78 493->509 495->484 496->495 503 7ff646ad6aff-7ff646ad6b37 CreateFileW 496->503 507 7ff646ad6be2-7ff646ad6c37 call 7ff646ac84a8 501->507 502->507 508 7ff646ad6bde 502->508 503->490 503->495 513 7ff646ad6c56-7ff646ad6c87 call 7ff646ad6488 507->513 514 7ff646ad6c39-7ff646ad6c45 call 7ff646ad6910 507->514 508->507 509->484 521 7ff646ad6c8d-7ff646ad6ccf 513->521 522 7ff646ad6c89-7ff646ad6c8b 513->522 514->513 520 7ff646ad6c47 514->520 523 7ff646ad6c49-7ff646ad6c51 call 7ff646acab30 520->523 524 7ff646ad6cf1-7ff646ad6cfc 521->524 525 7ff646ad6cd1-7ff646ad6cd5 521->525 522->523 523->498 526 7ff646ad6d02-7ff646ad6d06 524->526 527 7ff646ad6da0 524->527 525->524 529 7ff646ad6cd7-7ff646ad6cec 525->529 526->527 530 7ff646ad6d0c-7ff646ad6d51 CloseHandle CreateFileW 526->530 527->498 529->524 532 7ff646ad6d53-7ff646ad6d81 GetLastError call 7ff646ac4eec call 7ff646ac86d0 530->532 533 7ff646ad6d86-7ff646ad6d9b 530->533 532->533 533->527
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1617910340-0
                                                                                                                                                                                                          • Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
                                                                                                                                                                                                          • Instruction ID: 4b9469eb6c5fc31cb35a5f7cffc3118790cff9842ea38c706e8772ccd5f79d83
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D3C1D032B28E4585EB50EFA4C4902AC7772FB49B98F055229DE2E977D4CF3AE495C310
                                                                                                                                                                                                          Function 00007FF646AB92F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Find$CloseFileFirst
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2295610775-0
                                                                                                                                                                                                          • Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
                                                                                                                                                                                                          • Instruction ID: 94e0381262aa3be1df1a36332a5e030d073c09c9b33a0a3afa61ecf0f50070c9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7BF06872A1CB4586F7A0BB60B45976AF390FB84764F044339DA6D426D4DF3DD0898A10
                                                                                                                                                                                                          Function 00007FF646AB1950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 267 7ff646ab1950-7ff646ab198b call 7ff646ab45b0 270 7ff646ab1991-7ff646ab19d1 call 7ff646ab7f80 267->270 271 7ff646ab1c4e-7ff646ab1c72 call 7ff646abc5c0 267->271 276 7ff646ab19d7-7ff646ab19e7 call 7ff646ac0744 270->276 277 7ff646ab1c3b-7ff646ab1c3e call 7ff646ac00bc 270->277 282 7ff646ab1a08-7ff646ab1a24 call 7ff646ac040c 276->282 283 7ff646ab19e9-7ff646ab1a03 call 7ff646ac4f78 call 7ff646ab2910 276->283 281 7ff646ab1c43-7ff646ab1c4b 277->281 281->271 288 7ff646ab1a45-7ff646ab1a5a call 7ff646ac4f98 282->288 289 7ff646ab1a26-7ff646ab1a40 call 7ff646ac4f78 call 7ff646ab2910 282->289 283->277 297 7ff646ab1a5c-7ff646ab1a76 call 7ff646ac4f78 call 7ff646ab2910 288->297 298 7ff646ab1a7b-7ff646ab1afc call 7ff646ab1c80 * 2 call 7ff646ac0744 288->298 289->277 297->277 309 7ff646ab1b01-7ff646ab1b14 call 7ff646ac4fb4 298->309 312 7ff646ab1b35-7ff646ab1b4e call 7ff646ac040c 309->312 313 7ff646ab1b16-7ff646ab1b30 call 7ff646ac4f78 call 7ff646ab2910 309->313 318 7ff646ab1b50-7ff646ab1b6a call 7ff646ac4f78 call 7ff646ab2910 312->318 319 7ff646ab1b6f-7ff646ab1b8b call 7ff646ac0180 312->319 313->277 318->277 327 7ff646ab1b9e-7ff646ab1bac 319->327 328 7ff646ab1b8d-7ff646ab1b99 call 7ff646ab2710 319->328 327->277 331 7ff646ab1bb2-7ff646ab1bb9 327->331 328->277 333 7ff646ab1bc1-7ff646ab1bc7 331->333 334 7ff646ab1be0-7ff646ab1bef 333->334 335 7ff646ab1bc9-7ff646ab1bd6 333->335 334->334 336 7ff646ab1bf1-7ff646ab1bfa 334->336 335->336 337 7ff646ab1c0f 336->337 338 7ff646ab1bfc-7ff646ab1bff 336->338 340 7ff646ab1c11-7ff646ab1c24 337->340 338->337 339 7ff646ab1c01-7ff646ab1c04 338->339 339->337 341 7ff646ab1c06-7ff646ab1c09 339->341 342 7ff646ab1c26 340->342 343 7ff646ab1c2d-7ff646ab1c39 340->343 341->337 344 7ff646ab1c0b-7ff646ab1c0d 341->344 342->343 343->277 343->333 344->340
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB7F80: _fread_nolock.LIBCMT ref: 00007FF646AB802A
                                                                                                                                                                                                          • _fread_nolock.LIBCMT ref: 00007FF646AB1A1B
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB2910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF646AB1B6A), ref: 00007FF646AB295E
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _fread_nolock$CurrentProcess
                                                                                                                                                                                                          • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                          • API String ID: 2397952137-3497178890
                                                                                                                                                                                                          • Opcode ID: abc02df14881b8553accab44fb79ef53eaa7c88a432e732f5ead529d710b0ae2
                                                                                                                                                                                                          • Instruction ID: fb68b462c496d3267f3d19e048758a998510c19fa25a4a07b9e80cc3ea4f54ed
                                                                                                                                                                                                          • Opcode Fuzzy Hash: abc02df14881b8553accab44fb79ef53eaa7c88a432e732f5ead529d710b0ae2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5A81C671A0CE8A86E760FB24D0446F9A391FF45B84F404435DA8EC779ADE3EE5C58760
                                                                                                                                                                                                          Function 00007FF646AB2180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                          • String ID: P%
                                                                                                                                                                                                          • API String ID: 2147705588-2959514604
                                                                                                                                                                                                          • Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                          • Instruction ID: 8f999aa9f5823572a3b6343ba8003cdef3f383c2b888c49ce5458c15d0946eff
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 89510766618BA186D674AF22E4181BAF7A1F798B65F004121EFDE83794DF3DD085CB20
                                                                                                                                                                                                          Function 00007FF646AB1470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                          • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                          • API String ID: 2050909247-3659356012
                                                                                                                                                                                                          • Opcode ID: 3899eae9b9cf556598d50536af751799a91292f9e5d7650659be9fe1a68b4b95
                                                                                                                                                                                                          • Instruction ID: f56dee9665f3d7c6bce260a51f4e99b799b89c0c3015a8798b2d1cd23bd2389b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3899eae9b9cf556598d50536af751799a91292f9e5d7650659be9fe1a68b4b95
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5441BF62A0CE4695EB00FF2194411B9E391FF44B88F444532EE4E87B99DE3EE986C764
                                                                                                                                                                                                          Function 00007FF646AB1210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 538 7ff646ab1210-7ff646ab126d call 7ff646abbdf0 541 7ff646ab126f-7ff646ab1296 call 7ff646ab2710 538->541 542 7ff646ab1297-7ff646ab12af call 7ff646ac4fb4 538->542 547 7ff646ab12b1-7ff646ab12cf call 7ff646ac4f78 call 7ff646ab2910 542->547 548 7ff646ab12d4-7ff646ab12e4 call 7ff646ac4fb4 542->548 560 7ff646ab1439-7ff646ab146d call 7ff646abbad0 call 7ff646ac4fa0 * 2 547->560 554 7ff646ab1309-7ff646ab131b 548->554 555 7ff646ab12e6-7ff646ab1304 call 7ff646ac4f78 call 7ff646ab2910 548->555 558 7ff646ab1320-7ff646ab1345 call 7ff646ac040c 554->558 555->560 566 7ff646ab1431 558->566 567 7ff646ab134b-7ff646ab1355 call 7ff646ac0180 558->567 566->560 567->566 574 7ff646ab135b-7ff646ab1367 567->574 576 7ff646ab1370-7ff646ab1385 call 7ff646aba230 574->576 578 7ff646ab138a-7ff646ab1398 576->578 579 7ff646ab1416-7ff646ab142c call 7ff646ab2710 578->579 580 7ff646ab139a-7ff646ab139d 578->580 579->566 581 7ff646ab1411 580->581 582 7ff646ab139f-7ff646ab13a9 580->582 581->579 584 7ff646ab13d4-7ff646ab13d7 582->584 585 7ff646ab13ab-7ff646ab13c1 call 7ff646ac0b4c 582->585 586 7ff646ab13d9-7ff646ab13e7 call 7ff646ad9ea0 584->586 587 7ff646ab13ea-7ff646ab13ef 584->587 595 7ff646ab13cf-7ff646ab13d2 585->595 596 7ff646ab13c3-7ff646ab13cd call 7ff646ac0180 585->596 586->587 587->576 590 7ff646ab13f5-7ff646ab13f8 587->590 593 7ff646ab140c-7ff646ab140f 590->593 594 7ff646ab13fa-7ff646ab13fd 590->594 593->566 594->579 597 7ff646ab13ff-7ff646ab1407 594->597 595->579 596->587 596->595 597->558
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                          • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                          • API String ID: 2050909247-2813020118
                                                                                                                                                                                                          • Opcode ID: 5578c14fe94a244900e9a575e4f77a257a8de495ed559fdf9b362ebbbffb2fa7
                                                                                                                                                                                                          • Instruction ID: 94b5e9199faa9a2437e9a99d68bb45cad878c6760aeae8a0a6c71f3252fb2062
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5578c14fe94a244900e9a575e4f77a257a8de495ed559fdf9b362ebbbffb2fa7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8D51F762A0CE4685E660BB11A4403BAE291FF85F94F444135EE4EC77D9EF3EE985C720
                                                                                                                                                                                                          Function 00007FF646AB36B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(?,00007FF646AB3804), ref: 00007FF646AB36E1
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF646AB3804), ref: 00007FF646AB36EB
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF646AB3706,?,00007FF646AB3804), ref: 00007FF646AB2C9E
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF646AB3706,?,00007FF646AB3804), ref: 00007FF646AB2D63
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB2C50: MessageBoxW.USER32 ref: 00007FF646AB2D99
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
                                                                                                                                                                                                          • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                          • API String ID: 3187769757-2863816727
                                                                                                                                                                                                          • Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
                                                                                                                                                                                                          • Instruction ID: f4218f39d8e50210100c9c618269aac41dbcf59cfdedcadee4aa92cf82d355c3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1821B8A1F1CE4691FA20F720E8153B6E255BF48B95F804136EB5EC25D6EE2EE5C4C720
                                                                                                                                                                                                          Function 00007FF646ACBACC Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 699 7ff646acbacc-7ff646acbaf2 700 7ff646acbaf4-7ff646acbb08 call 7ff646ac4f58 call 7ff646ac4f78 699->700 701 7ff646acbb0d-7ff646acbb11 699->701 715 7ff646acbefe 700->715 702 7ff646acbee7-7ff646acbef3 call 7ff646ac4f58 call 7ff646ac4f78 701->702 703 7ff646acbb17-7ff646acbb1e 701->703 721 7ff646acbef9 _invalid_parameter_noinfo 702->721 703->702 707 7ff646acbb24-7ff646acbb52 703->707 707->702 710 7ff646acbb58-7ff646acbb5f 707->710 713 7ff646acbb61-7ff646acbb73 call 7ff646ac4f58 call 7ff646ac4f78 710->713 714 7ff646acbb78-7ff646acbb7b 710->714 713->721 718 7ff646acbee3-7ff646acbee5 714->718 719 7ff646acbb81-7ff646acbb87 714->719 720 7ff646acbf01-7ff646acbf18 715->720 718->720 719->718 723 7ff646acbb8d-7ff646acbb90 719->723 721->715 723->713 725 7ff646acbb92-7ff646acbbb7 723->725 726 7ff646acbbea-7ff646acbbf1 725->726 727 7ff646acbbb9-7ff646acbbbb 725->727 731 7ff646acbbf3-7ff646acbc1b call 7ff646acd66c call 7ff646aca9b8 * 2 726->731 732 7ff646acbbc6-7ff646acbbdd call 7ff646ac4f58 call 7ff646ac4f78 _invalid_parameter_noinfo 726->732 729 7ff646acbbe2-7ff646acbbe8 727->729 730 7ff646acbbbd-7ff646acbbc4 727->730 734 7ff646acbc68-7ff646acbc7f 729->734 730->729 730->732 758 7ff646acbc1d-7ff646acbc33 call 7ff646ac4f78 call 7ff646ac4f58 731->758 759 7ff646acbc38-7ff646acbc63 call 7ff646acc2f4 731->759 750 7ff646acbd70 732->750 737 7ff646acbc81-7ff646acbc89 734->737 738 7ff646acbcfa-7ff646acbd04 call 7ff646ad398c 734->738 737->738 742 7ff646acbc8b-7ff646acbc8d 737->742 748 7ff646acbd8e 738->748 749 7ff646acbd0a-7ff646acbd1f 738->749 742->738 746 7ff646acbc8f-7ff646acbca5 742->746 746->738 751 7ff646acbca7-7ff646acbcb3 746->751 753 7ff646acbd93-7ff646acbdb3 ReadFile 748->753 749->748 754 7ff646acbd21-7ff646acbd33 GetConsoleMode 749->754 755 7ff646acbd73-7ff646acbd7d call 7ff646aca9b8 750->755 751->738 756 7ff646acbcb5-7ff646acbcb7 751->756 760 7ff646acbead-7ff646acbeb6 GetLastError 753->760 761 7ff646acbdb9-7ff646acbdc1 753->761 754->748 762 7ff646acbd35-7ff646acbd3d 754->762 755->720 756->738 764 7ff646acbcb9-7ff646acbcd1 756->764 758->750 759->734 769 7ff646acbed3-7ff646acbed6 760->769 770 7ff646acbeb8-7ff646acbece call 7ff646ac4f78 call 7ff646ac4f58 760->770 761->760 766 7ff646acbdc7 761->766 762->753 768 7ff646acbd3f-7ff646acbd61 ReadConsoleW 762->768 764->738 772 7ff646acbcd3-7ff646acbcdf 764->772 777 7ff646acbdce-7ff646acbde3 766->777 779 7ff646acbd82-7ff646acbd8c 768->779 780 7ff646acbd63 GetLastError 768->780 774 7ff646acbedc-7ff646acbede 769->774 775 7ff646acbd69-7ff646acbd6b call 7ff646ac4eec 769->775 770->750 772->738 773 7ff646acbce1-7ff646acbce3 772->773 773->738 782 7ff646acbce5-7ff646acbcf5 773->782 774->755 775->750 777->755 784 7ff646acbde5-7ff646acbdf0 777->784 779->777 780->775 782->738 788 7ff646acbdf2-7ff646acbe0b call 7ff646acb6e4 784->788 789 7ff646acbe17-7ff646acbe1f 784->789 796 7ff646acbe10-7ff646acbe12 788->796 792 7ff646acbe21-7ff646acbe33 789->792 793 7ff646acbe9b-7ff646acbea8 call 7ff646acb524 789->793 797 7ff646acbe35 792->797 798 7ff646acbe8e-7ff646acbe96 792->798 793->796 796->755 800 7ff646acbe3a-7ff646acbe41 797->800 798->755 801 7ff646acbe43-7ff646acbe47 800->801 802 7ff646acbe7d-7ff646acbe88 800->802 803 7ff646acbe63 801->803 804 7ff646acbe49-7ff646acbe50 801->804 802->798 806 7ff646acbe69-7ff646acbe79 803->806 804->803 805 7ff646acbe52-7ff646acbe56 804->805 805->803 807 7ff646acbe58-7ff646acbe61 805->807 806->800 808 7ff646acbe7b 806->808 807->806 808->798
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                          • Opcode ID: ba46bac31fe72f1dd681b3566344db0dd8f54c3f22ac6e326a6392c95ac81308
                                                                                                                                                                                                          • Instruction ID: 4bd69cada80353a37acf5b273de84fa040e5e699879e62acb933e40167c84bd8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ba46bac31fe72f1dd681b3566344db0dd8f54c3f22ac6e326a6392c95ac81308
                                                                                                                                                                                                          • Instruction Fuzzy Hash: EEC1C322A0CF8681E761BB1594402BDBBA1EF81B80F554131EA4F87795CF7FE8D98720
                                                                                                                                                                                                          Function 00007FF646AB6350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                          • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                                                                                          • API String ID: 2050909247-2434346643
                                                                                                                                                                                                          • Opcode ID: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
                                                                                                                                                                                                          • Instruction ID: 7ee21ffe7dc67eb685b9e8cfd04273cce96db1e623073fe23fc909731debaf24
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 60416171B1CE8A91EA11FB20E5152E9E315FB44B84F800132EB5D83696EF3EE685C760
                                                                                                                                                                                                          Function 00007FF646AB2390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                          • String ID: Unhandled exception in script
                                                                                                                                                                                                          • API String ID: 3081866767-2699770090
                                                                                                                                                                                                          • Opcode ID: dd10c28d74256616f4f20b34f0e4914686707bcd8d030bd0fddff274f11205b5
                                                                                                                                                                                                          • Instruction ID: 1f4a9a6a93d6be28d5ca47a1fe6d4408e396623dd6e333d495b9e3931d868974
                                                                                                                                                                                                          • Opcode Fuzzy Hash: dd10c28d74256616f4f20b34f0e4914686707bcd8d030bd0fddff274f11205b5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8D31607261CA8189EB60FF21E8552F9A360FF88788F440135EA4E8BB49DF3DD184C710
                                                                                                                                                                                                          Function 00007FF646AC5698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1279662727-0
                                                                                                                                                                                                          • Opcode ID: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
                                                                                                                                                                                                          • Instruction ID: 003e7fb06907797d4426876347d0c4ceaf76d33be45db742ae55c21cd34c4069
                                                                                                                                                                                                          • Opcode Fuzzy Hash: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9C41A222D1CB8283E750BB219514379A260FF947A4F108334FA5E43AD6DF6DA8F08760
                                                                                                                                                                                                          Function 00007FF646AB20C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1956198572-0
                                                                                                                                                                                                          • Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                          • Instruction ID: 47707f41c947277ee21eb20f1cba9eb01b94d3b999dd30700cc6c654e67de4f0
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F111A971A1C94642F694F769F5442B99292EB89B84F488031DF4947B9DCD2FD8D5C220
                                                                                                                                                                                                          Function 00007FF646ABCCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3251591375-0
                                                                                                                                                                                                          • Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
                                                                                                                                                                                                          • Instruction ID: 68e24dddbd21d9a77a6339aa77bfa84cc9758c376dcb79c8f6f9fa717f17e5a3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 14317CA4E4CE0B91FA54BB24A4227B99792AF41B84F440435DB5FCB2D7DE2FA4C5C231
                                                                                                                                                                                                          Function 00007FF646AC01AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                          • Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
                                                                                                                                                                                                          • Instruction ID: a3783c103f76f5a150d3b5fcf152306cbe0f3b8844b431ddea41a13b1dbc13d8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E551D761B0DE5186EA24BE79940067AE291AF84BA8F144734DE7E877C5CF3FD4818620
                                                                                                                                                                                                          Function 00007FF646ACC1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorFileLastPointer
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2976181284-0
                                                                                                                                                                                                          • Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
                                                                                                                                                                                                          • Instruction ID: f830b1211c18eb29c1bc67a836b981ce4ee4ab7924ca5013b5d6ec107a6b7e74
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D81104A1B0CE4181DA10BB29A814169E361FB41BF4F544331EE7F8B7D8CE3DD0918710
                                                                                                                                                                                                          Function 00007FF646ACA9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • RtlFreeHeap.NTDLL(?,?,?,00007FF646AD2D92,?,?,?,00007FF646AD2DCF,?,?,00000000,00007FF646AD3295,?,?,?,00007FF646AD31C7), ref: 00007FF646ACA9CE
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF646AD2D92,?,?,?,00007FF646AD2DCF,?,?,00000000,00007FF646AD3295,?,?,?,00007FF646AD31C7), ref: 00007FF646ACA9D8
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 485612231-0
                                                                                                                                                                                                          • Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
                                                                                                                                                                                                          • Instruction ID: 5170b3c0750fc4f413f491839f4301f1448e701da48262983d5f2953801ff956
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A5E08650F0CF0243FF187BB258461789151AF84B40F054034CD1EC22A1DE2F68C58370
                                                                                                                                                                                                          Function 00007FF646ACABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,00007FF646ACAA45,?,?,00000000,00007FF646ACAAFA), ref: 00007FF646ACAC36
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF646ACAA45,?,?,00000000,00007FF646ACAAFA), ref: 00007FF646ACAC40
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CloseErrorHandleLast
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 918212764-0
                                                                                                                                                                                                          • Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
                                                                                                                                                                                                          • Instruction ID: 4421f65a1d5d932771d6c02c6a38c6ac6485ff798776fc5bca9598156b1a3e86
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5F219611F1CE4242FAA477A1949427996D2AF84B94F084235DB2FC77C6DE6EA8C58321
                                                                                                                                                                                                          Function 00007FF646ACBF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                          • Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
                                                                                                                                                                                                          • Instruction ID: ed8cf6e32a03d3f94da9f40b4b31d5b76b07cdec689a2c8ebc29546d551ad3c5
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5E41A17291CA018BEA34BB19A541279F3A4EF55B84F144131DA9FC7691CF2FE482CBA1
                                                                                                                                                                                                          Function 00007FF646AB7F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _fread_nolock
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 840049012-0
                                                                                                                                                                                                          • Opcode ID: e030e723ccfde11af85d0dda47479fa887e00b1a31505a58a3447353ba43a7bb
                                                                                                                                                                                                          • Instruction ID: e88ecf1e667533f00b64861faddc77ab2317fbcbad9f1e1e5c88d0b9f487e311
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e030e723ccfde11af85d0dda47479fa887e00b1a31505a58a3447353ba43a7bb
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A4219121B0DE9685FB54BA2665043BAD651BF45FC4F8C4430EF4D87B86CE7FE0818621
                                                                                                                                                                                                          Function 00007FF646ACB9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                          • Opcode ID: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
                                                                                                                                                                                                          • Instruction ID: 6e63662f9f859c76cc8bd77a0976d98c8a690125d1530e6c2cefc4eef86f082f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2431AE21A1CE468AF7517B55884137CAA60AF80B94F420135EA6F833E2CF7FE8C58775
                                                                                                                                                                                                          Function 00007FF646AC99D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3947729631-0
                                                                                                                                                                                                          • Opcode ID: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
                                                                                                                                                                                                          • Instruction ID: 44141691edc5fb6da086790566712c62181f1d305d7a84018295773ff131c47c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 65218E32E08B828AEB64FF64C4442FC73A0EB84718F441635D72E86AD5DF39D585CB60
                                                                                                                                                                                                          Function 00007FF646AC6004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                          • Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                          • Instruction ID: d6cd1648f345502d5c1341cf7a8f0021f5a7680b53877f4a911ded8a5316e984
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A7117522A1CE4189EE64BF51940117EE2A4BF45B84F444031FB4ED7B96DF7FE89087A0
                                                                                                                                                                                                          Function 00007FF646AD63C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                          • Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
                                                                                                                                                                                                          • Instruction ID: 81743825312f596e3e6acc6b0ddcb152fd889cf52da661fbec6b3b1d834786c3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7421507271CE4286DB61BF18D450379B6A1EB84B94F185234EA9EC76D9DF3ED4808B10
                                                                                                                                                                                                          Function 00007FF646AC042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                          • Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                          • Instruction ID: 34f793176986138ff5a0492500a7c0450bf4c5dc3551675a7404ce0c7b690199
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B601D621A0CF4140EA04FF569A0107AE691BF95FE0F084631EE6D97BD6CE3FE5918310
                                                                                                                                                                                                          Function 00007FF646AB9070 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB9400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF646AB45E4,00000000,00007FF646AB1985), ref: 00007FF646AB9439
                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,00007FF646AB6466,?,00007FF646AB336E), ref: 00007FF646AB9092
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ByteCharLibraryLoadMultiWide
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2592636585-0
                                                                                                                                                                                                          • Opcode ID: 7140f7c55cf735ced6a4f02887063d730e60c19ae08c919a697b9dfe54228ee6
                                                                                                                                                                                                          • Instruction ID: 8b1532ee70d9dc98c42d2d4301d7ecae923003158cc13b09837e4516e46c70d8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7140f7c55cf735ced6a4f02887063d730e60c19ae08c919a697b9dfe54228ee6
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0DD0C211F28A4541EA94F767BA466399252AFCEFC0F88C035EE1D43B4ADC3DC0814B00
                                                                                                                                                                                                          Function 00007FF646ACD66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • HeapAlloc.KERNEL32(?,?,?,00007FF646AC0D00,?,?,?,00007FF646AC236A,?,?,?,?,?,00007FF646AC3B59), ref: 00007FF646ACD6AA
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AllocHeap
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4292702814-0
                                                                                                                                                                                                          • Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
                                                                                                                                                                                                          • Instruction ID: 901096b45d9cde69264e8ed3c5aae3be45c3383c6456c806cd6efcfc95867fd2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
                                                                                                                                                                                                          • Instruction Fuzzy Hash: ACF05810B2DF0695FE647B615801279E2915F94BA0F080232DC2FC53C2DE2FA4C0E230

                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                          Function 00007FF8A7FEB6D0 Relevance: 91.4, APIs: 46, Strings: 6, Instructions: 369threadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Dealloc$Unicode_$ClearFormatFromUnraisableWrite$FetchRestoreString$CallObject_$ArgsCharCloseCreateExceptionFlagsFunctionHandleNormalizeOccurredRun_ThreadTuple_Widememcpy
                                                                                                                                                                                                          • String ID: %c%s%R%s$%c%s%s$, trying to convert the result back to C$done()$rom cffi callback $uring handling of the above exception by 'onerror'
                                                                                                                                                                                                          • API String ID: 3680899025-2484428055
                                                                                                                                                                                                          • Opcode ID: decc0abd9df1063f42d66e8780f255c007d8368bf3654e8c28f0d229d635d203
                                                                                                                                                                                                          • Instruction ID: 0eedf4f31b9e0ce9e35a0c83de3b875ed3f1bc7f1cb7e94abbb50bc8efb8d549
                                                                                                                                                                                                          • Opcode Fuzzy Hash: decc0abd9df1063f42d66e8780f255c007d8368bf3654e8c28f0d229d635d203
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1BF12932A0AA62A5EB159FB5E8446BC27A0FF44BD4F044035DE4E57B68EF7CE645E300
                                                                                                                                                                                                          Function 00007FF646AB8BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                                                                                                                                                          • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                                                                                                                                                          • API String ID: 3832162212-3165540532
                                                                                                                                                                                                          • Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
                                                                                                                                                                                                          • Instruction ID: 90a9b7065753a577a3d8aaa6a24ab6decbbff63b8eb4cc3ba588ef88bab95aef
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4CD17072A0CE8686EB50BF74E8542A9B761FF84B58F404235EE5D82A94DF3DD189C720
                                                                                                                                                                                                          Function 00007FF8A7FEBED0 Relevance: 30.0, APIs: 12, Strings: 5, Instructions: 234memoryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • libffi failed to build this callback, xrefs: 00007FF8A7FEC257
                                                                                                                                                                                                          • FFI_TRAMPOLINE_SIZE too small in src/c/libffi_x86_x64\ffi.c, xrefs: 00007FF8A7FEC1F9
                                                                                                                                                                                                          • O!O|OO:callback, xrefs: 00007FF8A7FEBF03
                                                                                                                                                                                                          • Cannot allocate write+execute memory for ffi.callback(). You might be running on a system that prevents this. For more information, see https://cffi.readthedocs.io/en/latest/using.html#callbacks, xrefs: 00007FF8A7FEC06D
                                                                                                                                                                                                          • %s: callback with unsupported argument or return type or with '...', xrefs: 00007FF8A7FEC0F5
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Dealloc$FormatObject_String$AllocArg_ErrorFatalInfoParseSizeSystemTrackTuple_Virtual
                                                                                                                                                                                                          • String ID: %s: callback with unsupported argument or return type or with '...'$Cannot allocate write+execute memory for ffi.callback(). You might be running on a system that prevents this. For more information, see https://cffi.readthedocs.io/en/latest/using.html#callbacks$FFI_TRAMPOLINE_SIZE too small in src/c/libffi_x86_x64\ffi.c$O!O|OO:callback$libffi failed to build this callback
                                                                                                                                                                                                          • API String ID: 1427098410-3680541158
                                                                                                                                                                                                          • Opcode ID: 23c9fd3e63b424cc72bec812328284be27760d706a1b8ba850e7a80d662f87e5
                                                                                                                                                                                                          • Instruction ID: 8ca5db29ecc8f7cf554ab4fd52e16b72def15030848b9e537dcd7d85e8df3f61
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 23c9fd3e63b424cc72bec812328284be27760d706a1b8ba850e7a80d662f87e5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3BB14D36A0AB52A5EB248F75E84027C73A4FB88BD4F448132DA8D577A4EF3CD695D304
                                                                                                                                                                                                          Function 00007FF8A7FFADB8 Relevance: 13.6, APIs: 9, Instructions: 71COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 313767242-0
                                                                                                                                                                                                          • Opcode ID: ea843acdad7c56c70b9743c44a311b0c1a9b6eb90ef1f84dc8ae54790f9ea7a2
                                                                                                                                                                                                          • Instruction ID: f5ffe3460cf48ac39b0d5135169f7d4d3f6b22ff32d402721a1960e2b7d5a45f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ea843acdad7c56c70b9743c44a311b0c1a9b6eb90ef1f84dc8ae54790f9ea7a2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 42313272609B8196EB609F70E8407EE7361FB45788F44403ADA4E47B94DF78D648C714
                                                                                                                                                                                                          Function 00007FF646ACA684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1239891234-0
                                                                                                                                                                                                          • Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
                                                                                                                                                                                                          • Instruction ID: 50dd96237e29b7b86551cdffe0ed105bee75ee508fc4e0750def38e2e7a9e7f6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 38316036618F8186DB60EF25E8402AEB3A4FB88758F540136EB9D83B58DF3DC185CB10
                                                                                                                                                                                                          Function 00007FF646AD18E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2227656907-0
                                                                                                                                                                                                          • Opcode ID: 2ef3c37f04818ead7d44404f95bcb0bbc346a7a2ea351082cea4bee254bbf61c
                                                                                                                                                                                                          • Instruction ID: 6b46c94d7df38dbe31fc08cd39529078ef482a1b3dcac93b16a71b437e0770a3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2ef3c37f04818ead7d44404f95bcb0bbc346a7a2ea351082cea4bee254bbf61c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 31B1C926B1CE9241EB61BB6194085B9E392EB44BD4F444131EE5E87BD5EF3EE8C1C320
                                                                                                                                                                                                          Function 00007FF646AD5EEC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF646AD5F1A
                                                                                                                                                                                                            • Part of subcall function 00007FF646AD5668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF646AD567C
                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF646AD5F2B
                                                                                                                                                                                                            • Part of subcall function 00007FF646AD5608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF646AD561C
                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF646AD5F3C
                                                                                                                                                                                                            • Part of subcall function 00007FF646AD5638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF646AD564C
                                                                                                                                                                                                            • Part of subcall function 00007FF646ACA9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF646AD2D92,?,?,?,00007FF646AD2DCF,?,?,00000000,00007FF646AD3295,?,?,?,00007FF646AD31C7), ref: 00007FF646ACA9CE
                                                                                                                                                                                                            • Part of subcall function 00007FF646ACA9B8: GetLastError.KERNEL32(?,?,?,00007FF646AD2D92,?,?,?,00007FF646AD2DCF,?,?,00000000,00007FF646AD3295,?,?,?,00007FF646AD31C7), ref: 00007FF646ACA9D8
                                                                                                                                                                                                          • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF646AD617C), ref: 00007FF646AD5F63
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3458911817-0
                                                                                                                                                                                                          • Opcode ID: 4f5f64917f1a6fb99e16ec8d4eadf885fc2e5ee96e92320975b551feff7f9d51
                                                                                                                                                                                                          • Instruction ID: 462c1a6e787762f53ce4442e65868ce01f5fa0c96262af21b11dcfb6fb0b5114
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4f5f64917f1a6fb99e16ec8d4eadf885fc2e5ee96e92320975b551feff7f9d51
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3F515332A0CA4286E714FF25D8815B9E762FF48784F449135EE4DC7696DF3EE48087A0
                                                                                                                                                                                                          Function 00007FF646AB5820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB5830
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB5842
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB5879
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB588B
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB58A4
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB58B6
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB58CF
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB58E1
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB58FD
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB590F
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB592B
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB593D
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB5959
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB596B
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB5987
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB5999
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB59B5
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF646AB64BF,?,00007FF646AB336E), ref: 00007FF646AB59C7
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressErrorLastProc
                                                                                                                                                                                                          • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                          • API String ID: 199729137-653951865
                                                                                                                                                                                                          • Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
                                                                                                                                                                                                          • Instruction ID: 3bfb4b33ddc7db6e6cf35bd3b5391dd9991feebdaef6050e558f8e4131e1bf98
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0322C6A494DF4B91FA44FF65A9141B4A3A6AF09B85F845035CC1F82660FF3EB9C89330
                                                                                                                                                                                                          Function 00007FF646AB76B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressErrorLastProc
                                                                                                                                                                                                          • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                          • API String ID: 199729137-3427451314
                                                                                                                                                                                                          • Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
                                                                                                                                                                                                          • Instruction ID: 714d873f52792af51d2eb95879a31041a4c2e9fb29adf144e46d7ae3e9b5053e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C202C664A4DF0B91FA95FB55A9145B4E3A2BF08B94F845036DD1E82260EF7EF5C88330
                                                                                                                                                                                                          Function 00007FF8A7FF9C40 Relevance: 89.5, APIs: 30, Strings: 21, Instructions: 211stringmemorythreadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Module_String$Err_$ConstantObjectUnicode_$Dict_From$FormatItemOccurredstrncmp$AllocAttrCapsule_Create2ImportImport_ModuleObject_ReadySys_Thread_allocate_lockType_
                                                                                                                                                                                                          • String ID: '%s' is an ill-formed type name$1$1.17.1$3.12.4$<cdata>$FFI_CDECL$FFI_DEFAULT_ABI$TlsAlloc() failed$_C_API$_IOBase$_WIN$__module__$__name__$__version__$_cffi_backend$_cffi_backend.$_io$can't allocate cffi_zombie_lock$cffi$this module was compiled for Python %c%c%c$version
                                                                                                                                                                                                          • API String ID: 3385652222-3179000925
                                                                                                                                                                                                          • Opcode ID: e35dcc5a39c1658808c63a9201d75b3221023b2b68b117264ad8d95726ba0c6a
                                                                                                                                                                                                          • Instruction ID: cd2f12150e43832ef3a475c9a95f00eedb9e2d5f962a9ec751671dd3de628680
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e35dcc5a39c1658808c63a9201d75b3221023b2b68b117264ad8d95726ba0c6a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: CCB1F922A0BA53A1FF10DF65E85427823A0FF45BC6F444135CA1E876A4EFBCE659E314
                                                                                                                                                                                                          Function 00007FF8A7FE7060 Relevance: 66.9, APIs: 29, Strings: 9, Instructions: 409threadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_Object_$FormatFree$Eval_MallocMemoryThreadValuemalloc$DeallocErrorInitLastLongLong_RestoreSaveString_errnomemcpymemset
                                                                                                                                                                                                          • String ID: '%s' expects %zd arguments, got %zd$'%s' expects at least %zd arguments, got %zd$a cdata function cannot be called with keyword arguments$argument %zd passed in the variadic part needs to be a cdata object (got %.200s)$cannot call null pointer pointer from cdata '%s'$cdata '%s' is not callable$int$return type is a struct/union with a varsize array member$return type is an opaque structure or union
                                                                                                                                                                                                          • API String ID: 2456053456-552399096
                                                                                                                                                                                                          • Opcode ID: c4c15c6a471b2c500a63e57da7f149bc84ee5df8078617c4f4a9f4cc3ab30684
                                                                                                                                                                                                          • Instruction ID: f3a4c391339cf815f6892fc758412d6cdc7d58db71e2183cc3e50c91eeab0573
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c4c15c6a471b2c500a63e57da7f149bc84ee5df8078617c4f4a9f4cc3ab30684
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 36023972A0AB92A6EB548F35E8442BD23A0FF48BD8F444536DA1D47794EF3CE645E310
                                                                                                                                                                                                          Function 00007FF8A7FE9020 Relevance: 54.5, APIs: 21, Strings: 10, Instructions: 223libraryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Unicode_$Err_$Arg_FormatParseSizeTuple_$LibraryLoad$CharClearErrorFreeFromLastLengthMem_StringWide
                                                                                                                                                                                                          • String ID: <None>$O|i:load_library$U|i:load_library$cannot call dlopen(NULL)$cannot load library '%s': %s$dlopen() takes a file name or 'void *' handle, not '%s'$dlopen(None) not supported on Windows$error 0x%x$et|i:load_library$|Oi:load_library
                                                                                                                                                                                                          • API String ID: 502613242-880521189
                                                                                                                                                                                                          • Opcode ID: 5f61a3c35ddf3417ad0959ded34a85f019f64529f12abbc31e34ac5d2516fa51
                                                                                                                                                                                                          • Instruction ID: 3c63cc402c21f6841c9b49ed3d19f28dab5b38403f70aba476e8884b16aa2953
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5f61a3c35ddf3417ad0959ded34a85f019f64529f12abbc31e34ac5d2516fa51
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 08A15A22A0AA52A9EF10CF76D8446BC33A4FF44BC5B444532D91E477A4EF7CE649E311
                                                                                                                                                                                                          Function 00007FF8A7FF7C20 Relevance: 47.5, APIs: 20, Strings: 7, Instructions: 216COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_Unicode_$ClearDict_ItemString
                                                                                                                                                                                                          • String ID: %s.lib$__all__$__class__$__dict__$__loader__$__name__$__spec__
                                                                                                                                                                                                          • API String ID: 1723949426-3301019394
                                                                                                                                                                                                          • Opcode ID: 446cd733eada2a38ca04b49a6c0640e6b9ebf6b869cd275318d076a42c48d988
                                                                                                                                                                                                          • Instruction ID: 4b8db96f03b453b02fe31bb35a0ad4f43cdbf14498c28764d51e605cc460b818
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 446cd733eada2a38ca04b49a6c0640e6b9ebf6b869cd275318d076a42c48d988
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FB717023B4B616A1EA558F35EC4017C63A0EF45BE5F884431CE0D47394EEBDE685E320
                                                                                                                                                                                                          Function 00007FF8A7FF6C10 Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 193threadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dealloc$Dict_$ItemSize$CallCapsule_Eval_Object_PackThreadTuple_$Arg_Function_Keywords_Method_ParsePointerRestoreSaveThread_acquire_lockThread_allocate_lockThread_free_lockThread_release_lockTuple
                                                                                                                                                                                                          • String ID: cffi_init_once_lock$setdefault
                                                                                                                                                                                                          • API String ID: 1006512166-1600032183
                                                                                                                                                                                                          • Opcode ID: c9f992ef7e9b3b0e609f91063d43edd59e9ce8d547b6f6717272dec2657d723a
                                                                                                                                                                                                          • Instruction ID: f7b1cfbb0ae9354524997b602bce7de9962ef25dfb1cddbe89787cce66808b8d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c9f992ef7e9b3b0e609f91063d43edd59e9ce8d547b6f6717272dec2657d723a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4A814D32A0AB12A5EB158F35EC6427C23A0EF48BD5F084039CE4D467A4DFBCE658E705
                                                                                                                                                                                                          Function 00007FF8A7FE8610 Relevance: 44.1, APIs: 18, Strings: 7, Instructions: 367COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$DeallocOccurred$FormatLongString$ComplexComplex_DoubleErrorFatalFloat_FuncInstanceLong_MaskObject_SubtypeType_Unsigned
                                                                                                                                                                                                          • String ID: an integer is required$cannot cast %.200s object to ctype '%s'$cannot cast ctype '%s' to ctype '%s'$cannot cast to ctype '%s'$integer conversion failed$write_raw_complex_data$write_raw_complex_data: bad complex size
                                                                                                                                                                                                          • API String ID: 1802667343-436044907
                                                                                                                                                                                                          • Opcode ID: 85c43f9991675b25a81feb9e4bd7e934e0bbb261e73bd2d802bf023595ce4a2f
                                                                                                                                                                                                          • Instruction ID: 63bbdb4492b4fb245004ba103b1fa00121682c9ad2c43948c86da07dec5ffe72
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 85c43f9991675b25a81feb9e4bd7e934e0bbb261e73bd2d802bf023595ce4a2f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E6F15D62F0BA46A1EE65AF35D80027D23A0FF44BD4F086532D91D466E4EF7CEA95E301
                                                                                                                                                                                                          Function 00007FF8A7FE1F10 Relevance: 43.9, APIs: 18, Strings: 7, Instructions: 199COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Slice_$AdjustBufferBuffer_CheckFormatIndex_IndicesNumber_Object_OccurredReleaseSsize_tStringUnpack
                                                                                                                                                                                                          • String ID: buffer assignment index out of range$buffer doesn't support slicing with step != 1$buffer indices must be integers, not %.200s$contiguous buffer expected$expected a pointer or array ctype, got '%s'$must assign a bytes of length 1, not %.200s$right operand length must match slice length
                                                                                                                                                                                                          • API String ID: 2091388830-3042757970
                                                                                                                                                                                                          • Opcode ID: 91d0e0add9cb049991f8c4443e78de5227e80171d3fdb8e7a0d65a9e2f0fd365
                                                                                                                                                                                                          • Instruction ID: ac63dffe56f816f399acec0e2b70e4f7aaf56544cb54a98d17203a44935df606
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 91d0e0add9cb049991f8c4443e78de5227e80171d3fdb8e7a0d65a9e2f0fd365
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 50918767B0AA52A2EA50DF35E8403BD2361FF84BE4F444131DA5D476A4EF7CE689E310
                                                                                                                                                                                                          Function 00007FF8A7FF9260 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 153threadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • extern "Python": function %s() called, but %s. Returning 0., xrefs: 00007FF8A7FF9417
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Value$State_$ErrorLast_errnomalloc$ClearDeallocDictDict_Err_FromInterpreterItemLong_ReleaseThreadVoid__acrt_iob_funcfprintfmemset
                                                                                                                                                                                                          • String ID: extern "Python": function %s() called, but %s. Returning 0.
                                                                                                                                                                                                          • API String ID: 1189152460-1240277920
                                                                                                                                                                                                          • Opcode ID: a9c47355c123ec80a5dc8c737ca8918648251e833020a7eb4a89df78e40b714d
                                                                                                                                                                                                          • Instruction ID: 0027f36b79d6cc1482b92de28c713f7e19b87bcbdb67c9ac69ca85e472fb1cd4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a9c47355c123ec80a5dc8c737ca8918648251e833020a7eb4a89df78e40b714d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 75611B32A0AB46A2EB149F71A85423D63A5FF48BD1F044435DA4F87794EFBCE654E300
                                                                                                                                                                                                          Function 00007FF8A7FE4510 Relevance: 42.4, APIs: 14, Strings: 10, Instructions: 362COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • pointer to same type, xrefs: 00007FF8A7FE46BC
                                                                                                                                                                                                          • implicit cast to 'char *' from a different pointer type: will be forbidden in the future (check that the types are as you expect; use an explicit ffi.cast() if they are correct), xrefs: 00007FF8A7FE461F
                                                                                                                                                                                                          • pointer or array, xrefs: 00007FF8A7FE46A5
                                                                                                                                                                                                          • implicit cast from 'char *' to a different pointer type: will be forbidden in the future (check that the types are as you expect; use an explicit ffi.cast() if they are correct), xrefs: 00007FF8A7FE4626
                                                                                                                                                                                                          • write_raw_integer_data: bad integer size, xrefs: 00007FF8A7FE47D7
                                                                                                                                                                                                          • write_raw_complex_data: bad complex size, xrefs: 00007FF8A7FE4A05
                                                                                                                                                                                                          • cdata pointer, xrefs: 00007FF8A7FE468E
                                                                                                                                                                                                          • convert_from_object: '%s', xrefs: 00007FF8A7FE4A25
                                                                                                                                                                                                          • write_raw_complex_data, xrefs: 00007FF8A7FE4A0C
                                                                                                                                                                                                          • write_raw_integer_data, xrefs: 00007FF8A7FE47DE
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_Warn
                                                                                                                                                                                                          • String ID: cdata pointer$convert_from_object: '%s'$implicit cast from 'char *' to a different pointer type: will be forbidden in the future (check that the types are as you expect; use an explicit ffi.cast() if they are correct)$implicit cast to 'char *' from a different pointer type: will be forbidden in the future (check that the types are as you expect; use an explicit ffi.cast() if they are correct)$pointer or array$pointer to same type$write_raw_complex_data$write_raw_complex_data: bad complex size$write_raw_integer_data$write_raw_integer_data: bad integer size
                                                                                                                                                                                                          • API String ID: 734914325-3043910273
                                                                                                                                                                                                          • Opcode ID: afafe24922391c459654689ce4c6693d3d2dd3445accf8ef715d7716a803c564
                                                                                                                                                                                                          • Instruction ID: 9d21844ea55ed034b53b402697d62a2ccb399c02f06b876e717e4ff034c34847
                                                                                                                                                                                                          • Opcode Fuzzy Hash: afafe24922391c459654689ce4c6693d3d2dd3445accf8ef715d7716a803c564
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 31E17A22E1BA42AAFA609F35980417D23A0FF55BD4F444539EA4E426D0FF7CFA55E204
                                                                                                                                                                                                          Function 00007FF8A7FF4F70 Relevance: 42.3, APIs: 14, Strings: 10, Instructions: 270stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dealloc$strncmp$BuildErr_FormatSizeValue_$ErrorFatalFuncList_
                                                                                                                                                                                                          • String ID: %s: %s%s%s (cdef says %zd, but C compiler says %zd). fix it or use "...;" as the last field in the cdef for %s to make it flexible$(OOOnii)$(sOin)$do_realize_lazy_struct$enum $field op=%d$lost a struct/union!$struct $union $wrong size for field '
                                                                                                                                                                                                          • API String ID: 1048173794-2709940433
                                                                                                                                                                                                          • Opcode ID: 5c095b41d4125f10d06d91481f975096bd344b5c3e4f95dc5998aef9e561da3a
                                                                                                                                                                                                          • Instruction ID: cae059eb559bf01c7ce860b12aa02948a1c7db70b8a6285147eefcb778610d44
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5c095b41d4125f10d06d91481f975096bd344b5c3e4f95dc5998aef9e561da3a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C1C17C72A0AA82A6EB108F25E9442BD37A1FB45BE4F444231DA6E477D4DFBCE255D300
                                                                                                                                                                                                          Function 00007FF8A7FE2270 Relevance: 40.4, APIs: 19, Strings: 4, Instructions: 110COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Object_$Dealloc$AttrString$Capsule_Err_$CallClearDescriptorErrnoFileFromMethod_PointerSizeUnicode__close_dup_fdopenfclosesetbuf
                                                                                                                                                                                                          • String ID: FILE$__cffi_FILE$flush$mode
                                                                                                                                                                                                          • API String ID: 893206650-3531628309
                                                                                                                                                                                                          • Opcode ID: 7a3013526266b7a646f70fbca41e08bf56b549bc88c4124df7b937eee1ac7037
                                                                                                                                                                                                          • Instruction ID: 86753400d05a6aba6d434f6f6d21fb0b42c3f3b05556d7c5bfbd082d64a594b5
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7a3013526266b7a646f70fbca41e08bf56b549bc88c4124df7b937eee1ac7037
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 80411836A0BE23A6FA059F36A81427C23A1EF49BD5F444030C90E46764FEBCE649F704
                                                                                                                                                                                                          Function 00007FF8A7FEC2C0 Relevance: 36.9, APIs: 17, Strings: 4, Instructions: 188COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_String$Arg_ParseSizeTuple_
                                                                                                                                                                                                          • String ID: enumerators must be a list of strings$expected a primitive signed or unsigned base type$sO!O!O!:new_enum_type$tuple args must have the same size
                                                                                                                                                                                                          • API String ID: 3337331331-3833221460
                                                                                                                                                                                                          • Opcode ID: 1ce72b17df9774109b977ac5b818a0364eef8d6e6245cc2d1a3e95691f75b309
                                                                                                                                                                                                          • Instruction ID: 830229246e63624e5088d6f45eb498460018375a101c5a01ec285f107cc17501
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1ce72b17df9774109b977ac5b818a0364eef8d6e6245cc2d1a3e95691f75b309
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 57912673A0AB52A5EA148F36D8442BD33A1FB84BD4F484035DA1D477A4EF7DE649E700
                                                                                                                                                                                                          Function 00007FF8A7FE1300 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 118threadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: State_Thread$StateThisValue$ClearDeallocDeleteDictDict_EnsureErrorEval_FatalFuncItemObject_RestoreStringThread_acquire_lockThread_release_lockUncheckedmalloc
                                                                                                                                                                                                          • String ID: cffi.thread.canary$cffi: invalid ThreadCanaryObj->tstate$thread_canary_free_zombies
                                                                                                                                                                                                          • API String ID: 1895661259-237290086
                                                                                                                                                                                                          • Opcode ID: a9c94bad9972d146f96a275a8134f4a7c1f527d065d1243276536a5c43e158b3
                                                                                                                                                                                                          • Instruction ID: 6184681d7fbf0231acac17c119b831332582c440eeff2c33cc872296c05ad909
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a9c94bad9972d146f96a275a8134f4a7c1f527d065d1243276536a5c43e158b3
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FE513872A0AB52A2EB149F21E85413C73A4FF88BD1F190534CA4D077A4EF7CE699E314
                                                                                                                                                                                                          Function 00007FF8A7FE4A70 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 185COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Long$Err_Long_Occurred
                                                                                                                                                                                                          • String ID: read_raw_unsigned_data$read_raw_unsigned_data: bad integer size$value %s outside the range allowed by the bit field width: %s <= x <= %s
                                                                                                                                                                                                          • API String ID: 391545614-647553974
                                                                                                                                                                                                          • Opcode ID: 12303eca1c576e1e3ec0f7bea286f7c74104514808cf3ac8cb2be38ebbcdd59d
                                                                                                                                                                                                          • Instruction ID: f7d8e76d195ed05d0b6312a734f469a038956286f6466032409204c1460cc051
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 12303eca1c576e1e3ec0f7bea286f7c74104514808cf3ac8cb2be38ebbcdd59d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2F617422B0B622AAEA14DF35A85427D2390FF45BE4F094539DE1E47794EF7CE295E300
                                                                                                                                                                                                          Function 00007FF8A7FEDC70 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 155COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Buffer_$Err_Release$String$BufferContiguousFormatObject_$Arg_Keywords_ParseSizeTuplememcpy
                                                                                                                                                                                                          • String ID: OOn$contiguous buffer expected$expected a pointer or array ctype, got '%s'$negative size
                                                                                                                                                                                                          • API String ID: 3181281413-4176687996
                                                                                                                                                                                                          • Opcode ID: 5e8d3a7e044e7f15dddcf988e108217123b986eefc78d5c51fcb7b081c946e92
                                                                                                                                                                                                          • Instruction ID: 5f7aea0e011e5157d604147337053c2c45b4be8ffafcacd9b85adb3ff6e131ac
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5e8d3a7e044e7f15dddcf988e108217123b986eefc78d5c51fcb7b081c946e92
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 60710E22A0FA46A1EA609F35E8543BD7360FB84FD4F544032C94D47AA4DFBDEA49E701
                                                                                                                                                                                                          Function 00007FF8A7FF61E0 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 247COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: SizeStringTuple_$Arg_DeallocDict_Err_FromItemParseUnicode_
                                                                                                                                                                                                          • String ID: O!s$addressof() expects at least 1 argument$cannot take the address of the constant '%.200s'$expected a cdata struct/union/array object$expected a cdata struct/union/array/pointer object
                                                                                                                                                                                                          • API String ID: 3853558574-3015567189
                                                                                                                                                                                                          • Opcode ID: 4f1f9d8f8d3ef48fb30b7b1165c1df5992e332cca099e2fc900ce8a4c44bdcca
                                                                                                                                                                                                          • Instruction ID: dc1a111e36a988c1b3386f75f0a0945430e774278bf362fe5606d3c91f1da9f2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4f1f9d8f8d3ef48fb30b7b1165c1df5992e332cca099e2fc900ce8a4c44bdcca
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F3A14C22B0BA02A6EE159F25E95017D63A0FF84BD4F480435DE4D477A4EFBCE695E310
                                                                                                                                                                                                          Function 00007FF8A7FEA910 Relevance: 31.7, APIs: 6, Strings: 12, Instructions: 221COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • It is a struct with bit fields, which libffi does not support, xrefs: 00007FF8A7FEAAA5
                                                                                                                                                                                                          • ctype '%s' has size 0, xrefs: 00007FF8A7FEA999
                                                                                                                                                                                                          • (the support for complex types inside libffi is mostly missing at this point, so CFFI only supports complex types as arguments or return value in API-mode functions), xrefs: 00007FF8A7FEABFA
                                                                                                                                                                                                          • It is a struct declared with "...;", but the C calling convention may depend on the missing fields; or, it contains anonymous struct/unions, xrefs: 00007FF8A7FEA9FC
                                                                                                                                                                                                          • argument, xrefs: 00007FF8A7FEA927
                                                                                                                                                                                                          • It is a 'packed' structure, with a different layout than expected by libffi, xrefs: 00007FF8A7FEAA0E
                                                                                                                                                                                                          • ctype '%s' has incomplete type, xrefs: 00007FF8A7FEA992
                                                                                                                                                                                                          • ctype '%s' not supported as %s. %s. Such structs are only supported as %s if the function is 'API mode' and non-variadic (i.e. declared inside ffibuilder.cdef()+ffibuilder.set_source() and not taking a final '...' argument), xrefs: 00007FF8A7FEAABC
                                                                                                                                                                                                          • ctype '%s' not supported as %s by libffi. Unions are only supported as %s if the function is 'API mode' and non-variadic (i.e. declared inside ffibuilder.cdef()+ffibuilder.set_source() and not taking a final '...' argument), xrefs: 00007FF8A7FEABCC
                                                                                                                                                                                                          • ctype '%s' (size %zd) not supported as %s%s, xrefs: 00007FF8A7FEAC05
                                                                                                                                                                                                          • It is a struct with a zero-length array, which libffi does not support, xrefs: 00007FF8A7FEAA9C
                                                                                                                                                                                                          • return value, xrefs: 00007FF8A7FEA920
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: (the support for complex types inside libffi is mostly missing at this point, so CFFI only supports complex types as arguments or return value in API-mode functions)$It is a 'packed' structure, with a different layout than expected by libffi$It is a struct declared with "...;", but the C calling convention may depend on the missing fields; or, it contains anonymous struct/unions$It is a struct with a zero-length array, which libffi does not support$It is a struct with bit fields, which libffi does not support$argument$ctype '%s' (size %zd) not supported as %s%s$ctype '%s' has incomplete type$ctype '%s' has size 0$ctype '%s' not supported as %s by libffi. Unions are only supported as %s if the function is 'API mode' and non-variadic (i.e. declared inside ffibuilder.cdef()+ffibuilder.set_source() and not taking a final '...' argument)$ctype '%s' not supported as %s. %s. Such structs are only supported as %s if the function is 'API mode' and non-variadic (i.e. declared inside ffibuilder.cdef()+ffibuilder.set_source() and not taking a final '...' argument)$return value
                                                                                                                                                                                                          • API String ID: 0-3203576518
                                                                                                                                                                                                          • Opcode ID: 91a60309c1201fcbff79e3b7a875e322f5ef19b41dd8c5b9171f57c97773f230
                                                                                                                                                                                                          • Instruction ID: 95a381f225d12c628dbdb9d0da44e8ac85deb9c8c63aa5a7d43093db75851493
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 91a60309c1201fcbff79e3b7a875e322f5ef19b41dd8c5b9171f57c97773f230
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7B918F22A0AB52E5EB148F29E94067E23A4FB44BD8F454032DE4D937A4EF7CD695E304
                                                                                                                                                                                                          Function 00007FF8A7FF8FF0 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 161COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dealloc$Err_$Arg_AttrDict_FormatFromItemLong_MemoryObject_ParseSizeStringTuple_Unicode_Void
                                                                                                                                                                                                          • String ID: OzOO$__name__$ffi.def_extern('%s'): no 'extern "Python"' function with this name
                                                                                                                                                                                                          • API String ID: 75418018-1717190264
                                                                                                                                                                                                          • Opcode ID: 009146542484bd9d585af5ddf01ac4b518f2af8cd7092de8f00e9a9bf2967272
                                                                                                                                                                                                          • Instruction ID: 96d810f7530acb5231bfe87c4a59c471abe460582ee5cd2825b0a74378fb56b6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 009146542484bd9d585af5ddf01ac4b518f2af8cd7092de8f00e9a9bf2967272
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 12613B32A0AB42A6EB559F75A8442BD33A0FF45BE5F054131CA0E87795DFBCE654E300
                                                                                                                                                                                                          Function 00007FF8A7FECB70 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 254COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Size$Bytes_DeallocFromString$Arg_Dict_Err_FormatItemKeywords_Object_ParseTupleUnicode_
                                                                                                                                                                                                          • String ID: O!|n:string$cannot use string() on %s$string(): unexpected cdata '%s' argument
                                                                                                                                                                                                          • API String ID: 13065410-52486950
                                                                                                                                                                                                          • Opcode ID: 2d4cbdc47e6f18dc9e6c1e0fe851ba1c9a15ca21d2103c4b73810f2b925c330a
                                                                                                                                                                                                          • Instruction ID: 7a78cd80b9a52a36f4476eba7048b16bca99b149e7c47f60fc34757b13ff6e5a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2d4cbdc47e6f18dc9e6c1e0fe851ba1c9a15ca21d2103c4b73810f2b925c330a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 73A19E33B0AB4291EB158F2AE54417D63A1EB84FD4F080131EE5D477A9EE6DE681E701
                                                                                                                                                                                                          Function 00007FF8A7FECF00 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 206COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$FormatFromSizeString$Arg_Bytes_DataDeallocKeywords_KindList_ParseTupleUnicode_
                                                                                                                                                                                                          • String ID: '%s' points to items of unknown size$'length' cannot be negative$O!n:unpack$cannot use unpack() on %s$expected a pointer or array, got '%s'
                                                                                                                                                                                                          • API String ID: 3473059216-2661630795
                                                                                                                                                                                                          • Opcode ID: 34e12fcbb80e5726260c73e6d2e536cbe86aba34bc5018269a53c7c1017e2df3
                                                                                                                                                                                                          • Instruction ID: b4e87a4f19cb448f2ba5672cf6f0d9d3ea9fa54375790912df1a3b28abb5e026
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 34e12fcbb80e5726260c73e6d2e536cbe86aba34bc5018269a53c7c1017e2df3
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3C913E62A0B606A1FA658F35D85427D23A1FF44FE8F180436DE4E47B98EE7DE645E300
                                                                                                                                                                                                          Function 00007FF8A7FF4580 Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 196stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$FormatObject_$DeallocOccurredTrackstrcmp
                                                                                                                                                                                                          • String ID: '%s %.200s' is opaque in the ffi.include(), but no longer in the ffi doing the include (workaround: don't use ffi.include() but duplicate the declarations of everything using %s %.200s)$'%s %.200s' should come from ffi.include() but was not found$FILE$struct$struct $struct _IO_FILE$union$union
                                                                                                                                                                                                          • API String ID: 1251701841-281863512
                                                                                                                                                                                                          • Opcode ID: 8e036e2844b051469bcf4b31112dec2c57e13b12b28c27cd0149affa9344cf3d
                                                                                                                                                                                                          • Instruction ID: db7f46749ea5b180e6c56d57c88345234d330e55e0650489034c0e2a35abb639
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8e036e2844b051469bcf4b31112dec2c57e13b12b28c27cd0149affa9344cf3d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C8913872A06B52A6EB108F35E8402BC73A0FB48BE4B458236DA2D477E4DF7CE654D300
                                                                                                                                                                                                          Function 00007FF8A7FE63A0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 188COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$DeallocFormatOccurred$memcpy$IterLong_Object_Ssize_tStringSubtypeType_
                                                                                                                                                                                                          • String ID: got more than %zd values to unpack$need %zd values to unpack, got %zd$need a string of length %zd, got %zd
                                                                                                                                                                                                          • API String ID: 3367705057-281290674
                                                                                                                                                                                                          • Opcode ID: ffccfdf67bb5514a2294067a38fbccc47c9777278039499112768b8df474f7c3
                                                                                                                                                                                                          • Instruction ID: c6e1195210593b1492c780ad5bdff8aa45a90082ef344196f02a66bf62a9e7f3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ffccfdf67bb5514a2294067a38fbccc47c9777278039499112768b8df474f7c3
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FF713D32B0AA56A5EE558F36E85027D23A0FB84BD4F480436DE0D477A4EF7CE685E300
                                                                                                                                                                                                          Function 00007FF8A7FE6B10 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 158COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AttrGenericObject_
                                                                                                                                                                                                          • String ID: cdata '%s' has no attribute '%s'$cdata '%s' has no field '%s'$cdata '%s' points to an opaque type: cannot read fields$read_raw_signed_data$read_raw_signed_data: bad integer size$read_raw_unsigned_data$read_raw_unsigned_data: bad integer size
                                                                                                                                                                                                          • API String ID: 3652601395-836776902
                                                                                                                                                                                                          • Opcode ID: fec4d6c021aa731c563873d6b774b880bb1207181053925ea72ca0eef88c19d5
                                                                                                                                                                                                          • Instruction ID: 7d8d41acb5e75b0852cf1bd05aeb8437ec6082fa0444b86c8019c9637f55f288
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fec4d6c021aa731c563873d6b774b880bb1207181053925ea72ca0eef88c19d5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7D51A372E0E65AA2EA288F39986417C2761EF55BD4F540036DA4E077D5EF6CEB41F300
                                                                                                                                                                                                          Function 00007FF8A7FEDA50 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 108COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • expected a pointer or array ctype, got '%s', xrefs: 00007FF8A7FEDA81
                                                                                                                                                                                                          • from_buffer('%s', ..): the actual length of the array cannot be computed, xrefs: 00007FF8A7FEDBBC
                                                                                                                                                                                                          • from_buffer() cannot return the address of a unicode object, xrefs: 00007FF8A7FEDAAF
                                                                                                                                                                                                          • buffer is too small (%zd bytes) for '%s' (%zd bytes), xrefs: 00007FF8A7FEDB53
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$FormatString
                                                                                                                                                                                                          • String ID: buffer is too small (%zd bytes) for '%s' (%zd bytes)$expected a pointer or array ctype, got '%s'$from_buffer('%s', ..): the actual length of the array cannot be computed$from_buffer() cannot return the address of a unicode object
                                                                                                                                                                                                          • API String ID: 4212644371-2010142110
                                                                                                                                                                                                          • Opcode ID: abe6d8a0bf70cae37633da0e0651984bc6223ba66e25b4b8c26269f830bf5e4c
                                                                                                                                                                                                          • Instruction ID: 60b4a50d60affb93cbda2abb91d22ca543024a880f74498a44b7f1392e27cfef
                                                                                                                                                                                                          • Opcode Fuzzy Hash: abe6d8a0bf70cae37633da0e0651984bc6223ba66e25b4b8c26269f830bf5e4c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4F510E26A0AA52A6EB14DF39E85027D63A1FB48FC4F440031DE4E47BA4EF7DE655E340
                                                                                                                                                                                                          Function 00007FF8A7FE61B0 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 94COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$FormatLong_OccurredSsize_t$String
                                                                                                                                                                                                          • String ID: cdata of type '%s' cannot be indexed$index too large (expected %zd <= %zd)$negative index$slice start > stop$slice start must be specified$slice stop must be specified$slice with step not supported
                                                                                                                                                                                                          • API String ID: 564475518-3973974439
                                                                                                                                                                                                          • Opcode ID: fc2cef9232994741ca4fe200dcfea594a668e3ee079a1f2ac3a9d476730cffc8
                                                                                                                                                                                                          • Instruction ID: 2cd353a9f7be7924e9dde2ea990ec852ac10fd22ad2943eacc449a45a6aba3e3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fc2cef9232994741ca4fe200dcfea594a668e3ee079a1f2ac3a9d476730cffc8
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 19412B32A0BA1AA1EE108F75E86017C2360FF88BD4F444535DA6D477A4EFBCE655E301
                                                                                                                                                                                                          Function 00007FF8A7FE25A0 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 61COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • __builtins__, xrefs: 00007FF8A7FE260A
                                                                                                                                                                                                          • import sysclass FileLike: def write(self, x): try: of.write(x) except: pass self.buf += x def flush(self): passfl = FileLike()fl.buf = ''of = sys.stderrsys.stderr = fldef done(): sys.stderr = of return fl.buf, xrefs: 00007FF8A7FE263D
                                                                                                                                                                                                          • _cffi_error_capture, xrefs: 00007FF8A7FE25C2
                                                                                                                                                                                                          • builtins, xrefs: 00007FF8A7FE25ED
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$DeallocImport_ModuleString$ClearDictDict_FlagsImportItemModule_OccurredRun_UnraisableWrite
                                                                                                                                                                                                          • String ID: __builtins__$_cffi_error_capture$builtins$import sysclass FileLike: def write(self, x): try: of.write(x) except: pass self.buf += x def flush(self): passfl = FileLike()fl.buf = ''of = sys.stderrsys.stderr = fldef done(): sys.stderr = of return fl.buf
                                                                                                                                                                                                          • API String ID: 2387839683-950058525
                                                                                                                                                                                                          • Opcode ID: 19fe21f271e7442d25d3103835c50ccb39658e7b69a728fbdb021a384b3e77a4
                                                                                                                                                                                                          • Instruction ID: f64fec574d380cfdbc7b35c6d4b977f4c607024ff06ef88309e784ae6c0b7762
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 19fe21f271e7442d25d3103835c50ccb39658e7b69a728fbdb021a384b3e77a4
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 86210926A0BB12A1FA559F35ED1427C23A0EF85BD0F480535C90E467A0FFBCE688E704
                                                                                                                                                                                                          Function 00007FF8A7FF5910 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 188COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dict_Err_FormatItem$DeallocUnicode_
                                                                                                                                                                                                          • String ID: or $cdata object$ctype object$expected a %s%s%s%s%s, got '%.200s'$string$the type '%s%s' is a function type, not a pointer-to-function type$unexpected symbol
                                                                                                                                                                                                          • API String ID: 3047486896-3137146848
                                                                                                                                                                                                          • Opcode ID: e48489101ec95c841d86b78e47a6197ee3134ba41591d101bfc84f079dba80d9
                                                                                                                                                                                                          • Instruction ID: a63538beb6341fdd6ab2376fed7e2f656aa816b2449d0a255b9a31053bd9af4c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e48489101ec95c841d86b78e47a6197ee3134ba41591d101bfc84f079dba80d9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3F81BF62B0BB42A1EB508F28E5903BD67A1FB85BD4F484031DA4D47794DFBCEA99D300
                                                                                                                                                                                                          Function 00007FF8A7FF7660 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 146COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • PyUnicode_AsUTF8.PYTHON312(?,?,00000000,?,?,00007FF8A7FF82C3), ref: 00007FF8A7FF7689
                                                                                                                                                                                                          • PyErr_SetString.PYTHON312(?,?,00000000,?,?,00007FF8A7FF82C3), ref: 00007FF8A7FF76FE
                                                                                                                                                                                                          • PyDict_GetItem.PYTHON312(?,?,00000000,?,?,00007FF8A7FF82C3), ref: 00007FF8A7FF772F
                                                                                                                                                                                                          • PyTuple_GetItem.PYTHON312(?,?,00000000,?,?,00007FF8A7FF82C3), ref: 00007FF8A7FF776F
                                                                                                                                                                                                          • PyErr_Occurred.PYTHON312(?,?,00000000,?,?,00007FF8A7FF82C3), ref: 00007FF8A7FF779A
                                                                                                                                                                                                          • PyUnicode_AsUTF8.PYTHON312(?,?,00000000,?,?,00007FF8A7FF82C3), ref: 00007FF8A7FF77D2
                                                                                                                                                                                                          • PyErr_Format.PYTHON312(?,?,00000000,?,?,00007FF8A7FF82C3), ref: 00007FF8A7FF77EF
                                                                                                                                                                                                          • PyDict_SetItem.PYTHON312(?,?,00000000,?,?,00007FF8A7FF82C3), ref: 00007FF8A7FF7AA3
                                                                                                                                                                                                          • _Py_Dealloc.PYTHON312(?,?,00000000,?,?,00007FF8A7FF82C3), ref: 00007FF8A7FF7AB9
                                                                                                                                                                                                          • PyErr_Format.PYTHON312(?,?,00000000,?,?,00007FF8A7FF82C3), ref: 00007FF8A7FF7AD9
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Item$Dict_FormatUnicode_$DeallocOccurredStringTuple_
                                                                                                                                                                                                          • String ID: cffi library '%.200s' has no function, constant or global variable named '%.200s'$in lib_build_attr: op=%d$recursion overflow in ffi.include() delegations
                                                                                                                                                                                                          • API String ID: 3583525245-1263113588
                                                                                                                                                                                                          • Opcode ID: 3632fe1a96f4866765e8c4c9aa862c6ac1012ff48af7dff7a1c568364126c7fa
                                                                                                                                                                                                          • Instruction ID: c04e4d7c624c8b8fda84c278d0539d5402ea04e119435b5f377e5ef14a0ed489
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3632fe1a96f4866765e8c4c9aa862c6ac1012ff48af7dff7a1c568364126c7fa
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 77518E22A1B652A2EA058F36E80457DA3A1FF88BD4F854031CE1D477A0EFBDE605E710
                                                                                                                                                                                                          Function 00007FF646AB1600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                          • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                          • API String ID: 2050909247-1550345328
                                                                                                                                                                                                          • Opcode ID: 0a87ee3060ec78e21d6c2d3bfc048a27d307e8fd5641d8a78f43b3b0b6daa239
                                                                                                                                                                                                          • Instruction ID: 7cea0f6b518ac829e0a57dd3ded8ca75e6943cbfbf62f1eea1e4938712e7af52
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0a87ee3060ec78e21d6c2d3bfc048a27d307e8fd5641d8a78f43b3b0b6daa239
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4851CE61B0CE4B92EA10BB6194001B9E361BF44B94F404532EE0D8779ADF3EE9D9C760
                                                                                                                                                                                                          Function 00007FF8A7FE99F0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$FormatString
                                                                                                                                                                                                          • String ID: $[%llu]$array item of unknown size: '%s'$array size would overflow a Py_ssize_t$first arg must be a pointer ctype
                                                                                                                                                                                                          • API String ID: 4212644371-3798105388
                                                                                                                                                                                                          • Opcode ID: 0f7ff40b9492430f6444851611742362be4f60dd5914046253e5e3483d8bcc28
                                                                                                                                                                                                          • Instruction ID: 2ad92f44b52539645a64d388f68417dd2d67f5422ec958eede84e7e4283bd0ef
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0f7ff40b9492430f6444851611742362be4f60dd5914046253e5e3483d8bcc28
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9B517E3261AB82A6EB10CF39E88426D73A4FB48BD8F454135DA8D47B64EF7CE245D700
                                                                                                                                                                                                          Function 00007FF8A7FF9720 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 121COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dealloc$AttrObject_StringTuple_$Err_FormatImportImport_ModuleSubtypeType_
                                                                                                                                                                                                          • String ID: ffi$lib$while loading %.200s: failed to import ffi, lib from %.200s
                                                                                                                                                                                                          • API String ID: 1456096276-3368324463
                                                                                                                                                                                                          • Opcode ID: 26fbf7435834fbb81c118951177d6ed4611873be6c422189694af47c10966b7c
                                                                                                                                                                                                          • Instruction ID: 9ac0fdd4bcc4333f21916c44b6f42eedad4522fe5e71331244aa16b0dc127eb5
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 26fbf7435834fbb81c118951177d6ed4611873be6c422189694af47c10966b7c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A7510872A0AB02A5EB55CF62E85437863A0FF48BD5F488035CE5E82794EFBCE645D300
                                                                                                                                                                                                          Function 00007FF8A7FE1690 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 100COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Arg_Err_Keywords_MemoryParseSizeTupleValuemalloc
                                                                                                                                                                                                          • String ID: (iO)$Windows Error 0x%X
                                                                                                                                                                                                          • API String ID: 4153797932-3802556843
                                                                                                                                                                                                          • Opcode ID: aa6f1365919562944e64679afd59fa5a4f403ab1571dade86c67187814c02b34
                                                                                                                                                                                                          • Instruction ID: 8c0562326a464a9edd1052ba65ab89902be6d395e75b4359ead8bc0104fd7fc1
                                                                                                                                                                                                          • Opcode Fuzzy Hash: aa6f1365919562944e64679afd59fa5a4f403ab1571dade86c67187814c02b34
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FB415136A1AB5292EB108F36E81067D63E1FF84BD0F540231DA5D46BA4EF7CEA45DB00
                                                                                                                                                                                                          Function 00007FF8A7FEC7A0 Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 94COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Occurred$Dict_ItemLong_ObjectSsize_tString
                                                                                                                                                                                                          • String ID: 0$array offset would overflow a Py_ssize_t$field name or array index expected$not supported for bitfields$struct/union is opaque$with a field name argument, expected a struct or union ctype$with an integer argument, expected an array ctype or a pointer to non-opaque
                                                                                                                                                                                                          • API String ID: 1199264806-2423494606
                                                                                                                                                                                                          • Opcode ID: 15764696cd55fac5522d1ec8942211e7eebdc4d2e047d10dc843e0d7c4ae04c7
                                                                                                                                                                                                          • Instruction ID: 278d44844693bd8d44e2ef774c1ffee8bd1bd95b9d1b279cfed8abf994f7a65f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 15764696cd55fac5522d1ec8942211e7eebdc4d2e047d10dc843e0d7c4ae04c7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D4413D63A1AB46A1EA548F36E94023C67A0FF48BC4F445131EE4D477A4EF7CE685E300
                                                                                                                                                                                                          Function 00007FF8A7FE59F0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 125COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: LongLong_
                                                                                                                                                                                                          • String ID: int() not supported on cdata '%s'$read_raw_float_data$read_raw_float_data: bad float size$read_raw_signed_data$read_raw_signed_data: bad integer size
                                                                                                                                                                                                          • API String ID: 1954241474-3524632987
                                                                                                                                                                                                          • Opcode ID: d62b5bc8ff23949be585d8430b8588d3943835305f9611146c7a104307dac948
                                                                                                                                                                                                          • Instruction ID: 6d502940e01d648366636758cd14ce31a34b5e3833f023ef89281828bbe8fee3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d62b5bc8ff23949be585d8430b8588d3943835305f9611146c7a104307dac948
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2E513136E0AA42E2EA548F39D89113C63A2FF89BD4F544031C64E477A5EF7DE685E700
                                                                                                                                                                                                          Function 00007FF8A7FE7B70 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 111COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DeallocErr_Object_$CallFormatFunction_InitSizeStringcallocmallocmemset
                                                                                                                                                                                                          • String ID: alloc() must return a cdata object (got %.200s)$alloc() must return a cdata pointer, not '%s'$alloc() returned NULL
                                                                                                                                                                                                          • API String ID: 4240332552-2229446564
                                                                                                                                                                                                          • Opcode ID: e8505e40d4f95405b2923bb402cdf3d18fb0de832882a66e2166830acccdea2c
                                                                                                                                                                                                          • Instruction ID: c34caf714145f3f0c3ff40a74c784d11afd0e478e5192e0d4f0c1f60de4f5bc5
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e8505e40d4f95405b2923bb402cdf3d18fb0de832882a66e2166830acccdea2c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D1514262A0BB42A5EA148F79E84437C23A5FF44BD4F444431DA0D077A4EF7CE699E351
                                                                                                                                                                                                          Function 00007FF8A7FF53C0 Relevance: 21.1, APIs: 14, Instructions: 107COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dealloc$FreeMem_$Object_Track
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1636395627-0
                                                                                                                                                                                                          • Opcode ID: ce48e4e672e2c6818d4a73e97968dd169680a4fd601cbed6aaf2176881b5350f
                                                                                                                                                                                                          • Instruction ID: 78622ca7c454fdbfa01a6a6642c79e516c1ffb73a43e027c4db34f6fbb59fa8b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ce48e4e672e2c6818d4a73e97968dd169680a4fd601cbed6aaf2176881b5350f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 51513936A0BA12A5EF699F759A1433C23A0EF45FE9F184031CA4D43654CFBDE649E700
                                                                                                                                                                                                          Function 00007FF8A7FE1D68 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 104COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_Slice_String$AdjustBytes_CheckFromIndex_IndicesNumber_OccurredSizeSsize_tUnpack
                                                                                                                                                                                                          • String ID: buffer doesn't support slicing with step != 1$buffer index out of range$buffer indices must be integers, not %.200s
                                                                                                                                                                                                          • API String ID: 3001075121-863229255
                                                                                                                                                                                                          • Opcode ID: c3bbac0e351e823eb68676c4cd5ce7afb934f6ef43e78c458449ebea6c2e5c67
                                                                                                                                                                                                          • Instruction ID: 48a6ba7ee09dee98b0416ceaf7d7c5fbe78264b95d1bf3752d43c8aab6dfe22a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c3bbac0e351e823eb68676c4cd5ce7afb934f6ef43e78c458449ebea6c2e5c67
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0A417467B0AA92A2EF118F36E8501BD6770FF88BD4B444132DA4D43664EF6CE698D700
                                                                                                                                                                                                          Function 00007FF8A7FEBD60 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 102COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Callable_CheckDeallocSize$BuildBytes_Err_FormatFromStringValue_memset
                                                                                                                                                                                                          • String ID: OOOO$expected a callable object for 'onerror', not %.200s$expected a callable object, not %.200s$expected a function ctype, got '%s'
                                                                                                                                                                                                          • API String ID: 2491357067-2441438866
                                                                                                                                                                                                          • Opcode ID: 4020317c1fca9fb9c650a107a7e6a97b17715a6bbdeb8766cf46be8e5f530d4b
                                                                                                                                                                                                          • Instruction ID: 373f4ad441e82db77977fb677902df3af99803eee53fbef98e158751f30cf0c3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4020317c1fca9fb9c650a107a7e6a97b17715a6bbdeb8766cf46be8e5f530d4b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 45415B22A0AA56A2EA108F36E8405BD77A1FF49BD4F444031DE4D87764EF7CE649E701
                                                                                                                                                                                                          Function 00007FF8A7FE5430 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 95COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Unicode_$From$Format$DeallocString
                                                                                                                                                                                                          • String ID: %LE$<cdata '%s%s' %s>$NULL$sliced length %zd
                                                                                                                                                                                                          • API String ID: 1355997861-971221297
                                                                                                                                                                                                          • Opcode ID: 4ad9b0ebd051aa1761897eaea9f30dd362766fc5f2269501a42982830dc0511c
                                                                                                                                                                                                          • Instruction ID: 1d9615168356fdf4ffe4b9c2190bd832ff29ce4cfe28a73c7d5f48244682fefa
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4ad9b0ebd051aa1761897eaea9f30dd362766fc5f2269501a42982830dc0511c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0C411C22A0FA42E1EA609F75EC5437D63A2FF94BD4F544032DA0E476A5EF6CE605E300
                                                                                                                                                                                                          Function 00007FF8A7FE4E60 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 77COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DeallocObject_$ClearRefsTrackWeak$Buffer_ErrorFatalFuncRelease
                                                                                                                                                                                                          • String ID: cdata CDataOwningGC_Type with unexpected type flags$cdataowninggc_dealloc
                                                                                                                                                                                                          • API String ID: 2255642161-3398618105
                                                                                                                                                                                                          • Opcode ID: 5edf71624d3ebf7757d260e393094d1c65f1b48ce567a2b0a6a8ba6cb1f6c516
                                                                                                                                                                                                          • Instruction ID: 7a1009653e7a3571d69f23f9f9741369902b85752ae19d136da3dbc17cd95e79
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5edf71624d3ebf7757d260e393094d1c65f1b48ce567a2b0a6a8ba6cb1f6c516
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9331173690AA42A6EB188F75E85423C33B0FB48FD8F141039DA1E476A4DF7CE695E300
                                                                                                                                                                                                          Function 00007FF8A7FF4A05 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 187COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dealloc$SizeTuple_$BuildErr_FromOccurredStringUnicode_Value_
                                                                                                                                                                                                          • String ID: (sOOO)$enum
                                                                                                                                                                                                          • API String ID: 1987804237-1765524442
                                                                                                                                                                                                          • Opcode ID: 52308ee6e9dda6b75b2e50c26c5d93fda79e142a43ef7e3d04d888155ff1c8f1
                                                                                                                                                                                                          • Instruction ID: 59c0dbe402b99ad60268ac374649ae684c31b57691a71dce68aeb03c6e5c0381
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 52308ee6e9dda6b75b2e50c26c5d93fda79e142a43ef7e3d04d888155ff1c8f1
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4871DD32A0AB8295EB518F35D8542BC37A0FF48BD4B488531DA5E47799DFBCE641D300
                                                                                                                                                                                                          Function 00007FF8A7FE82B0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 184COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Object_Occurred$ErrorFatalFormatFuncInitMallocSubtypeType_
                                                                                                                                                                                                          • String ID: cannot cast %s to ctype '%s'$unicode string of length %zd$write_raw_integer_data$write_raw_integer_data: bad integer size
                                                                                                                                                                                                          • API String ID: 2324297635-3775214127
                                                                                                                                                                                                          • Opcode ID: a9eff805046bd2350fc0d1e81b93a758ac4aea78bcc713fe649a5e6c2cdb988f
                                                                                                                                                                                                          • Instruction ID: 605a178b55ec34893e9db8195fcc086923f2f90131cfdcd022c218a3fe52728e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a9eff805046bd2350fc0d1e81b93a758ac4aea78bcc713fe649a5e6c2cdb988f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 67715C32B0F642AAEE60AF35A85027D62A1FF44BD4F182431DA5E47694EF7CE645E310
                                                                                                                                                                                                          Function 00007FF8A7FEB2D0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 180COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Object_$ClearDeallocExceptionFormatFromLongLong_MatchesTrackTuple_
                                                                                                                                                                                                          • String ID: (*)$invalid result type: '%s'$result type '%s' is opaque
                                                                                                                                                                                                          • API String ID: 4166317216-2055205602
                                                                                                                                                                                                          • Opcode ID: 3f77c5492d3cf76c4490e1b725f4ed40f8ca7395ae54f42b26e052cd1ab5bb79
                                                                                                                                                                                                          • Instruction ID: a2f3ca53d06f84d1de383652e533fccc61fd7b0fafad558a3ee8b6b308558b26
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3f77c5492d3cf76c4490e1b725f4ed40f8ca7395ae54f42b26e052cd1ab5bb79
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7E818F7260AB42A6EB10CF35D8406AD33A4FF48BD8F544236DA5E47B98EF38E655D340
                                                                                                                                                                                                          Function 00007FF8A7FE4330 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 123COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Dict_$FormatNext$ErrorFatalFuncItemList_ObjectOccurredstrncmp
                                                                                                                                                                                                          • String ID: '%s' is opaque$list or tuple or dict$list or tuple or dict or struct-cdata$too many initializers for '%s' (got %zd)
                                                                                                                                                                                                          • API String ID: 3179473356-3352871426
                                                                                                                                                                                                          • Opcode ID: 5c3913ca492e5bdc01c8805f59d7d478c2bb42eb8da7ce2d44509c725c79c4bb
                                                                                                                                                                                                          • Instruction ID: bc264181e9e55a3b17ad3935b954f20afeb1dda5c9cde777d733ba67ed799a1e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5c3913ca492e5bdc01c8805f59d7d478c2bb42eb8da7ce2d44509c725c79c4bb
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8F51356270EA42A5EA109F36E4441BD67A0FF88BD4F484136EE4D477A5EF7CE645E300
                                                                                                                                                                                                          Function 00007FF8A7FE1970 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 99COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Buffer_$Err_Release$String$BufferContiguousFormatObject_
                                                                                                                                                                                                          • String ID: contiguous buffer expected$expected a pointer or array ctype, got '%s'$right operand length must match slice length
                                                                                                                                                                                                          • API String ID: 917851491-2344006768
                                                                                                                                                                                                          • Opcode ID: c2aae864342acb74752e73ec3745920d1ba676c7a557cbc33d049a253a943c13
                                                                                                                                                                                                          • Instruction ID: f602545b88dd91c9bb3bdc31952b17c47b95d434f8629f44fafed3f5bd736b8e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c2aae864342acb74752e73ec3745920d1ba676c7a557cbc33d049a253a943c13
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0A415366B0AA82E2EE20DF76E85017D2361FF48BD4F544132D95E476A4EF7CEA48D300
                                                                                                                                                                                                          Function 00007FF8A7FE8C50 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 72libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_Format$AddressArg_ErrorLastParseProcSizeTuple___stdio_common_vsprintf
                                                                                                                                                                                                          • String ID: O!s:load_function$error 0x%x$function or pointer or array cdata expected, got '%s'$function/symbol '%s' not found in library '%s': %s$library '%s' has already been closed
                                                                                                                                                                                                          • API String ID: 1100265670-2543733793
                                                                                                                                                                                                          • Opcode ID: e28848603302aa5decceb4ea9c13b646fcd72f38971cde9ccdfe0c718d57e90a
                                                                                                                                                                                                          • Instruction ID: af69f49f1d43a678c9a148a2cc6e0fcccf6b8931c73325ae2cdccb73a5715fc7
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e28848603302aa5decceb4ea9c13b646fcd72f38971cde9ccdfe0c718d57e90a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 61314F66B0AA52A1EB109F75E8402BD63A0FF84BD4F441436C94D876A4EFBCD299E340
                                                                                                                                                                                                          Function 00007FF8A7FF7330 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 213COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dealloc$Err_$FormatMallocMem_MemoryMethod_Unicode___stdio_common_vsprintf
                                                                                                                                                                                                          • String ID: ;CFFI C function from %s.lib$the type '%s%s' is a function type, not a pointer-to-function type
                                                                                                                                                                                                          • API String ID: 1374498512-75659475
                                                                                                                                                                                                          • Opcode ID: f3e92e9d171f3dfcd5e58b7d7cb9247855d542b73da3129a23e94598be2d22d9
                                                                                                                                                                                                          • Instruction ID: edf52bcd84c17fce08c079cca8d198807be78c2305891236a4845b6d0f8b38f2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f3e92e9d171f3dfcd5e58b7d7cb9247855d542b73da3129a23e94598be2d22d9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 20A19C32A0AB829AEB10CF35D8442AD77A4FB48BD8F454231EE5D03794EF79E295D310
                                                                                                                                                                                                          Function 00007FF8A7FF6340 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 151COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memcpy$SizeUnicode_isspace$Arg_Bytes_DeallocDecodeDict_FromItemKeywords_Latin1ParseStringTuple
                                                                                                                                                                                                          • String ID: O|s:getctype
                                                                                                                                                                                                          • API String ID: 1974405215-2338347666
                                                                                                                                                                                                          • Opcode ID: e8034133fbcbcf1d20d4f4350f2741869491fde5b39f9f5417f3e7601edd3249
                                                                                                                                                                                                          • Instruction ID: 8142f9254f5edea8a9791ed253bc19caad7671dee9d2adead862202b9a7276a2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e8034133fbcbcf1d20d4f4350f2741869491fde5b39f9f5417f3e7601edd3249
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5951F122A0E696A1EA609F35A8647BE6791FF44FC4F084139CE4E47784DFBCD645E300
                                                                                                                                                                                                          Function 00007FF8A7FE6040 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 90COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$FormatNumber_OccurredSsize_t
                                                                                                                                                                                                          • String ID: cannot dereference null pointer from cdata '%s'$cdata '%s' can only be indexed by 0$cdata of type '%s' cannot be indexed$index too large for cdata '%s' (expected %zd < %zd)$negative index
                                                                                                                                                                                                          • API String ID: 2356906851-315104295
                                                                                                                                                                                                          • Opcode ID: 1e7b630bd5c526ef6c7075673091452f5f8fbe11da2cefb666558952b158651c
                                                                                                                                                                                                          • Instruction ID: 16e86db691f494661bc3d38088211b6d6cedef25271a9d6677693886581ccf75
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1e7b630bd5c526ef6c7075673091452f5f8fbe11da2cefb666558952b158651c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F3411166B0BA56A1EE51CF39E85017C6361FF84BE8F480531CA1D877A5EF6CE694E300
                                                                                                                                                                                                          Function 00007FF8A7FE8EA0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 78libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_ErrorFormatLast$AddressArg_ParseProcSizeTuple___stdio_common_vsprintf
                                                                                                                                                                                                          • String ID: O!sO:write_variable$error 0x%x$library '%s' has already been closed$variable '%s' not found in library '%s': %s
                                                                                                                                                                                                          • API String ID: 1423611193-1606821111
                                                                                                                                                                                                          • Opcode ID: d834ad5416b59c683c1ef897ad01fb44601a43a73b6a999b7fea32b09cc2a9e8
                                                                                                                                                                                                          • Instruction ID: c0127ead8851b0c0acd513bd99bac71739f5cc78e0cc9fe5a0b5386a89ac7b9d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d834ad5416b59c683c1ef897ad01fb44601a43a73b6a999b7fea32b09cc2a9e8
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 83314D62B0AB42A2EB109F36E84017D2361FF88BD4F445136DA5D87754EF7CE258E740
                                                                                                                                                                                                          Function 00007FF8A7FE9E70 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 76COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dict_$DeallocSizeUnicode_$Err_FormatInternItemObject_Place
                                                                                                                                                                                                          • String ID: duplicate field name '%s'
                                                                                                                                                                                                          • API String ID: 4240887453-3400721703
                                                                                                                                                                                                          • Opcode ID: 4abbc0d4fcf44b16489248f50e7b2221ef56aa351b393893ec3ce001d24608ae
                                                                                                                                                                                                          • Instruction ID: 23ad27e872ad16cee1fa9df1bd21b2d344e4fc9fc4c04eda77c1aa26a34ef8dd
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4abbc0d4fcf44b16489248f50e7b2221ef56aa351b393893ec3ce001d24608ae
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F5311336A0AA92A6DB008F35E85417D73B0FB89BD5F180031DA4E83764EFBDE655E701
                                                                                                                                                                                                          Function 00007FF8A7FE8D80 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 68libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_ErrorFormatLast$AddressArg_Object_ParseProcSizeTuple_
                                                                                                                                                                                                          • String ID: O!s:read_variable$error 0x%x$library '%s' has already been closed$variable '%s' not found in library '%s': %s
                                                                                                                                                                                                          • API String ID: 4169278214-767532634
                                                                                                                                                                                                          • Opcode ID: f1854dddd00d2dc07dbc5580063100e3c2a1b95eca19e54a93221191acd3c986
                                                                                                                                                                                                          • Instruction ID: b9cef8686cbd074957d22fb10a3d5db5a7043d6ba75ef3d92ccbf150813bb2c9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f1854dddd00d2dc07dbc5580063100e3c2a1b95eca19e54a93221191acd3c986
                                                                                                                                                                                                          • Instruction Fuzzy Hash: DA316D66B1AA52A1EB009F35E84017E63A0FF84BC4F441532DE4D87B68EF7CD259D740
                                                                                                                                                                                                          Function 00007FF646AB80B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                                                                                                                                                          • String ID: Needs to remove its temporary files.
                                                                                                                                                                                                          • API String ID: 3975851968-2863640275
                                                                                                                                                                                                          • Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
                                                                                                                                                                                                          • Instruction ID: 49fb1d1a2cd9831c95365f66379ace5cf215a7cfb8f841da46c25e108772c34f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 30218B61A0DE4682E781BB7AB854169E261EF88F90F484231DF2EC3798DE2DD5C58231
                                                                                                                                                                                                          Function 00007FF8A7FF8450 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 59libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_ErrorFormatLastUnicode_$AddressProc
                                                                                                                                                                                                          • String ID: error 0x%x$library '%s' has been closed$symbol '%s' not found in library '%s': %s
                                                                                                                                                                                                          • API String ID: 3000000035-2382056100
                                                                                                                                                                                                          • Opcode ID: a6a57e7dff6c6103324552777f93e54becfae5a7bac4de5ab0b1a612f0a09a44
                                                                                                                                                                                                          • Instruction ID: ab247fbe4780e3f1a3f588c1f260ff02feffc0b992081659a443b732f750088a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a6a57e7dff6c6103324552777f93e54becfae5a7bac4de5ab0b1a612f0a09a44
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4E213925B0EA52A5EB109F26B84407D6360FF85BD4F481135DE0E47BA4EFBCE205E304
                                                                                                                                                                                                          Function 00007FF8A7FF69E0 Relevance: 16.6, APIs: 11, Instructions: 128COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DeallocList_$FromStringUnicode_$AppendPackTuple_
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1902583452-0
                                                                                                                                                                                                          • Opcode ID: 9280075ff307f06dbeda912c69eef76fb2f4c3556412a018c406dc5bcd8cee40
                                                                                                                                                                                                          • Instruction ID: 6a7f1300c745b888ab5610417c31b09e499ab908ffcbb66f5805ec5a75f7fcaa
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9280075ff307f06dbeda912c69eef76fb2f4c3556412a018c406dc5bcd8cee40
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D0516836A0AB52A5EA149F35A86827D63A0FB88FD8F084039CF4D47755DFBCE645D700
                                                                                                                                                                                                          Function 00007FF8A7FEBC60 Relevance: 16.6, APIs: 11, Instructions: 68COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Value$ErrorLast_errnomalloc$ReleaseState_
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3175917953-0
                                                                                                                                                                                                          • Opcode ID: 38fb3d2d0f60556b14f0495fd9d4d32ec89c594f68a2ec04fa11d50a441e41c8
                                                                                                                                                                                                          • Instruction ID: c892aa6625358ad72aa5635e006c800edcc9ef8e523045ebc481f538d44a1d02
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 38fb3d2d0f60556b14f0495fd9d4d32ec89c594f68a2ec04fa11d50a441e41c8
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 57217832A0AB1296EB109F31E85462D63A1FF88BD4F084538DE4D073A5EF7CEA95D710
                                                                                                                                                                                                          Function 00007FF8A7FE9570 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 186COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • PyErr_SetString.PYTHON312(?,?,?,?,00000000,00000000,00007FF8A7FE729B), ref: 00007FF8A7FE95D1
                                                                                                                                                                                                          • _PyObject_GC_NewVar.PYTHON312(?,?,?,?,00000000,00000000,00007FF8A7FE729B), ref: 00007FF8A7FE9768
                                                                                                                                                                                                          • PyObject_GC_Track.PYTHON312(?,?,?,?,00000000,00000000,00007FF8A7FE729B), ref: 00007FF8A7FE97AA
                                                                                                                                                                                                          • memcpy.VCRUNTIME140(?,?,?,?,00000000,00000000,00007FF8A7FE729B), ref: 00007FF8A7FE97BA
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Object_$Err_StringTrackmemcpy
                                                                                                                                                                                                          • String ID: double$float$long double$primitive type '%s' has size %d; the supported sizes are 1, 2, 4, 8
                                                                                                                                                                                                          • API String ID: 1250498430-2195461940
                                                                                                                                                                                                          • Opcode ID: b9b4bd686c0b7d980a607a1e1505f7a2736158eea20b8c1650ff5888c06c7e61
                                                                                                                                                                                                          • Instruction ID: 73a7ea74cb6dec8e38d662f9040a9026eb75720939449bab543bf0dc076c300f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b9b4bd686c0b7d980a607a1e1505f7a2736158eea20b8c1650ff5888c06c7e61
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B081A062A1E782A1EB54CF35A85007C27A0FF45BD6F440036DA8E17A98EF7CE655E321
                                                                                                                                                                                                          Function 00007FF8A7FE7D20 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 172COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$DeallocFormatInitObject_Stringmalloc
                                                                                                                                                                                                          • String ID: array size would overflow a Py_ssize_t$cannot instantiate ctype '%s' of unknown size$expected a pointer or array ctype, got '%s'
                                                                                                                                                                                                          • API String ID: 3721622924-1738891937
                                                                                                                                                                                                          • Opcode ID: 203bd65f97b3b91bf9145b79f1931da84dd3c818db7281400d4032b7af9e5268
                                                                                                                                                                                                          • Instruction ID: 988d7753b74cc84ad87514f5e7bd1a4210fb34f7d32f31ad287e661146832226
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 203bd65f97b3b91bf9145b79f1931da84dd3c818db7281400d4032b7af9e5268
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B3716F22A0B742A1EA149F36E4402BD23A0FB44BD8F540535DE5D477A4EF7CFA86E350
                                                                                                                                                                                                          Function 00007FF8A7FE5340 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 70COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Object_$DeallocDict_Item
                                                                                                                                                                                                          • String ID: %s: %s
                                                                                                                                                                                                          • API String ID: 22580554-3740598653
                                                                                                                                                                                                          • Opcode ID: 28746dd814fc3743f830dc76f4eb43fb0c73353e8198c2ca47858735e79e809f
                                                                                                                                                                                                          • Instruction ID: 31d13fcb1d4b79eeeca6d07a73f665f39a8bedace7b57a5453e3614b76546d0c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 28746dd814fc3743f830dc76f4eb43fb0c73353e8198c2ca47858735e79e809f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5C213D32E0FA5292EA148F66A95417D63A2EF49FC5F280031CE4E07755EF6CE646E700
                                                                                                                                                                                                          Function 00007FF8A7FF8F20 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 57threadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dict_$ItemState_$ClearDeallocDictErr_FromInternInterpreterStringThreadUnicode_
                                                                                                                                                                                                          • String ID: __cffi_backend_extern_py
                                                                                                                                                                                                          • API String ID: 2738494814-865530817
                                                                                                                                                                                                          • Opcode ID: 848e42f0217935a16e66fd4db591153a2f895bdfe1b74589055b6e1d468eb191
                                                                                                                                                                                                          • Instruction ID: 0cdfa10a79927304f5c77365f0de23865fa62ab51b17737a63dfff4be745234c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 848e42f0217935a16e66fd4db591153a2f895bdfe1b74589055b6e1d468eb191
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 83110D26B1BB02A5EF458F75E85423D22E1EF68BD1F480434D91E467E4EF7CE684E210
                                                                                                                                                                                                          Function 00007FF646AC1038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID: f$f$p$p$f
                                                                                                                                                                                                          • API String ID: 3215553584-1325933183
                                                                                                                                                                                                          • Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                          • Instruction ID: 28290d89d08414d8567abeafee8764f8486b2777e875aa6f8eefec77dc04a77b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F9127271F0C98385FB60BA15E15C679E2A1EB40758F984035D79B866C4DF7EECC09B24
                                                                                                                                                                                                          Function 00007FF8A7FEADE0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 208COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memcpy$Err_String
                                                                                                                                                                                                          • String ID: ($...$expected a tuple of ctypes
                                                                                                                                                                                                          • API String ID: 629984673-1295035442
                                                                                                                                                                                                          • Opcode ID: f1854efa52403ce88a6defa8e061232ed205aa23c369b6f954f753c50e4d75d0
                                                                                                                                                                                                          • Instruction ID: bd064afe84ef678cf4bbfea8ebf5511cf9cd169f6f5e7c21373be7d00a29d6f0
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f1854efa52403ce88a6defa8e061232ed205aa23c369b6f954f753c50e4d75d0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4681B472A0AB86A6EB258F25E54077E77A1EB15BD0F198132CB6D07390EF3CE5859300
                                                                                                                                                                                                          Function 00007FF8A7FE8000 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 160COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Long_SignSubtypeType_
                                                                                                                                                                                                          • String ID: integer/float conversion failed$integer/float expected
                                                                                                                                                                                                          • API String ID: 3148124222-1774177493
                                                                                                                                                                                                          • Opcode ID: cbe909d874529a4ce723fa37f86186a71358f8b5156f028e2dfde0e227453eed
                                                                                                                                                                                                          • Instruction ID: 8e4952f095a9a2c35365bb07116161b24912be910836d648f4fb449dc699faa9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: cbe909d874529a4ce723fa37f86186a71358f8b5156f028e2dfde0e227453eed
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F451D462F0AA42A1EF559F35D44013C23A1FF85BE4F086136DA0E47794EE6CEAD1E300
                                                                                                                                                                                                          Function 00007FF646AB1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                          • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                          • API String ID: 2050909247-3659356012
                                                                                                                                                                                                          • Opcode ID: e30da66bd449e278f4e1a8a1da43a6fc232ee02027dbecaf9a0becaf305aee32
                                                                                                                                                                                                          • Instruction ID: 75acdbc43d5ab413e49369bbaf7646ea72df2cf47cc4fe4bc891f38b3f50b0f9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e30da66bd449e278f4e1a8a1da43a6fc232ee02027dbecaf9a0becaf305aee32
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1F41A061B0CE5686EA00FB12A8046B9E391FF54FC4F444432EE0D8779ADF3EE5858760
                                                                                                                                                                                                          Function 00007FF8A7FF4C72 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 118COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dealloc$Err_FormatTuple_$Pack
                                                                                                                                                                                                          • String ID: abi number %d not supported
                                                                                                                                                                                                          • API String ID: 3887392137-1298965716
                                                                                                                                                                                                          • Opcode ID: daea80570288f162babb6434e8d73fde46a3de03784f133d8ddc03d0cec998e8
                                                                                                                                                                                                          • Instruction ID: df374651f53836141adc1a1aecbd0f497e8a5b6a812469fd27262460728b269a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: daea80570288f162babb6434e8d73fde46a3de03784f133d8ddc03d0cec998e8
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A6417132A0A652A5EB558F31D8043BC77A1EF45BD4F448031CA0E57B95DFBCE681E300
                                                                                                                                                                                                          Function 00007FF646AB8850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetTempPathW.KERNEL32(?,?,00000000,00007FF646AB3CBB), ref: 00007FF646AB88F4
                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,00000000,00007FF646AB3CBB), ref: 00007FF646AB88FA
                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32(?,00000000,00007FF646AB3CBB), ref: 00007FF646AB893C
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB8A20: GetEnvironmentVariableW.KERNEL32(00007FF646AB388E), ref: 00007FF646AB8A57
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB8A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF646AB8A79
                                                                                                                                                                                                            • Part of subcall function 00007FF646AC82A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF646AC82C1
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB2810: MessageBoxW.USER32 ref: 00007FF646AB28EA
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                                                                                          • API String ID: 3563477958-1339014028
                                                                                                                                                                                                          • Opcode ID: 6ea14b1c2d16789ddeaa0d8cc05df9935aa6d91fa7ad17376743f3d33dced37a
                                                                                                                                                                                                          • Instruction ID: 2546f8c976cc7f5e1d053ae623ef2df7c0b73ed9b1cb8fb79c5707d50c9421b4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6ea14b1c2d16789ddeaa0d8cc05df9935aa6d91fa7ad17376743f3d33dced37a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E341C211A0DE4645FA20FB65A8552FA9391AF89FC4F400031EE0ED77DADE3EE585C361
                                                                                                                                                                                                          Function 00007FF8A7FEDF30 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 98COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Arg_Err_Keywords_ParseSizeStringSubtypeTupleType_
                                                                                                                                                                                                          • String ID: Can remove destructor only on a object previously returned by ffi.gc()$O!O|n:gc
                                                                                                                                                                                                          • API String ID: 2258746257-2175166513
                                                                                                                                                                                                          • Opcode ID: e3a5cf178e5a69bcc67de852dd7062f429d1c813df3dff71a7469cb62966c711
                                                                                                                                                                                                          • Instruction ID: 31b5bd6cb45228035a086add1263bba915b8c14420e0788632f2e6bb5451db3d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e3a5cf178e5a69bcc67de852dd7062f429d1c813df3dff71a7469cb62966c711
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8841F736A0AB4292EB60CF25E84426D33A1FB48BD0F844136DB9D87B58EF7DE559D700
                                                                                                                                                                                                          Function 00007FF8A7FE3B40 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 81COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • initializer for ctype '%s' must be a %s, not %.200s, xrefs: 00007FF8A7FE3B9B
                                                                                                                                                                                                          • initializer for ctype '%s' must be a %s, not cdata '%s', xrefs: 00007FF8A7FE3BFE
                                                                                                                                                                                                          • initializer for ctype '%s' appears indeed to be '%s', but the types are different (check that you are not e.g. mixing up different ffi instances), xrefs: 00007FF8A7FE3C32
                                                                                                                                                                                                          • initializer for ctype '%s' is correct, but we get an internal mismatch--please report a bug, xrefs: 00007FF8A7FE3C5C
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_Format
                                                                                                                                                                                                          • String ID: initializer for ctype '%s' appears indeed to be '%s', but the types are different (check that you are not e.g. mixing up different ffi instances)$initializer for ctype '%s' is correct, but we get an internal mismatch--please report a bug$initializer for ctype '%s' must be a %s, not %.200s$initializer for ctype '%s' must be a %s, not cdata '%s'
                                                                                                                                                                                                          • API String ID: 376477240-1352286566
                                                                                                                                                                                                          • Opcode ID: f320ca696e307b7e8ba0fac4e3850166535296ae0181565a196ad7c80b2c7ab3
                                                                                                                                                                                                          • Instruction ID: c0b78bf467df46699e51d9d96e1d2e3b8c7352320154a9a4090ab651808bb0af
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f320ca696e307b7e8ba0fac4e3850166535296ae0181565a196ad7c80b2c7ab3
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E9315066A0AA46A1EE008F29E85007C3361FF88BD4F484531DE6D473E4EFBDDA58D304
                                                                                                                                                                                                          Function 00007FF8A7FF42A0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 66COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • prim=%d, xrefs: 00007FF8A7FF4374
                                                                                                                                                                                                          • primitive floating-point type is 'long double', not supported for now with the syntax 'typedef double... xxx;', xrefs: 00007FF8A7FF4357
                                                                                                                                                                                                          • primitive floating-point type with an unexpected size (or not a float type at all), xrefs: 00007FF8A7FF4331
                                                                                                                                                                                                          • primitive integer type with an unexpected size (or not an integer type at all), xrefs: 00007FF8A7FF430B
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Object_$Track
                                                                                                                                                                                                          • String ID: prim=%d$primitive floating-point type is 'long double', not supported for now with the syntax 'typedef double... xxx;'$primitive floating-point type with an unexpected size (or not a float type at all)$primitive integer type with an unexpected size (or not an integer type at all)
                                                                                                                                                                                                          • API String ID: 16854473-3944103904
                                                                                                                                                                                                          • Opcode ID: faa758031222a6cc76c542af6647647ffec1296893555f385ace537a3077dca6
                                                                                                                                                                                                          • Instruction ID: 7fefc64dad7421764016687d4c81f3c21c7c560befc3dd7d80b2da85960b4abb
                                                                                                                                                                                                          • Opcode Fuzzy Hash: faa758031222a6cc76c542af6647647ffec1296893555f385ace537a3077dca6
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2A217E22F1A902A1EF548F79F89007D23A0FF487E4F951135DA2E4B2A4EF6CD6A49304
                                                                                                                                                                                                          Function 00007FF8A7FF5F90 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 64COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Arg_Bool_DeallocErr_FromKeywords_LongMethod_PackParseSizeStringTupleTuple_
                                                                                                                                                                                                          • String ID: cannot pass 'free' without 'alloc'$|OOi:new_allocator
                                                                                                                                                                                                          • API String ID: 3165387783-375137214
                                                                                                                                                                                                          • Opcode ID: 8619190078572a5ff1f93501410df266657b6abe7660833b568527782c0aa0dd
                                                                                                                                                                                                          • Instruction ID: 0c51d418b12b3f2b9678687e0c288647a76fa14243f67a29f66fb4cab2c43e04
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8619190078572a5ff1f93501410df266657b6abe7660833b568527782c0aa0dd
                                                                                                                                                                                                          • Instruction Fuzzy Hash: ED216132A0EB4292EB108F21F85026973B0FB49BC4F544035DA8D47B64DFBDD194D700
                                                                                                                                                                                                          Function 00007FF8A7FE5750 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 60COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Unicode_$DeallocFormatFromObject_Repr
                                                                                                                                                                                                          • String ID: <cdata '%s' %s %s>$<cdata '%s' owning %zd bytes>$calling$handle to
                                                                                                                                                                                                          • API String ID: 3526755465-2632218437
                                                                                                                                                                                                          • Opcode ID: 597212b7671f7fb5f942f3f9ed8acfd309a1245cc953ec0d53327de69b19cd3c
                                                                                                                                                                                                          • Instruction ID: f768c871636bfe28027aacf97fb0beec6a8e1c28109fdd1e01d211f61d5b1820
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 597212b7671f7fb5f942f3f9ed8acfd309a1245cc953ec0d53327de69b19cd3c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A8215E72A1BB46E2EA118F6AE95007C2361FF49BD4F441031CA0E07765EE7CD391E704
                                                                                                                                                                                                          Function 00007FF8A7FF85B0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 58COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Arg_ClearDict_Err_ErrorFormatFreeLastLibraryParseSizeTuple_Unicode___stdio_common_vsprintf
                                                                                                                                                                                                          • String ID: closing library '%s': %s$error 0x%x
                                                                                                                                                                                                          • API String ID: 3709125606-4000567706
                                                                                                                                                                                                          • Opcode ID: 11cee66fe837d19775e87c6625fade0d4b2f2581af4f54aab030b7b6574c378d
                                                                                                                                                                                                          • Instruction ID: d292a4cff23a93e6804632839d02d891b986e008bfb245fcbebc37b3fafdd869
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 11cee66fe837d19775e87c6625fade0d4b2f2581af4f54aab030b7b6574c378d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 83213C22B1AA92A2EB448F26E88006D3770FF88FC0F545032DA4D93764DF7CEA45E704
                                                                                                                                                                                                          Function 00007FF8A7FEEAA0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 46COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Occurred$DeallocFormatObject_Unicode_
                                                                                                                                                                                                          • String ID: 32-bit int$integer %s does not fit '%s'
                                                                                                                                                                                                          • API String ID: 4129581467-810487915
                                                                                                                                                                                                          • Opcode ID: 36b12394ac6193a4cc45a9ad7eeba973ec5097458df3955d7616972b085294d3
                                                                                                                                                                                                          • Instruction ID: fd7f48ae2ef1b3b76ee6e6cdf2e6e467ae15018e0f6a9f73ba0fbfebafbe091e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 36b12394ac6193a4cc45a9ad7eeba973ec5097458df3955d7616972b085294d3
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E8110022F0B602A1FE545F79F84427C2291EF88BE4F085235E95E46399EF7CE644D700
                                                                                                                                                                                                          Function 00007FF8A7FEE940 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 44COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Occurred$DeallocFormatObject_Unicode_
                                                                                                                                                                                                          • String ID: 8-bit int$integer %s does not fit '%s'
                                                                                                                                                                                                          • API String ID: 4129581467-3624244522
                                                                                                                                                                                                          • Opcode ID: dc085fcf2b57c0e09125b0cb8cb07fc8f99a36aa64b17531676cd353cc19aeac
                                                                                                                                                                                                          • Instruction ID: a75c70fa39b4d1692f458a3d8fea8cc784d6077f0c6032e29ce780c0c1fd125c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: dc085fcf2b57c0e09125b0cb8cb07fc8f99a36aa64b17531676cd353cc19aeac
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A7113C22E0AA02A1FA945F75F85437C22E0EF48BD4F484035D94E4A799EFBCE684E301
                                                                                                                                                                                                          Function 00007FF8A7FEE9F0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 44COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Occurred$DeallocFormatObject_Unicode_
                                                                                                                                                                                                          • String ID: 16-bit int$integer %s does not fit '%s'
                                                                                                                                                                                                          • API String ID: 4129581467-4142791282
                                                                                                                                                                                                          • Opcode ID: 2caa50001df5dfa3399e96b5a1aa8e995700632d9b155835259a430637cd0d84
                                                                                                                                                                                                          • Instruction ID: e840dbbcbd4cfb119f1d318458f8333815fedcd321a13c873e2ed945de6c44b6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2caa50001df5dfa3399e96b5a1aa8e995700632d9b155835259a430637cd0d84
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 60111C22A0BA02A1FA549F75F84437C22A0FF44FD4F484039E90D46798EF6CE654D700
                                                                                                                                                                                                          Function 00007FF8A7FEEB60 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 44COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Occurred$DeallocFormatLong_Object_SignStringUnicode_
                                                                                                                                                                                                          • String ID: 8-bit unsigned int$integer %s does not fit '%s'
                                                                                                                                                                                                          • API String ID: 198760793-3731599500
                                                                                                                                                                                                          • Opcode ID: 9e703b4bbcd8911ee5849571e574c289719175e73c9bfc9667675a2bdae30fd8
                                                                                                                                                                                                          • Instruction ID: 18974b477a243ef4f5328213c0ba7972c2e0048cc57e42c83bfa06d41d424eba
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9e703b4bbcd8911ee5849571e574c289719175e73c9bfc9667675a2bdae30fd8
                                                                                                                                                                                                          • Instruction Fuzzy Hash: CD111E22E1B752A1FA545F79F84437C22A0EF48BE4F084134E95E467A9EF7CE684E300
                                                                                                                                                                                                          Function 00007FF8A7FEEC10 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 44COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Occurred$DeallocFormatLong_Object_SignStringUnicode_
                                                                                                                                                                                                          • String ID: 16-bit unsigned int$integer %s does not fit '%s'
                                                                                                                                                                                                          • API String ID: 198760793-331574723
                                                                                                                                                                                                          • Opcode ID: 0fe9db819802c4d93fcf6734ddb347999dbb8c1e8b80f5ec2e2c1211c6d880aa
                                                                                                                                                                                                          • Instruction ID: b0818b0c573e5fc6516c51698182376135720bd73c6bf7557f20aca3062d375b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0fe9db819802c4d93fcf6734ddb347999dbb8c1e8b80f5ec2e2c1211c6d880aa
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7F110C22B0BA42A1FA555F79F84427C27A0EF48BD4F184134D91E467A9EE7CE6C4E300
                                                                                                                                                                                                          Function 00007FF8A7FE1BD0 Relevance: 13.6, APIs: 9, Instructions: 95COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Object_$Buffer_Release$BufferClearErr_Instance
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3750329280-0
                                                                                                                                                                                                          • Opcode ID: 521cdb7d3d03546320b66de061579e722a750754d8dfef82b8805fce3310aff6
                                                                                                                                                                                                          • Instruction ID: b9114f0c4ffff3e53a9a36f93a33c46d12527e9f7467a0812404772968d358d4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 521cdb7d3d03546320b66de061579e722a750754d8dfef82b8805fce3310aff6
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B6417622B0EA53A2EB609F3AE8402BD63A1FF44BC4F544431D94D83664EF6CE645E740
                                                                                                                                                                                                          Function 00007FF8A7FE9460 Relevance: 13.6, APIs: 9, Instructions: 76COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dealloc$Dict_Item$Bytes_FromObject_SizeStringTrackmemcpy
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1819324212-0
                                                                                                                                                                                                          • Opcode ID: 10dd33285bf39167ec24cafbda5630ec4e52906e5030b9548a34149d46781ed2
                                                                                                                                                                                                          • Instruction ID: 9c183d13e5034b968563a145cbeb4ed4c5aa4f4be9fe9c5888573102da0b06fc
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 10dd33285bf39167ec24cafbda5630ec4e52906e5030b9548a34149d46781ed2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 06313872A0AB52A1EB148F31E94423D63E0EB48BD6F089031CA0E46799EF7CE651E711
                                                                                                                                                                                                          Function 00007FF8A7FF6880 Relevance: 13.6, APIs: 9, Instructions: 55COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _errno$Value$DeallocErr_LongLong_Occurredmalloc
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1551808740-0
                                                                                                                                                                                                          • Opcode ID: 68f3a9b78e3be72a959a71ca5eae25652b8b683c127bea553681060075fa99aa
                                                                                                                                                                                                          • Instruction ID: d5ba8f3037bd64369ef4ce2b50cf921eff94fffc9ac37ce205ddf823959c0629
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 68f3a9b78e3be72a959a71ca5eae25652b8b683c127bea553681060075fa99aa
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 67211F36E0B61296EB554F74AC6423C33A0FF48BA5F145138CA5D46390EFBCA695E710
                                                                                                                                                                                                          Function 00007FF8A7FE5C70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 165COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: cannot use <cdata '%s'> in a comparison
                                                                                                                                                                                                          • API String ID: 0-3474358591
                                                                                                                                                                                                          • Opcode ID: c5e331fd3171f7dac3e799057ca81497e548b3efce0c31a355493e8c05cadf0e
                                                                                                                                                                                                          • Instruction ID: a40c66879b0782745c00aecbdb469a70ebc036eea2ca01d1418b4736c35001fd
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c5e331fd3171f7dac3e799057ca81497e548b3efce0c31a355493e8c05cadf0e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4D614136A0AA46E2EA648F35EC5417D73A2FB44BD4F480432CA4D47794EF7CE686D701
                                                                                                                                                                                                          Function 00007FF646ACED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,?,00007FF646ACF11A,?,?,-00000018,00007FF646ACADC3,?,?,?,00007FF646ACACBA,?,?,?,00007FF646AC5FAE), ref: 00007FF646ACEEFC
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,?,?,00007FF646ACF11A,?,?,-00000018,00007FF646ACADC3,?,?,?,00007FF646ACACBA,?,?,?,00007FF646AC5FAE), ref: 00007FF646ACEF08
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                          • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                          • API String ID: 3013587201-537541572
                                                                                                                                                                                                          • Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
                                                                                                                                                                                                          • Instruction ID: 14ecf939b8a505e272a2ee51ba5cea1676fcc5a38141318f937c7cfc00b2c5a6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4141F261B1DE1291FB16FB16A804675A3D1BF49BD0F884539ED1EC7784EE3EE8858320
                                                                                                                                                                                                          Function 00007FF8A7FE67E0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 104COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Format$Number_Object_OccurredSsize_t
                                                                                                                                                                                                          • String ID: cannot add a cdata '%s' and a number$ctype '%s' points to items of unknown size
                                                                                                                                                                                                          • API String ID: 3506362094-755949881
                                                                                                                                                                                                          • Opcode ID: c2efb5d05a2d3b88d1a7755e517a8200a62e1477812044be39661a1839469e58
                                                                                                                                                                                                          • Instruction ID: e528fc5f1e61396e4f476a5c6bf3719b0e07e805b7140eefcaf86e3a1794897f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c2efb5d05a2d3b88d1a7755e517a8200a62e1477812044be39661a1839469e58
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 08413E32A0BA46E1EA54CF25E86017C23A1FF48BD4F584532DA4D577A4EF7CEA55E300
                                                                                                                                                                                                          Function 00007FF8A7FE2BF0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: List_$Dealloc$AppendErr_ErrorFatalFuncPackStringTuple_strncmp
                                                                                                                                                                                                          • String ID: fields
                                                                                                                                                                                                          • API String ID: 1806387768-2128995208
                                                                                                                                                                                                          • Opcode ID: 1de2d5332e17e85d5dc8c83ce253931b447faedcb9ff6807fb712ce2a2eb0ce5
                                                                                                                                                                                                          • Instruction ID: 4b286503748192f7c34b64d9c0e0f537435617a0db184484700f3dfe5a38be0d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1de2d5332e17e85d5dc8c83ce253931b447faedcb9ff6807fb712ce2a2eb0ce5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9A313032A0AA5291EB258F39E84423D63A0EF48BE4F440435CE4D477A4FF7CE685E704
                                                                                                                                                                                                          Function 00007FF8A7FE3C80 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 83COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: expected new array length or list/tuple/str, not %.200s$negative array length
                                                                                                                                                                                                          • API String ID: 0-630084864
                                                                                                                                                                                                          • Opcode ID: 892606e70f02ff47bb33e3f4324523b3daf652738aee88c1b788a2eeff9f6216
                                                                                                                                                                                                          • Instruction ID: b7f10a1f9d5ac883515696365dd74c85f1b3af1aa6e7ee484984db6a0170268d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 892606e70f02ff47bb33e3f4324523b3daf652738aee88c1b788a2eeff9f6216
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7C315C62B1AA0591EB548F2AF48017C2360FF88FE4B085231DE2D477A5EE6CE594D700
                                                                                                                                                                                                          Function 00007FF8A7FE31F0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 79COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DeallocErr_Long_SignString
                                                                                                                                                                                                          • String ID: an integer is required$can't convert negative number to unsigned$integer conversion failed
                                                                                                                                                                                                          • API String ID: 2527065810-2728004092
                                                                                                                                                                                                          • Opcode ID: 50a59338c99dfe6c9e4e28f1ce5a28eddca145c5707da92acfc7a868a9e21f7d
                                                                                                                                                                                                          • Instruction ID: 7ae479e3f619ddceb9ebef3f1adbcacd66c46c362b3eeacfc53a063faa32b9ff
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 50a59338c99dfe6c9e4e28f1ce5a28eddca145c5707da92acfc7a868a9e21f7d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 69317522B0AA52A1EA548F36E54427D6360FF48BE0F1C4131DEAD477D4EF6CE655E300
                                                                                                                                                                                                          Function 00007FF8A7FF7891 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dealloc$Err_Format$Dict_Item
                                                                                                                                                                                                          • String ID: constant '%s' is of type '%s', whose size is not known
                                                                                                                                                                                                          • API String ID: 3830123900-580431848
                                                                                                                                                                                                          • Opcode ID: 6fc4e4bc58be4fb527064c909f452ad2242212ac3f3d94e60b08bfb62660448c
                                                                                                                                                                                                          • Instruction ID: c595ea8d7786621ad7f76836e4688fd114e6a7300b4f86955f1b69ced9f31fae
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6fc4e4bc58be4fb527064c909f452ad2242212ac3f3d94e60b08bfb62660448c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BA314C22A0FA46A1EE519F35984027DA3A1EF44FD4F494435CE0E473A4EEBDEB45A320
                                                                                                                                                                                                          Function 00007FF8A7FE6D50 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 70COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_Long$AttrDict_GenericItemLong_Object_OccurredString
                                                                                                                                                                                                          • String ID: cannot delete struct field$cdata '%s' has no attribute '%s'$cdata '%s' has no field '%s'$cdata '%s' points to an opaque type: cannot write fields
                                                                                                                                                                                                          • API String ID: 3507916589-3282381042
                                                                                                                                                                                                          • Opcode ID: 9b29c16fa045ca136bcacd05488022c57aab267b6520d96aa7ddc49fd6ce27a7
                                                                                                                                                                                                          • Instruction ID: 6fd0fb2ff1f3922b0b7f824898c337a67e2937bf4f0ace52dc0d63ca93d18550
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9b29c16fa045ca136bcacd05488022c57aab267b6520d96aa7ddc49fd6ce27a7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D6318A21A0AB46A1EA248F36D86027C2760FB44FD8F480232DE4D477D9EF7CE652E305
                                                                                                                                                                                                          Function 00007FF8A7FF43A0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 51COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Long$FromLong_$Err_FormatUnsigned__stdio_common_vsprintf
                                                                                                                                                                                                          • String ID: %lld$%llu (0x%llx)$the C compiler says '%.200s' is equal to %s, but the cdef disagrees
                                                                                                                                                                                                          • API String ID: 2237024420-3737824454
                                                                                                                                                                                                          • Opcode ID: 0ab413eaa7f16fe4a3d2974242eaa0135d84b9118cc3b85c767991a37cbc0278
                                                                                                                                                                                                          • Instruction ID: 3bbe0533e6d22514bc246002cb5d599cded18278f4def61748b10cfd2049dd41
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0ab413eaa7f16fe4a3d2974242eaa0135d84b9118cc3b85c767991a37cbc0278
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5F215E2290E942A5EE20AF30E45037D6370FF84BC5F544132DA9E566E4DF6CE645E704
                                                                                                                                                                                                          Function 00007FF8A7FE26E0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47threadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: String$CharClearCloseCreateDeallocErr_FlagsHandleRun_ThreadUnicode_Wide
                                                                                                                                                                                                          • String ID: done()
                                                                                                                                                                                                          • API String ID: 168230354-3016733518
                                                                                                                                                                                                          • Opcode ID: dc2926677b4cad4f42074df862bef11821c116c181b1e3c06f314a515a354f73
                                                                                                                                                                                                          • Instruction ID: 803c615a935cf803886d04134f5e48931db97dc4da9699acacce02c3fa2d2419
                                                                                                                                                                                                          • Opcode Fuzzy Hash: dc2926677b4cad4f42074df862bef11821c116c181b1e3c06f314a515a354f73
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 45111936A1BB42A1EB148F71B91417D67A0FF84BC1F480535D98E42A64FF7CE249E604
                                                                                                                                                                                                          Function 00007FF8A7FFA650 Relevance: 12.2, APIs: 8, Instructions: 227COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 190073905-0
                                                                                                                                                                                                          • Opcode ID: 1a88d5e129af8f8e9a06888864d203883e398308e02297e2ddab19384919b000
                                                                                                                                                                                                          • Instruction ID: 0d17171654f074756c36f10aa6b8f861a738ef0d99eac10df479d912d533c944
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1a88d5e129af8f8e9a06888864d203883e398308e02297e2ddab19384919b000
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0A819122E1A243A5FA64AF75984127F22A0EF46BC0F558037DA4D47396DFBCEA45E700
                                                                                                                                                                                                          Function 00007FF8A7FE2F00 Relevance: 12.1, APIs: 8, Instructions: 66COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dealloc$List_String$AppendAttrClearErr_FromObject_Unicode_
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2809749462-0
                                                                                                                                                                                                          • Opcode ID: 5f7001363ee2e3e1e24e9347cfe3456a083445a969597ef583d071dd1216ae2a
                                                                                                                                                                                                          • Instruction ID: 540ad50e87e457cb8f6fc3b5a85a5df569b4d8019afc02bf0a407fb739a30a69
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5f7001363ee2e3e1e24e9347cfe3456a083445a969597ef583d071dd1216ae2a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F4212A32F0EA52A6EA195F75A90423D62A0FF48BD5F088434DA1D46794FFBCE645E308
                                                                                                                                                                                                          Function 00007FF8A7FED750 Relevance: 12.0, APIs: 8, Instructions: 47COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _errno$Value$Err_LongLong_Occurredmalloc
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 262410431-0
                                                                                                                                                                                                          • Opcode ID: 143ad8097e68d886845f92d8a0cab5f2b489c72b8dff9bee63b1868e0b542dec
                                                                                                                                                                                                          • Instruction ID: 149081f8b94b6ee05a5b89b0d056446e10951f195be6b9fb2387410d50c02b1e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 143ad8097e68d886845f92d8a0cab5f2b489c72b8dff9bee63b1868e0b542dec
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2D112876A1BB1296EB154F34E89423C33A0FF88B95F085534CA5D477A0EF7CAA94E710
                                                                                                                                                                                                          Function 00007FF8A7FF2778 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 132COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strncmp
                                                                                                                                                                                                          • String ID: __stdcal$__stdcal$__stdcal$internal error, please report!$undefined type name$unsigned
                                                                                                                                                                                                          • API String ID: 1114863663-2565106455
                                                                                                                                                                                                          • Opcode ID: a60b716f1b9cc4aa5d75289d4cc4827581d064da47f4e050f02a43019d6b9f62
                                                                                                                                                                                                          • Instruction ID: 03bf0a75c261ee2d4a020fcbba41d23599ea297c5cdda4ccc14492445fe10d7c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a60b716f1b9cc4aa5d75289d4cc4827581d064da47f4e050f02a43019d6b9f62
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1E51C172A0AA4696EB249F2AD4442BC37A1FB44FE4F540232DE6D873D5DF78E241E344
                                                                                                                                                                                                          Function 00007FF8A7FE5890 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 110COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: read_raw_complex_data$read_raw_complex_data: bad complex size$read_raw_unsigned_data$read_raw_unsigned_data: bad integer size
                                                                                                                                                                                                          • API String ID: 0-1204700216
                                                                                                                                                                                                          • Opcode ID: ad663ebdf663ba745235886c23d750f202d7ae20290f1215730e6ea7fda71956
                                                                                                                                                                                                          • Instruction ID: a8fa6c23ca3e0d6c146c8be0b20262b0d431cab4c36e5b6b20aaf62f296ed0b9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ad663ebdf663ba745235886c23d750f202d7ae20290f1215730e6ea7fda71956
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E141B662E1A606E6EA459F398CA107C2392FF557E0F644631D64EE3190FF1CEAD6E700
                                                                                                                                                                                                          Function 00007FF646ABDD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,?,?,00007FF646ABDFEA,?,?,?,00007FF646ABDCDC,?,?,?,00007FF646ABD8D9), ref: 00007FF646ABDDBD
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF646ABDFEA,?,?,?,00007FF646ABDCDC,?,?,?,00007FF646ABD8D9), ref: 00007FF646ABDDCB
                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,?,?,00007FF646ABDFEA,?,?,?,00007FF646ABDCDC,?,?,?,00007FF646ABD8D9), ref: 00007FF646ABDDF5
                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,?,00007FF646ABDFEA,?,?,?,00007FF646ABDCDC,?,?,?,00007FF646ABD8D9), ref: 00007FF646ABDE63
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,?,?,00007FF646ABDFEA,?,?,?,00007FF646ABDCDC,?,?,?,00007FF646ABD8D9), ref: 00007FF646ABDE6F
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                          • String ID: api-ms-
                                                                                                                                                                                                          • API String ID: 2559590344-2084034818
                                                                                                                                                                                                          • Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
                                                                                                                                                                                                          • Instruction ID: ba447dd26a55f1580cd122c3252bf3c7c0b2209d998c564449d5e35bd34a7759
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6C317E21B1EE4A91EE52BB02A800579E394FF59FA0F594536EE1D87380EF3DE4848624
                                                                                                                                                                                                          Function 00007FF8A7FECA40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memcpy$Size$Arg_FromParseStringTuple_Unicode_
                                                                                                                                                                                                          • String ID: O!s:getcname
                                                                                                                                                                                                          • API String ID: 714380276-3937919902
                                                                                                                                                                                                          • Opcode ID: 2e85fb79fad885fd9e833b6e31f0d80e5dc855ab3c0854f2ce48e6f0148d5109
                                                                                                                                                                                                          • Instruction ID: cb8dcd8d0c58d1d5cb16d18e90a3b0725f5c964bac00b348155fbe9d7d17105e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2e85fb79fad885fd9e833b6e31f0d80e5dc855ab3c0854f2ce48e6f0148d5109
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 45316962605A86EADB10CF75D8501ED3760FB45BE8B444722EA2D0BBD9DF38D256D340
                                                                                                                                                                                                          Function 00007FF8A7FF6750 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Size$Arg_DeallocParse$AllocBuildDict_Err_InfoItemKeywords_Method_StringSystemTupleTuple_Unicode_Value_Virtual
                                                                                                                                                                                                          • String ID: (OOOO)$O|OOO
                                                                                                                                                                                                          • API String ID: 164275408-1768548383
                                                                                                                                                                                                          • Opcode ID: 007a6adfdea7edddd031857b16fb3ef72d70f6da05746cc2e868e7309ea663a9
                                                                                                                                                                                                          • Instruction ID: 9ade335c3ec712491e0bd2ea6c668e34ce03cf40932a26fa68e48d10b65e0352
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 007a6adfdea7edddd031857b16fb3ef72d70f6da05746cc2e868e7309ea663a9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: DB314132A0AB46D1DB608F25F85026AB3A4FF88BD0F540039DA8D47B58DF7DD254DB00
                                                                                                                                                                                                          Function 00007FF646AB8760 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 995526605-0
                                                                                                                                                                                                          • Opcode ID: 1e3bf3a8b1345e2c0c0bdd6ff4e06add0bb9355989cc78c5a669156b3459c754
                                                                                                                                                                                                          • Instruction ID: e922f539595c6da0abe4fc4c8d9879105661e91a21a22ea4e74c9b48d0e8e5d1
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1e3bf3a8b1345e2c0c0bdd6ff4e06add0bb9355989cc78c5a669156b3459c754
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F1215121A0CE4642EB50BB99F45422AE3A1FF85BE0F100235EA6D83AE4DE6ED4848750
                                                                                                                                                                                                          Function 00007FF8A7FF7EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • PyDict_GetItem.PYTHON312 ref: 00007FF8A7FF7F01
                                                                                                                                                                                                          • PyErr_SetString.PYTHON312 ref: 00007FF8A7FF7F3F
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FF7660: PyUnicode_AsUTF8.PYTHON312(?,?,00000000,?,?,00007FF8A7FF82C3), ref: 00007FF8A7FF7689
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FF7660: PyErr_SetString.PYTHON312(?,?,00000000,?,?,00007FF8A7FF82C3), ref: 00007FF8A7FF76FE
                                                                                                                                                                                                          • PyUnicode_AsUTF8.PYTHON312 ref: 00007FF8A7FF7F85
                                                                                                                                                                                                          • PyErr_Format.PYTHON312 ref: 00007FF8A7FF7FA8
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FF70C0: PyEval_SaveThread.PYTHON312(?,?,00000000,00007FF8A7FF8342), ref: 00007FF8A7FF70DF
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FF70C0: TlsGetValue.KERNEL32(?,?,00000000,00007FF8A7FF8342), ref: 00007FF8A7FF70EE
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FF70C0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF8A7FF8342), ref: 00007FF8A7FF7101
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FF70C0: TlsSetValue.KERNEL32(?,?,00000000,00007FF8A7FF8342), ref: 00007FF8A7FF711E
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FF70C0: SetLastError.KERNEL32(?,?,00000000,00007FF8A7FF8342), ref: 00007FF8A7FF7127
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FF70C0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,00007FF8A7FF8342), ref: 00007FF8A7FF712D
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FF70C0: PyEval_RestoreThread.PYTHON312(?,?,00000000,00007FF8A7FF8342), ref: 00007FF8A7FF7149
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FF70C0: PyUnicode_AsUTF8.PYTHON312(?,?,00000000,00007FF8A7FF8342), ref: 00007FF8A7FF715D
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FF70C0: PyErr_Format.PYTHON312(?,?,00000000,00007FF8A7FF8342), ref: 00007FF8A7FF7174
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Unicode_$Eval_FormatStringThreadValue$Dict_ErrorItemLastRestoreSave_errnomalloc
                                                                                                                                                                                                          • String ID: C attribute cannot be deleted$cannot write to function or constant '%.200s'
                                                                                                                                                                                                          • API String ID: 3181857070-1071161328
                                                                                                                                                                                                          • Opcode ID: fad06088634bfd1fbfbf3eb47ddf1e8c66b0f447a4e8b21ec7c8bc15754f5b28
                                                                                                                                                                                                          • Instruction ID: 24c898f6a2df4a13d1f45983b3fdcae0ba5a6c16af05bd4520fc3469d9b1e677
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fad06088634bfd1fbfbf3eb47ddf1e8c66b0f447a4e8b21ec7c8bc15754f5b28
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9A216021A0AB42A1EF549F26E84017DA360EF48FC0F984035EE1E07BE4DF6DE645E350
                                                                                                                                                                                                          Function 00007FF8A7FE7A00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_InitObject_Stringmallocmemcpy
                                                                                                                                                                                                          • String ID: return type is a struct/union with a varsize array member$return type is an opaque structure or union
                                                                                                                                                                                                          • API String ID: 673089332-262380981
                                                                                                                                                                                                          • Opcode ID: bfd66b53dfe05172c11c1f0ecb5d33bca5e1d540f5dc4c788623ec16cdb41bee
                                                                                                                                                                                                          • Instruction ID: f4ee779f4b7d3b430357807142677b8deb9c37e208856fac6083fd72a48c30d9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: bfd66b53dfe05172c11c1f0ecb5d33bca5e1d540f5dc4c788623ec16cdb41bee
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A8216D32A0AB51A2EB54DF26E44426D73A1FB48FD0F480035DA4D47B64EF7CE6A4E710
                                                                                                                                                                                                          Function 00007FF8A7FF6640 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Size$Arg_BuildDeallocKeywords_Method_ParseTupleValue_
                                                                                                                                                                                                          • String ID: (OOOO)$|OOO
                                                                                                                                                                                                          • API String ID: 1859027967-2767428988
                                                                                                                                                                                                          • Opcode ID: c1c22f69095526a158d93733b1236ca31807cbeb396342611cd2cff1a23f6d7c
                                                                                                                                                                                                          • Instruction ID: 009cebbfe5c0a61036a204aeeac01ab0d345424a507c389aa633b1797ee0b94b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c1c22f69095526a158d93733b1236ca31807cbeb396342611cd2cff1a23f6d7c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 41213E36A1AB8691DB108F21F8506AAB3E4FB49BD0F540036DE8C43B68EF7CD154DB00
                                                                                                                                                                                                          Function 00007FF8A7FE2920 Relevance: 10.6, APIs: 7, Instructions: 50COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DeallocObject_$ClearDict_FreeItemRefsTrackWeak
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2303943592-0
                                                                                                                                                                                                          • Opcode ID: 5281ba59460151379513deaece5fbc7f97450a4c9895c88d5ea50fc7f3853007
                                                                                                                                                                                                          • Instruction ID: 6fc5527df77725d479051c2dd3aa30925c514c4a6447b6e17f1466e6ab2f34c8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5281ba59460151379513deaece5fbc7f97450a4c9895c88d5ea50fc7f3853007
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0721953290AE12A1EB599F75D85837C33A0FB48F99F086031CA0D462A4EF7DA685E305
                                                                                                                                                                                                          Function 00007FF646AD7DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                          • String ID: CONOUT$
                                                                                                                                                                                                          • API String ID: 3230265001-3130406586
                                                                                                                                                                                                          • Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
                                                                                                                                                                                                          • Instruction ID: 873558190367a4d2a237d141310b78e621a26cc4aadf2a4411ebacf0bb35fd4f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 62116021B1CE4286E750BB52E854369A6A1FB88FE4F044234EE5DC77A4DF7ED8848750
                                                                                                                                                                                                          Function 00007FF8A7FE7720 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ComplexComplex_Err_ErrorFatalFormatFromFunc
                                                                                                                                                                                                          • String ID: complex() not supported on cdata '%s'$read_raw_complex_data$read_raw_complex_data: bad complex size
                                                                                                                                                                                                          • API String ID: 1922044008-1323234755
                                                                                                                                                                                                          • Opcode ID: b628bd0cfb1c42fad71d6a92584b4695d23458dcf6edd97101d687094bb75b49
                                                                                                                                                                                                          • Instruction ID: 4583ffe001ed3ed3eadb5def99fce965881e36d997b26a47f175cce228a86130
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b628bd0cfb1c42fad71d6a92584b4695d23458dcf6edd97101d687094bb75b49
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 71119132D0968697EB10CF38D45106D6360FF957C8F604232D64C96564EF6CE65ADB00
                                                                                                                                                                                                          Function 00007FF8A7FE9950 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$String$Arg_Number_OccurredParseSizeSsize_tTuple_
                                                                                                                                                                                                          • String ID: O!O:new_array_type$negative array length
                                                                                                                                                                                                          • API String ID: 3893677698-1806197627
                                                                                                                                                                                                          • Opcode ID: 667bbbe7a2185914b3b4b824aba0e42bf06a34faae8301afd8c22bcf33a742a6
                                                                                                                                                                                                          • Instruction ID: 2a8e9047e14dbaffc7b1bdcad831eb634943caa8ef96265cc72978644f92748a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 667bbbe7a2185914b3b4b824aba0e42bf06a34faae8301afd8c22bcf33a742a6
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3D012D66B0EA42A0EE00DF75E85007D6361FF84BE4B844232D95D477A4EFBCE648E310
                                                                                                                                                                                                          Function 00007FF8A7FE37F0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 32COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$DeallocFormatObject_OccurredUnicode_
                                                                                                                                                                                                          • String ID: integer %s does not fit '%s'
                                                                                                                                                                                                          • API String ID: 1393314426-3740469958
                                                                                                                                                                                                          • Opcode ID: 9dda8ed7cafac19a58ef1854290d42d6d9f235014fdb1a7dfd31a9aafc488a0d
                                                                                                                                                                                                          • Instruction ID: 4d892a69aaacd4d0ade9f8dd3a2babe72db7cc25c9bd0481a685636820536017
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9dda8ed7cafac19a58ef1854290d42d6d9f235014fdb1a7dfd31a9aafc488a0d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7AF0C922E0AB12A2EA449F76E95817C22A4FF49FE4F085034DE1E477A4EE7CE644D300
                                                                                                                                                                                                          Function 00007FF646AB8560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF646AB9216), ref: 00007FF646AB8592
                                                                                                                                                                                                          • K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF646AB9216), ref: 00007FF646AB85E9
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB9400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF646AB45E4,00000000,00007FF646AB1985), ref: 00007FF646AB9439
                                                                                                                                                                                                          • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF646AB9216), ref: 00007FF646AB8678
                                                                                                                                                                                                          • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF646AB9216), ref: 00007FF646AB86E4
                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,00000000,00007FF646AB9216), ref: 00007FF646AB86F5
                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,00000000,00007FF646AB9216), ref: 00007FF646AB870A
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3462794448-0
                                                                                                                                                                                                          • Opcode ID: b2770b171440e78660be4c91fda42c27049aa369c6710ced6bdf6821ec2ad01d
                                                                                                                                                                                                          • Instruction ID: ad8de16c187df3f2852ea0ae3ac4c055481e7318f227933dd2571555c14f3504
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b2770b171440e78660be4c91fda42c27049aa369c6710ced6bdf6821ec2ad01d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2141B462B1DA8A81EB30BB15A5406AAA394FF84FC8F440135DF8DD7B89DE3DD581C721
                                                                                                                                                                                                          Function 00007FF646AB90E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB8760: GetCurrentProcess.KERNEL32 ref: 00007FF646AB8780
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB8760: OpenProcessToken.ADVAPI32 ref: 00007FF646AB8793
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB8760: GetTokenInformation.ADVAPI32 ref: 00007FF646AB87B8
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB8760: GetLastError.KERNEL32 ref: 00007FF646AB87C2
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB8760: GetTokenInformation.ADVAPI32 ref: 00007FF646AB8802
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB8760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF646AB881E
                                                                                                                                                                                                            • Part of subcall function 00007FF646AB8760: CloseHandle.KERNEL32 ref: 00007FF646AB8836
                                                                                                                                                                                                          • LocalFree.KERNEL32(?,00007FF646AB3C55), ref: 00007FF646AB916C
                                                                                                                                                                                                          • LocalFree.KERNEL32(?,00007FF646AB3C55), ref: 00007FF646AB9175
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                          • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                                                                                          • API String ID: 6828938-1529539262
                                                                                                                                                                                                          • Opcode ID: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
                                                                                                                                                                                                          • Instruction ID: 702e8323489f964ad7221e3df6f26ae13b47c2394ded001998fd0ca9d72cdbbc
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 88216D21A0CF4681F750BB10E8152EAA265FF89B80F444036EA4E93796DF3ED885C760
                                                                                                                                                                                                          Function 00007FF8A7FF8080 Relevance: 9.1, APIs: 6, Instructions: 63memoryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dealloc$AllocDict_FreeFromGenericLibraryStringType_Unicode_
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3239884862-0
                                                                                                                                                                                                          • Opcode ID: be2aba3d24c1ada56db06f01110a32629b58641e6e655dadaad03aa7c6967eec
                                                                                                                                                                                                          • Instruction ID: 77b88a85025482ec38ea1d7abd9ba644567e73a1a830e58c19c63c972975cfb3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: be2aba3d24c1ada56db06f01110a32629b58641e6e655dadaad03aa7c6967eec
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 73214A32B0AB42A5EB648F25E84027D73E8FB48BD4F184134DA8D42764DFBCE652D300
                                                                                                                                                                                                          Function 00007FF8A7FED6E0 Relevance: 9.0, APIs: 6, Instructions: 28COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _errno$Value$malloc
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2897262332-0
                                                                                                                                                                                                          • Opcode ID: 7c89d1e7b46bceea5cab29fc1de263db9d067b15880768255f3937c3ff3dfe8d
                                                                                                                                                                                                          • Instruction ID: 9e7fd37ff34fa77eeb4d4da0fcb42131a43fcae2b6281cb0054e351df8c187f2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7c89d1e7b46bceea5cab29fc1de263db9d067b15880768255f3937c3ff3dfe8d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A7F03C76A0BA1696EB154F30E85423C23A1FF88B89F055134CA4D063A0EF7CA998D610
                                                                                                                                                                                                          Function 00007FF8A7FF56A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 90COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • recursion overflow in ffi.include() delegations, xrefs: 00007FF8A7FF5769
                                                                                                                                                                                                          • function, global variable or non-integer constant '%.200s' must be fetched from its original 'lib' object, xrefs: 00007FF8A7FF570E
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_Format
                                                                                                                                                                                                          • String ID: function, global variable or non-integer constant '%.200s' must be fetched from its original 'lib' object$recursion overflow in ffi.include() delegations
                                                                                                                                                                                                          • API String ID: 376477240-3674543662
                                                                                                                                                                                                          • Opcode ID: b8ff02f170859be29615f4bcde8e3fdc89724505101976f2779168ed6f99660e
                                                                                                                                                                                                          • Instruction ID: b7cf777865f994f457db161e4ff94cff2109330ce86f2b96a499ec28ecdb1a11
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b8ff02f170859be29615f4bcde8e3fdc89724505101976f2779168ed6f99660e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6931CF27B1AA56D6EA118F32F54027E63A0FB84BE0F480531CE5E47795DFBCE642A300
                                                                                                                                                                                                          Function 00007FF646AB2910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF646AB1B6A), ref: 00007FF646AB295E
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                          • String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
                                                                                                                                                                                                          • API String ID: 2050909247-2962405886
                                                                                                                                                                                                          • Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
                                                                                                                                                                                                          • Instruction ID: d37e2d4d2308dea67e29211079533e7d7725b0c4c17ce40f7ef0c1dc1b714c33
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0B31C762B1CA8552E760B761A8406F6A695BF88BD4F400132FE8DC3759DF3DD586C610
                                                                                                                                                                                                          Function 00007FF8A7FF792B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • global variable '%.200s' should be %zd bytes according to the cdef, but is actually %zd, xrefs: 00007FF8A7FF7968
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dealloc$Err_Format$Dict_Item
                                                                                                                                                                                                          • String ID: global variable '%.200s' should be %zd bytes according to the cdef, but is actually %zd
                                                                                                                                                                                                          • API String ID: 3830123900-276371364
                                                                                                                                                                                                          • Opcode ID: bc69f846bbe908aa3b1f298b2c6cab019fc9750a59e2bab75fff88cb0835d384
                                                                                                                                                                                                          • Instruction ID: fbc6e712b83d6b0674fa1586ae9e0e4e4185cbd7acd561ed3b47bc35ae3b319a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: bc69f846bbe908aa3b1f298b2c6cab019fc9750a59e2bab75fff88cb0835d384
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5921A222A0B64291FA519F76D84067DA3A1EF84FD4F890035CE0D473A4DEBEE741A320
                                                                                                                                                                                                          Function 00007FF646AB2710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF646AB1B99), ref: 00007FF646AB2760
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                          • String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                          • API String ID: 2050909247-1591803126
                                                                                                                                                                                                          • Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
                                                                                                                                                                                                          • Instruction ID: 5277d9acfab89ab9d99eefbe351da8155980cb4421cfd4bf95e27f7c4d2a6c8b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1A217C72A1CB8582E660BB50B8817E6A3A4FB887C4F400136EE8D83659DF7DD6898750
                                                                                                                                                                                                          Function 00007FF8A7FE3110 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dealloc
                                                                                                                                                                                                          • String ID: an integer is required$integer conversion failed
                                                                                                                                                                                                          • API String ID: 3617616757-1846422268
                                                                                                                                                                                                          • Opcode ID: 7809733d7cd1f8e9f7524f195d2639f2e74a98a67b81af8ddee571cc842d2f0a
                                                                                                                                                                                                          • Instruction ID: a6026f9d4c78f509153016077f81afa2b5a07a0b2e5f73d04c9a709c90c3fc26
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7809733d7cd1f8e9f7524f195d2639f2e74a98a67b81af8ddee571cc842d2f0a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: EF21E022F0AA46A1EA558F36E94427C63A4EF44BF4F1C5235DE2D077E4EE6CE694D300
                                                                                                                                                                                                          Function 00007FF8A7FE9D90 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Arg_ParseSizeTuple_strcmp
                                                                                                                                                                                                          • String ID: FILE$s:new_struct_type$struct _IO_FILE
                                                                                                                                                                                                          • API String ID: 3757293142-674226114
                                                                                                                                                                                                          • Opcode ID: fd3a60de0ca84b9ee791de28b189f2f851fb8b2f8231fe578e3776eb59bb0570
                                                                                                                                                                                                          • Instruction ID: aec88668daf246a8e603e69c5404322a77bb3c9e728f8f197dfc986ccc9820be
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fd3a60de0ca84b9ee791de28b189f2f851fb8b2f8231fe578e3776eb59bb0570
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B801B162A0D68292DB10CF35E8402BD73A1FB857C1F885132DB8E43658EE7CD646D710
                                                                                                                                                                                                          Function 00007FF8A7FE55B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Unicode_$DeallocFormatFromObject_Repr
                                                                                                                                                                                                          • String ID: <cdata '%s' %s %s>
                                                                                                                                                                                                          • API String ID: 3526755465-1199376545
                                                                                                                                                                                                          • Opcode ID: 92e8b411aa87ab1fc87cb18141ce1d7fd9f4644be2a94bc0e60e910f9e080c53
                                                                                                                                                                                                          • Instruction ID: b357b91affecb7607533da63fa271eed810545029fc21dfd9f8f175438fdf625
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 92e8b411aa87ab1fc87cb18141ce1d7fd9f4644be2a94bc0e60e910f9e080c53
                                                                                                                                                                                                          • Instruction Fuzzy Hash: DC012822A0AA9292EA548F66FD4012D63A1FB88FD4F485031EE4E07B59EF7CD691D700
                                                                                                                                                                                                          Function 00007FF8A7FEC9A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Arg_Err_ParseSizeStringTuple_
                                                                                                                                                                                                          • String ID: O!O!n:rawaddressof$expected a cdata struct/union/array/pointer object$expected a pointer ctype
                                                                                                                                                                                                          • API String ID: 4247878537-375230600
                                                                                                                                                                                                          • Opcode ID: ff3d13d3c1bd2ecf70dcc6f6de814df9574445e062849f9b6d2bb57c48f062f7
                                                                                                                                                                                                          • Instruction ID: 78219703b8c7ed7fae1b6b8271604b7c52410126f3e53059d373eeb8ba954963
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ff3d13d3c1bd2ecf70dcc6f6de814df9574445e062849f9b6d2bb57c48f062f7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 32112E62A0DA86A1EE11CF24E8501BD33A0FB84BD4F940132DA9D436A4DF7CD649E700
                                                                                                                                                                                                          Function 00007FF8A7FE5BE0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 34COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_ErrorFatalFormatFunc
                                                                                                                                                                                                          • String ID: float() not supported on cdata '%s'$read_raw_float_data$read_raw_float_data: bad float size
                                                                                                                                                                                                          • API String ID: 4046554067-1430910167
                                                                                                                                                                                                          • Opcode ID: cca38cd799a4194b9cc09f102081e57649ff986fa1583fdc2600aa6cd8071237
                                                                                                                                                                                                          • Instruction ID: ddd5b8d84b433e5abc877918e0c0bc435d3a38e97132d25eaef0417857107ddf
                                                                                                                                                                                                          • Opcode Fuzzy Hash: cca38cd799a4194b9cc09f102081e57649ff986fa1583fdc2600aa6cd8071237
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BA017172E0AA06E2EA44CF39E89047C23A1FF45BC4B904032C50D57664EF7CE6CAEB10
                                                                                                                                                                                                          Function 00007FF8A7FE2FE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dict_Next$ErrorFatalFunc
                                                                                                                                                                                                          • String ID: _cffi_backend: get_field_name()$get_field_name
                                                                                                                                                                                                          • API String ID: 3667637998-2451131939
                                                                                                                                                                                                          • Opcode ID: 83c9e2edf1c90e3bb5b73ef7b7146cbf376fbd351d02ab754c5f6e28380c3fb2
                                                                                                                                                                                                          • Instruction ID: 625625d9b01c1e0ccbd9aec1ad3bf127a210321af006904b53ab286019e75174
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 83c9e2edf1c90e3bb5b73ef7b7146cbf376fbd351d02ab754c5f6e28380c3fb2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C5014F22619A87A2DB10CF25F4442AE6371FF847C8F541032EB8D47928EFBDD659D740
                                                                                                                                                                                                          Function 00007FF8A7FED9E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 29COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Buffer_$BufferContiguousErr_Object_ReleaseString
                                                                                                                                                                                                          • String ID: contiguous buffer expected
                                                                                                                                                                                                          • API String ID: 2934809616-3992619153
                                                                                                                                                                                                          • Opcode ID: d6b75a9f0b40574fef19843038d3722adfd3bfe2648668ed4aff4fa49dce6ba1
                                                                                                                                                                                                          • Instruction ID: cc3277adf09072fdf04e79d806adb1c88bcc4fe4f08ed04d7450a5ee56389b65
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d6b75a9f0b40574fef19843038d3722adfd3bfe2648668ed4aff4fa49dce6ba1
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E3F0A062B1A52392FB109F76AC4013C1361DF84FE0B482030CC1E8B3A0EE6CE6D9E300
                                                                                                                                                                                                          Function 00007FF8A7FE27F0 Relevance: 7.6, APIs: 5, Instructions: 73COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memcpy$Object_$Track
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2188153816-0
                                                                                                                                                                                                          • Opcode ID: 2ffe7a5f7058f47fe5cd9df19c3e406a6f0f16ceb72a15f06e52b1da7f32a6c2
                                                                                                                                                                                                          • Instruction ID: 6fb7e29c26f8f2a0fd26c1373417e8044afa8a85f07dcf1ec27cae9e0eba675b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2ffe7a5f7058f47fe5cd9df19c3e406a6f0f16ceb72a15f06e52b1da7f32a6c2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0C21F532605B909ADB04CF25E88416D77A5FB48BE8B490135EE4D87B95EF3CD256C300
                                                                                                                                                                                                          Function 00007FF646AD93D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _set_statfp
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1156100317-0
                                                                                                                                                                                                          • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                          • Instruction ID: 12fd4369076be84bdc41967321dd05b3af15b2017aa65e09af264655ccb87287
                                                                                                                                                                                                          • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0C1191B2E5CE1301F754B124D456375A0466F59374F050634EE7E8A2D7CE2EE9C14124
                                                                                                                                                                                                          Function 00007FF646ACB400 Relevance: 7.6, APIs: 5, Instructions: 54COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • FlsGetValue.KERNEL32(?,?,?,00007FF646ACA613,?,?,00000000,00007FF646ACA8AE,?,?,?,?,?,00007FF646ACA83A), ref: 00007FF646ACB41F
                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF646ACA613,?,?,00000000,00007FF646ACA8AE,?,?,?,?,?,00007FF646ACA83A), ref: 00007FF646ACB43E
                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF646ACA613,?,?,00000000,00007FF646ACA8AE,?,?,?,?,?,00007FF646ACA83A), ref: 00007FF646ACB466
                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF646ACA613,?,?,00000000,00007FF646ACA8AE,?,?,?,?,?,00007FF646ACA83A), ref: 00007FF646ACB477
                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF646ACA613,?,?,00000000,00007FF646ACA8AE,?,?,?,?,?,00007FF646ACA83A), ref: 00007FF646ACB488
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Value
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3702945584-0
                                                                                                                                                                                                          • Opcode ID: 43a5c13e669b9c0dc60c9d5204f3187f9cebb30c335aac4df6ce1d0b58ad24f5
                                                                                                                                                                                                          • Instruction ID: ab841c59357fbc51218342ff9f52246f9c9d86c21f1757fdbedd7b2e82a45e22
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 43a5c13e669b9c0dc60c9d5204f3187f9cebb30c335aac4df6ce1d0b58ad24f5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 35116020F0DE4281FA58B765A651179E142AF847B0F488734E93FDA6D6EE2FF4C58321
                                                                                                                                                                                                          Function 00007FF8A7FF7210 Relevance: 7.5, APIs: 5, Instructions: 32COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dealloc$FreeLibraryObject_Track
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2674720036-0
                                                                                                                                                                                                          • Opcode ID: b5063930d8c60cc215c3057d7fcac7dc0d69dba4791599d4b43e0b87794572c6
                                                                                                                                                                                                          • Instruction ID: 2e1caa8271de6dd66d8f9f38567812f1e6277bd8fce256ecefc38243fcba4ba6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b5063930d8c60cc215c3057d7fcac7dc0d69dba4791599d4b43e0b87794572c6
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9101D633D0BA12E5EB954F71DD4827C73A0EB45FA9F545030DA0E85191CFBEA686EB10
                                                                                                                                                                                                          Function 00007FF8A7FE15B0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Value$ErrorLast_errnomalloc
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2411484184-0
                                                                                                                                                                                                          • Opcode ID: e488a826f195c001651052e684a3a9f0d19f84a96cf89817c6b9f1d79835e855
                                                                                                                                                                                                          • Instruction ID: 12a52755558a4b299d2d59aa669a910912422aa10890a050dd58df318ce50824
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e488a826f195c001651052e684a3a9f0d19f84a96cf89817c6b9f1d79835e855
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0E014B32E0AB5192EB108F21E45412863A1FF88B94F098535DA4D47354EF7CE995DB10
                                                                                                                                                                                                          Function 00007FF8A7FE1630 Relevance: 7.5, APIs: 5, Instructions: 25COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Value$ErrorLast_errnomalloc
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2411484184-0
                                                                                                                                                                                                          • Opcode ID: 938e482ca38ea7b382a05e366784367b7899dc8e576a2d46c98cab6c7a6c2be2
                                                                                                                                                                                                          • Instruction ID: da75839637dd5b71146fda9aa5a54b16f5fa2c520db6b0923e412371059c048f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 938e482ca38ea7b382a05e366784367b7899dc8e576a2d46c98cab6c7a6c2be2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 66F03A32E0760697EB158F31E8642386361FF88B95F094138C94D063A4EF6C6A98D610
                                                                                                                                                                                                          Function 00007FF646AC6010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID: verbose
                                                                                                                                                                                                          • API String ID: 3215553584-579935070
                                                                                                                                                                                                          • Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                          • Instruction ID: b7f936ef77a05fbbf5bcbdb9318f582ee60864c70ac4e53c8cb264772f776e68
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D091BD22B0CE4681F761FF28D46877DB391AB40B94F489136DA5B873C5DE3EE8858321
                                                                                                                                                                                                          Function 00007FF646ABD6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                          • String ID: csm
                                                                                                                                                                                                          • API String ID: 2395640692-1018135373
                                                                                                                                                                                                          • Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
                                                                                                                                                                                                          • Instruction ID: f828acd0bc2dcb960bfc5a8e9d4a57377a6c33b733f08c646bd0f2cee17a734c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 88518D32A1DA468ADB14BF15E444A78A791EB44F98F108136DB4E87788EF7EE8C1C710
                                                                                                                                                                                                          Function 00007FF646ABEF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                          • String ID: MOC$RCC
                                                                                                                                                                                                          • API String ID: 3544855599-2084237596
                                                                                                                                                                                                          • Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
                                                                                                                                                                                                          • Instruction ID: dae0add7e3fb6d68b07cc8d1a71a599aaa782982d38f98aaaa4431fecfb95fb4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
                                                                                                                                                                                                          • Instruction Fuzzy Hash: AA61807290CBC981EB60AB15E4403AAF7A0FB85B84F084625EB9D47B55DF7DD1D0CB20
                                                                                                                                                                                                          Function 00007FF8A7FE6E60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_String
                                                                                                                                                                                                          • String ID: array size would overflow a Py_ssize_t
                                                                                                                                                                                                          • API String ID: 1450464846-3850734049
                                                                                                                                                                                                          • Opcode ID: 33cdaf1584b82da621bae8fdbdf860ffc2a95cdbf945a7e33592c68d286ca6e9
                                                                                                                                                                                                          • Instruction ID: 332dedb694154fb81180c47e74a293691f9556ecb3cda93e0d2b8fa5c3626910
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 33cdaf1584b82da621bae8fdbdf860ffc2a95cdbf945a7e33592c68d286ca6e9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 57515E22B0A686A1EE948F26E85017D3360FF48BD0F441231EE6E43BD4EF6CE9909744
                                                                                                                                                                                                          Function 00007FF646AB7E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32(00000000,?,00007FF646AB352C,?,00000000,00007FF646AB3F23), ref: 00007FF646AB7F22
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CreateDirectory
                                                                                                                                                                                                          • String ID: %.*s$%s%c$\
                                                                                                                                                                                                          • API String ID: 4241100979-1685191245
                                                                                                                                                                                                          • Opcode ID: 517c45005fecb665460f06d6deeb7a52b86fc8f3bacaeb8cdec2a0b3fdaf0698
                                                                                                                                                                                                          • Instruction ID: 9a82708fdc449c614e7bcfd2c244fa198ab62936b17c0f83a15d30f1cbdf31d0
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 517c45005fecb665460f06d6deeb7a52b86fc8f3bacaeb8cdec2a0b3fdaf0698
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4531D22161DEC945EA61BB20E8507EAA354EF84FE4F044231EF6D837C9DE2DD681C710
                                                                                                                                                                                                          Function 00007FF8A7FE6980 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • pointer subtraction: the distance between the two pointers is not a multiple of the item size, xrefs: 00007FF8A7FE6A4C
                                                                                                                                                                                                          • cannot subtract cdata '%s' and cdata '%s', xrefs: 00007FF8A7FE6A7A
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$FormatString
                                                                                                                                                                                                          • String ID: cannot subtract cdata '%s' and cdata '%s'$pointer subtraction: the distance between the two pointers is not a multiple of the item size
                                                                                                                                                                                                          • API String ID: 4212644371-3794040536
                                                                                                                                                                                                          • Opcode ID: 395e169c5739ba28758f6a1c21c95846833e8ea4a1d44cf29ab1dbb009c727f8
                                                                                                                                                                                                          • Instruction ID: 1f271b2effab59ca5499f8168a51cabae7c8cb8b3da8d79c782455252a8fab7b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 395e169c5739ba28758f6a1c21c95846833e8ea4a1d44cf29ab1dbb009c727f8
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9F314F72E0BA4EA1EE648F65D86067C23A1FB44BC4F455976C91C072D0EE7CEAD5E301
                                                                                                                                                                                                          Function 00007FF8A7FEC610 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$FormatString
                                                                                                                                                                                                          • String ID: ctype '%s' is of unknown size$expected a 'cdata' or 'ctype' object
                                                                                                                                                                                                          • API String ID: 4212644371-2764735189
                                                                                                                                                                                                          • Opcode ID: 5810c187a67809cb4b130ed5f0013bfbd1904b457718a229d1d8487af58f6217
                                                                                                                                                                                                          • Instruction ID: e04810eced7f336fc949633cf5602943e9dbb321136ee6f59c1f4011c2226c2c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5810c187a67809cb4b130ed5f0013bfbd1904b457718a229d1d8487af58f6217
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0631EA63B0BA06E1EE54CF25D49067923A1FF94BC4F451432D50E876A0EF7CE6A9E701
                                                                                                                                                                                                          Function 00007FF8A7FE3920 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • PyErr_Format.PYTHON312 ref: 00007FF8A7FE3A11
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FE11A0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8A7FE11EB
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_Format__stdio_common_vsprintf
                                                                                                                                                                                                          • String ID: initializer for ctype 'char16_t' must be a unicode string of length 1, not %.200s$larger-than-0xFFFF character$unicode string of length %zd
                                                                                                                                                                                                          • API String ID: 3682193652-3085492373
                                                                                                                                                                                                          • Opcode ID: b42d2b992fd0f15b7e2c26160689cf66ed3603904f2301dfe72343b861151498
                                                                                                                                                                                                          • Instruction ID: 70e7d4311296136a17020851d91e968bb7fa13a5af3c0d3fcc78776c63b39078
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b42d2b992fd0f15b7e2c26160689cf66ed3603904f2301dfe72343b861151498
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BA317222A0E682A1EE60CF35D45537C63A5FF84BC8F980132D98D462E4EF7DEA49D700
                                                                                                                                                                                                          Function 00007FF646AB2810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Message
                                                                                                                                                                                                          • String ID: ERROR$Error$[PYI-%d:%ls]
                                                                                                                                                                                                          • API String ID: 2030045667-255084403
                                                                                                                                                                                                          • Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
                                                                                                                                                                                                          • Instruction ID: 9e8d19d2ed1f2bc9a69fc9b3d6ec2212395e429851e979d2b3735ae190349c10
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 50219FA2B0CB4182E650BB54F8447EAA3A4FB88784F400136EE8D93659DE3DD689C710
                                                                                                                                                                                                          Function 00007FF8A7FF6100 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_FromLong_SizeSsize_tStringTuple_
                                                                                                                                                                                                          • String ID: offsetof() expects at least 2 arguments
                                                                                                                                                                                                          • API String ID: 1664805531-4287892465
                                                                                                                                                                                                          • Opcode ID: f00b09bba9f38762a77f4bafc419a15b5121ad400c08834d8ddbbda3a053e21e
                                                                                                                                                                                                          • Instruction ID: 1551f768e2bda3aade5f0d7b9e087c76b4e582d48e5555a06a64d2bd456b6f9a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f00b09bba9f38762a77f4bafc419a15b5121ad400c08834d8ddbbda3a053e21e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B5119D22B1AA5195EB148F31E8501BD23A0FB8DBD4F081431EE4E43B55DFBCD695D700
                                                                                                                                                                                                          Function 00007FF8A7FF6950 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Arg_FormatKeywords_OccurredParseSizeTuple
                                                                                                                                                                                                          • String ID: integer constant '%.200s' not found
                                                                                                                                                                                                          • API String ID: 2363003521-2598228679
                                                                                                                                                                                                          • Opcode ID: 672c97ed1388c1b5454143079bf92689344c8bb2180d1a9fbbd5984362136aff
                                                                                                                                                                                                          • Instruction ID: d003d171857f1903d4b8fa2741cdbe6805e085ea1801523e11793cf37a87117c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 672c97ed1388c1b5454143079bf92689344c8bb2180d1a9fbbd5984362136aff
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FF016265B1AA16A1EE108F71E8105B9A3A0EF88FD0F480035DD4D47764EF7CE258D714
                                                                                                                                                                                                          Function 00007FF8A7FEC910 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Size$Arg_BuildErr_ParseStringTuple_Value_
                                                                                                                                                                                                          • String ID: (On)$O!O|i:typeoffsetof
                                                                                                                                                                                                          • API String ID: 1294453720-945657874
                                                                                                                                                                                                          • Opcode ID: a9e96af6e96d563c977228fa90480bf78f758e699be6a10abd642ecc536274d7
                                                                                                                                                                                                          • Instruction ID: 57d2ba544de3c1c87734358845bb0b71de1936d849ae2cd03bc45b6c957ed735
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a9e96af6e96d563c977228fa90480bf78f758e699be6a10abd642ecc536274d7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A101177661DB46A1DE10CF61E8401AE7760FB857D4F841136E98E43764EF7CE249DB40
                                                                                                                                                                                                          Function 00007FF8A7FED880 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Arg_Err_FormatParseSizeTuple_
                                                                                                                                                                                                          • String ID: O!O$needs 'void *', got '%s'
                                                                                                                                                                                                          • API String ID: 365124298-685417567
                                                                                                                                                                                                          • Opcode ID: f09494dd2b88f10b23476fc2a386a7864d06bc62aa949ad35e8d89ceb211845d
                                                                                                                                                                                                          • Instruction ID: 7fd2cebc190a6511344d5a526a42163bcdd1928fa22706d4777616ee17f83d30
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f09494dd2b88f10b23476fc2a386a7864d06bc62aa949ad35e8d89ceb211845d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D5F0FF66A0EA42A1EA00DF65E8511AD63A1FB84BD4F804132D94D47A64DFBCD75EE700
                                                                                                                                                                                                          Function 00007FF646ACC610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2718003287-0
                                                                                                                                                                                                          • Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
                                                                                                                                                                                                          • Instruction ID: 0dba6a515fa2e01f3673ed82e3a01550e4808a6e0913874a808adb3bc7c19de5
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 42D114B2B1CE808AE710EF65D4442AC77B2FB44B98B448235DE5F97B89DE39D046C350
                                                                                                                                                                                                          Function 00007FF646ACCFD0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF646ACCFBB), ref: 00007FF646ACD0EC
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF646ACCFBB), ref: 00007FF646ACD177
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 953036326-0
                                                                                                                                                                                                          • Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
                                                                                                                                                                                                          • Instruction ID: db8144fa8de4560c9db26a591e74a51a30638b8b82208d5df199264a3feb93ce
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2A91B572F1CA5185F750BF6994502BDABA1BB44B88F14413ADE0F97A85CE3ED4C2D720
                                                                                                                                                                                                          Function 00007FF8A7FF7B08 Relevance: 6.1, APIs: 4, Instructions: 128COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: List_$DeallocFromSliceStringUnicode_
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2856216243-0
                                                                                                                                                                                                          • Opcode ID: a060fcd1d1d0bc63c597a10254fac5962edccef78e3cd3d07f34a90fd84b24d2
                                                                                                                                                                                                          • Instruction ID: 233995145fca5f1aee5dba4a6a359f161208227766d30312ab5a9f9802dfb8c4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a060fcd1d1d0bc63c597a10254fac5962edccef78e3cd3d07f34a90fd84b24d2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BA31C333A0F64297E70A4F3A984117CBBA1EB52BD5B548431CF4982754EFBEE542D710
                                                                                                                                                                                                          Function 00007FF646AC57EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2780335769-0
                                                                                                                                                                                                          • Opcode ID: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
                                                                                                                                                                                                          • Instruction ID: eeb62928c636e0669b382bade804c40e460ad5be323f962b1659bec64547a717
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 39519E62E0CA418AFB50FFB1D4503BDA3B1AF48B98F144435EE0E97689DF39D8918720
                                                                                                                                                                                                          Function 00007FF8A7FF5D20 Relevance: 6.1, APIs: 4, Instructions: 72COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Item$ClearDeallocDict_Err_SubtypeTuple_Type_Unicode_
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2830349452-0
                                                                                                                                                                                                          • Opcode ID: 7247e3d3d3da37e9cbc845cff0bd3705929a9b1aa68531a92463a3f350e90a1c
                                                                                                                                                                                                          • Instruction ID: 5dea38815c6c30458af169fcd1cba0b3ff85419eae7ef2123849b38a8b93a600
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7247e3d3d3da37e9cbc845cff0bd3705929a9b1aa68531a92463a3f350e90a1c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 33313C32A0BB12A2EA588F26D65423C67E1FF48BD0F084035CA1D47B90EFACE555D740
                                                                                                                                                                                                          Function 00007FF8A7FF7FD0 Relevance: 6.1, APIs: 4, Instructions: 58COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: List_$DeallocFromSliceStringUnicode_
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2856216243-0
                                                                                                                                                                                                          • Opcode ID: 3af2a3771d165e4ed7308a0aa5761afe4799a0c283cf7672543a36ad24db933a
                                                                                                                                                                                                          • Instruction ID: a409fe69c6a95d056f52c4e59787877548b891b5c73b5428016626f7b8392b23
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3af2a3771d165e4ed7308a0aa5761afe4799a0c283cf7672543a36ad24db933a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 41119023B0AA02D5EA119F66A68017D67A0FB44BE4F450031CF0D47750DEB9E692A300
                                                                                                                                                                                                          Function 00007FF646ABD080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2933794660-0
                                                                                                                                                                                                          • Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
                                                                                                                                                                                                          • Instruction ID: 16d320fcbef588b419c15c560a1ae3d5b6c9ac3e4547a7c55e05ff67ae357075
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 23117036B58F058AEB40EF60E8442B973A4FB19758F040E35DE2D867A4DF3CD1988350
                                                                                                                                                                                                          Function 00007FF8A7FFA9A0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2933794660-0
                                                                                                                                                                                                          • Opcode ID: 596be0927f78f84991075cbdc7975b617f20e2a8a8906028a2789e57974fb007
                                                                                                                                                                                                          • Instruction ID: 4412d02a726c9453209c8723d3b0a4df6709f3fee284910c1be20d648a34b54c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 596be0927f78f84991075cbdc7975b617f20e2a8a8906028a2789e57974fb007
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 65111822B15F019AEB00CF70E8542A833B4FB59798F440A31DA6D867A4DF7CD5A9C340
                                                                                                                                                                                                          Function 00007FF8A7FE93D0 Relevance: 6.0, APIs: 4, Instructions: 39COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Unicode_$Library$Arg_CharDeallocErrorFreeLastLengthLoadObject_ParseSizeTuple_Wide_strdup
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 401954816-0
                                                                                                                                                                                                          • Opcode ID: d448c56beaffd09715bd41e11c35a37641729b34c4a5d25298aeeb40dc85d46a
                                                                                                                                                                                                          • Instruction ID: 47615a46fb5d7996fab71c46f59fdb2042b33234d20b6b21faf0271b192bbedc
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d448c56beaffd09715bd41e11c35a37641729b34c4a5d25298aeeb40dc85d46a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D2013976A0EA42A2EB15CF74E44017DA3A0FF88BD9F444035DA4D42754EFBCD645D711
                                                                                                                                                                                                          Function 00007FF8A7FE6AA0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$ClearExceptionFormatMatchesUnicode_
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3412208678-0
                                                                                                                                                                                                          • Opcode ID: 937af04d1200e84c7176cf5eec324f504c542d33950e4b6559967da55c4092cf
                                                                                                                                                                                                          • Instruction ID: 8e8b84bdb4cf5cb84a3757a861d0e3980375f7e86b47e85b4cd51dbdcadd6018
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 937af04d1200e84c7176cf5eec324f504c542d33950e4b6559967da55c4092cf
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5BF0F926B0AB92A2EA408F76E89403D6360FB88FC0B088035DE5E97B64DE6CD594D300
                                                                                                                                                                                                          Function 00007FF646AC9084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _invalid_parameter_noinfo.LIBCMT ref: 00007FF646AC90B6
                                                                                                                                                                                                            • Part of subcall function 00007FF646ACA9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF646AD2D92,?,?,?,00007FF646AD2DCF,?,?,00000000,00007FF646AD3295,?,?,?,00007FF646AD31C7), ref: 00007FF646ACA9CE
                                                                                                                                                                                                            • Part of subcall function 00007FF646ACA9B8: GetLastError.KERNEL32(?,?,?,00007FF646AD2D92,?,?,?,00007FF646AD2DCF,?,?,00000000,00007FF646AD3295,?,?,?,00007FF646AD31C7), ref: 00007FF646ACA9D8
                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF646ABCC15), ref: 00007FF646AC90D4
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID: C:\Users\user\Desktop\qhos.exe
                                                                                                                                                                                                          • API String ID: 3580290477-2817503745
                                                                                                                                                                                                          • Opcode ID: 2cf9991d5cc0f55d4af5251d222b056ff2fa25707e1fd1ed9fb4097698885552
                                                                                                                                                                                                          • Instruction ID: b9cd7c38ff6c84f88980d320efce69b329563604248803c2d62eb1080271ffe3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2cf9991d5cc0f55d4af5251d222b056ff2fa25707e1fd1ed9fb4097698885552
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6B416032A0CF5286EB54FF25A4420BDA795EF457D4B554035EA4F83B85DE3EE4C18360
                                                                                                                                                                                                          Function 00007FF8A7FF6ED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$OccurredString
                                                                                                                                                                                                          • String ID: recursion overflow in ffi.include() delegations
                                                                                                                                                                                                          • API String ID: 114435612-2249810312
                                                                                                                                                                                                          • Opcode ID: 4909c9b511e2c0b31c2cd97bbd258bb9a808b8332b7f05489945ee6e26e49877
                                                                                                                                                                                                          • Instruction ID: 1ec371c99b9cfeaa8b1bbf1a65c1a96bb01c90c19308f98a4a64c7d01fddcdb6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4909c9b511e2c0b31c2cd97bbd258bb9a808b8332b7f05489945ee6e26e49877
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F431A332B0AA42A5EB14CF22E81066D6760FB44BD8F444536EE6D43785EF7CE512D300
                                                                                                                                                                                                          Function 00007FF8A7FF57E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_Formatmemset
                                                                                                                                                                                                          • String ID: %s%s
                                                                                                                                                                                                          • API String ID: 1100529188-3252725368
                                                                                                                                                                                                          • Opcode ID: 6da30f56e8015e3a1d7d2734413e7b8b409e5e6b94874cc5211c7e7bd792728b
                                                                                                                                                                                                          • Instruction ID: cb7cdf24bc733133f7bd2197115ad7844f3862563952576da1370785653bb659
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6da30f56e8015e3a1d7d2734413e7b8b409e5e6b94874cc5211c7e7bd792728b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4D317222A09B8599EB108F35D4502AC37A1FB49BE8F485331DA6E177D9DF7DD255C300
                                                                                                                                                                                                          Function 00007FF646ACF628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentDirectory
                                                                                                                                                                                                          • String ID: :
                                                                                                                                                                                                          • API String ID: 1611563598-336475711
                                                                                                                                                                                                          • Opcode ID: 779a21297323b81187f7e0c7d27b40be9ec8fbab2d126766b2de98969da868de
                                                                                                                                                                                                          • Instruction ID: 8beab3b547bb5766f344f132f6ee627726beca0c861ab153c26e978782805346
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 779a21297323b81187f7e0c7d27b40be9ec8fbab2d126766b2de98969da868de
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6B21B662A0CE8182FB20BB15D04426DB3B1FF84B44F954035DA9E83694DF7EE9C58761
                                                                                                                                                                                                          Function 00007FF8A7FE3A40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FE11A0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8A7FE11EB
                                                                                                                                                                                                          • PyErr_Format.PYTHON312 ref: 00007FF8A7FE3B15
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_Format__stdio_common_vsprintf
                                                                                                                                                                                                          • String ID: initializer for ctype 'char32_t' must be a unicode string of length 1, not %.200s$unicode string of length %zd
                                                                                                                                                                                                          • API String ID: 3682193652-4170590841
                                                                                                                                                                                                          • Opcode ID: 3c6d72cb6482390d1f6e8d6967e0b6c0bb6f4ae1d620c188bf85d2c4d03a0e74
                                                                                                                                                                                                          • Instruction ID: 55c6c4bef2504aa6e90694ed85c8acacd10bd96f7684d619eb9ce165e3f81b42
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3c6d72cb6482390d1f6e8d6967e0b6c0bb6f4ae1d620c188bf85d2c4d03a0e74
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A4314126A0A686A1EE20DF29D4542BD2375FF85BC8F884131D94D476E4EF7CEA89D700
                                                                                                                                                                                                          Function 00007FF8A7FE7830 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • PyErr_SetString.PYTHON312 ref: 00007FF8A7FE78B2
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FE50A0: PyErr_Fetch.PYTHON312 ref: 00007FF8A7FE50CA
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FE50A0: PyObject_CallFunctionObjArgs.PYTHON312 ref: 00007FF8A7FE50D9
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FE50A0: _Py_Dealloc.PYTHON312 ref: 00007FF8A7FE50FA
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FE50A0: _Py_Dealloc.PYTHON312 ref: 00007FF8A7FE51FD
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FE50A0: PyErr_Restore.PYTHON312 ref: 00007FF8A7FE5215
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FE50A0: _Py_Dealloc.PYTHON312 ref: 00007FF8A7FE5233
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • only 'cdata' object from ffi.new(), ffi.gc(), ffi.from_buffer() or ffi.new_allocator()() can be used with the 'with' keyword or ffi.release(), xrefs: 00007FF8A7FE78A8
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DeallocErr_$ArgsCallFetchFunctionObject_RestoreString
                                                                                                                                                                                                          • String ID: only 'cdata' object from ffi.new(), ffi.gc(), ffi.from_buffer() or ffi.new_allocator()() can be used with the 'with' keyword or ffi.release()
                                                                                                                                                                                                          • API String ID: 1646949248-4224388032
                                                                                                                                                                                                          • Opcode ID: aa63ce304cdc2b21f3c42e19cb5892ebf741b955057ef031d4102737c2678c8b
                                                                                                                                                                                                          • Instruction ID: b292d6a79999840ecca7e52f5b601c64d3a0686863f589a8f8ab025cf8decada
                                                                                                                                                                                                          • Opcode Fuzzy Hash: aa63ce304cdc2b21f3c42e19cb5892ebf741b955057ef031d4102737c2678c8b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 71210136E0B646A1EA50DF65D89017C3361FFA4BC4B941432DA0E477A0DF7CDA58E311
                                                                                                                                                                                                          Function 00007FF8A7FEB620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$OccurredString
                                                                                                                                                                                                          • String ID: callback with the return type 'void' must return None
                                                                                                                                                                                                          • API String ID: 114435612-1821524162
                                                                                                                                                                                                          • Opcode ID: ae7b6f80f023880edb94a5da8e51c10f15895ed8fcf9e2dde7b7f5fbeedea884
                                                                                                                                                                                                          • Instruction ID: 292c1385234973736fc35055e216aa153c300718b4c208657a7514a043002464
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ae7b6f80f023880edb94a5da8e51c10f15895ed8fcf9e2dde7b7f5fbeedea884
                                                                                                                                                                                                          • Instruction Fuzzy Hash: EC119432A1A602E2EE548F39F44197C22A0EF14BE4F084635DA2C477D5FE6CE6909700
                                                                                                                                                                                                          Function 00007FF646ABFDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                          • String ID: csm
                                                                                                                                                                                                          • API String ID: 2573137834-1018135373
                                                                                                                                                                                                          • Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
                                                                                                                                                                                                          • Instruction ID: 7d9e53c96976b0a9da84be20f7235d8270a38c20977b9f41d312cad6607664ba
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8311193261CF8582EB61AB15F440269B7E5FB88B88F584234DF8D47B69DF3DD5918B00
                                                                                                                                                                                                          Function 00007FF8A7FE7960 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_FormatObject_
                                                                                                                                                                                                          • String ID: cdata '%s' does not support iteration
                                                                                                                                                                                                          • API String ID: 2473357163-1739368148
                                                                                                                                                                                                          • Opcode ID: 6c488f7799fa390b29dea17249abf4c880117c5121d23be5963cdd351ac3da00
                                                                                                                                                                                                          • Instruction ID: bbbb7a19daeecf03e7a57478cee720bd2bf38a3e898a118f622d0d24cef85b81
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6c488f7799fa390b29dea17249abf4c880117c5121d23be5963cdd351ac3da00
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B2113CB2A06B0592EF19CF79D49016C23A0FB98F98B041036CE4C87364EF38D5A4D350
                                                                                                                                                                                                          Function 00007FF8A7FE6740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$OccurredString
                                                                                                                                                                                                          • String ID: 'del x[n]' not supported for cdata objects
                                                                                                                                                                                                          • API String ID: 114435612-201749645
                                                                                                                                                                                                          • Opcode ID: f720e1f39a2eb0efaf902be54d2bea477f9509a7fcba676635de80ebcb984ae1
                                                                                                                                                                                                          • Instruction ID: 710e4433bff67b3bd97a607bd1880b5c72fca33e532c666f913c4babed255d11
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f720e1f39a2eb0efaf902be54d2bea477f9509a7fcba676635de80ebcb984ae1
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 21016132B2AB5591EE508F26E95013D6360FB48FD4F181031EF5E07795EF6CEA91A700
                                                                                                                                                                                                          Function 00007FF646AD07AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2248277956.00007FF646AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646AB0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248248660.00007FF646AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248314117.00007FF646ADB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248346388.00007FF646AF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2248420949.00007FF646AF9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff646ab0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                          • String ID: :
                                                                                                                                                                                                          • API String ID: 2595371189-336475711
                                                                                                                                                                                                          • Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
                                                                                                                                                                                                          • Instruction ID: 9151ae9870f228d7b05f5a075ce259a5260c193ca323c73bcf92ff579b76113a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3D01676291CE0785FB60BF60A46627EA3A0FF44744F840135D95DC6695DF3EE5848B34
                                                                                                                                                                                                          Function 00007FF8A7FF4480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • the type '%s%s' is a function type, not a pointer-to-function type, xrefs: 00007FF8A7FF44A4
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DeallocErr_Format
                                                                                                                                                                                                          • String ID: the type '%s%s' is a function type, not a pointer-to-function type
                                                                                                                                                                                                          • API String ID: 186121651-1909832095
                                                                                                                                                                                                          • Opcode ID: 64ab044391dccdbd6a1c55b012bd2c3716ff9c8927066ae23d857c7a5b707b1b
                                                                                                                                                                                                          • Instruction ID: ec4b1d39e5d93f04dec573d6ab194fc2ed3e9348ea56536e28a756920d5e6a36
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 64ab044391dccdbd6a1c55b012bd2c3716ff9c8927066ae23d857c7a5b707b1b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 25011A22E0AA82A1EF509F75E5852BC23A1FF44B94F498031CA1D06695EF7CE2A9D350
                                                                                                                                                                                                          Function 00007FF8A7FE9C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _PyObject_GC_NewVar.PYTHON312 ref: 00007FF8A7FE9C52
                                                                                                                                                                                                          • PyObject_GC_Track.PYTHON312 ref: 00007FF8A7FE9C75
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FE9460: PyBytes_FromStringAndSize.PYTHON312(?,?,?,00007FF8A7FE9BAB), ref: 00007FF8A7FE9486
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FE9460: memcpy.VCRUNTIME140(?,?,?,00007FF8A7FE9BAB), ref: 00007FF8A7FE94A2
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FE9460: PyDict_GetItem.PYTHON312(?,?,?,00007FF8A7FE9BAB), ref: 00007FF8A7FE94B1
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FE9460: _Py_Dealloc.PYTHON312(?,?,?,00007FF8A7FE9BAB), ref: 00007FF8A7FE94CD
                                                                                                                                                                                                            • Part of subcall function 00007FF8A7FE9460: _Py_Dealloc.PYTHON312(?,?,?,00007FF8A7FE9BAB), ref: 00007FF8A7FE94EA
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DeallocObject_$Bytes_Dict_FromItemSizeStringTrackmemcpy
                                                                                                                                                                                                          • String ID: void
                                                                                                                                                                                                          • API String ID: 2546078241-3531332078
                                                                                                                                                                                                          • Opcode ID: 4c094f274a6ea7267a5ac3d88bf51addd8cd5ffdee27056a3ad5142d784a6b84
                                                                                                                                                                                                          • Instruction ID: 063b1dba0e845770ccb15fd8823398f4f44bb8d9e29856b68e10cfd4a1dd5d8e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4c094f274a6ea7267a5ac3d88bf51addd8cd5ffdee27056a3ad5142d784a6b84
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 68019E72A0AB5196EB408F35E84022C37E0FB08BA8F040234CA6D463C4EF7CD194DB10
                                                                                                                                                                                                          Function 00007FF8A7FE3330 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: write_raw_integer_data$write_raw_integer_data: bad integer size
                                                                                                                                                                                                          • API String ID: 0-2904179195
                                                                                                                                                                                                          • Opcode ID: 788fb9f4567cdc27bf4120c71a56f576d2c2369954c6e97c64edf891cec12b5b
                                                                                                                                                                                                          • Instruction ID: 13872a198e00949e7f5126e30d7632bd71c35d164bc64e8b49a0695f7d51cebe
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 788fb9f4567cdc27bf4120c71a56f576d2c2369954c6e97c64edf891cec12b5b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C7E06575E1B112FDDE255F35C85582C3264EF59794FE44470C20C05A54ED9EA29FAB00
                                                                                                                                                                                                          Function 00007FF8A7FE3380 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: read_raw_float_data$read_raw_float_data: bad float size
                                                                                                                                                                                                          • API String ID: 0-3717373606
                                                                                                                                                                                                          • Opcode ID: dc5a5fbde97426e1895f415c3e0f2b016b9a9dc5067fe02518ca64e991821a09
                                                                                                                                                                                                          • Instruction ID: 50d6ac894721b466d7789d9b3191a386a5394a274bb1fd373cd47cbb308fb4a5
                                                                                                                                                                                                          • Opcode Fuzzy Hash: dc5a5fbde97426e1895f415c3e0f2b016b9a9dc5067fe02518ca64e991821a09
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 25E06571E0A906AAE640CF39E49042C7364FF89784F604131D24D12628EF2CD689DB00
                                                                                                                                                                                                          Function 00007FF8A7FE2D70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_ItemStringTuple_
                                                                                                                                                                                                          • String ID: result
                                                                                                                                                                                                          • API String ID: 2162364271-325763347
                                                                                                                                                                                                          • Opcode ID: 4cec6cef12b53bdbeb5f8dc1b09f4298dac28b4045d4d1e57bcfb86b228623e1
                                                                                                                                                                                                          • Instruction ID: 191648ca60278413168e1bafe61e5c955becdb6a4f4326f87a1aa3881244e9e8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4cec6cef12b53bdbeb5f8dc1b09f4298dac28b4045d4d1e57bcfb86b228623e1
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D6F0C032A0650296EB159F25C85527C23A0FF88B84FD44035C60D47360EEADE65AE700
                                                                                                                                                                                                          Function 00007FF8A7FE2E10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_ItemStringTuple_
                                                                                                                                                                                                          • String ID: abi
                                                                                                                                                                                                          • API String ID: 2162364271-3589384412
                                                                                                                                                                                                          • Opcode ID: 619fa9de396bd3482c321f948884e66e22dfe0a9027d5e8740db5fa946ded6da
                                                                                                                                                                                                          • Instruction ID: b9fdabbd2b432bfbb96bff1d3210c30da405fbd8cf841c9ed2c60e2b53ebce06
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 619fa9de396bd3482c321f948884e66e22dfe0a9027d5e8740db5fa946ded6da
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 35E0C932A4691292EB199F35C8A517C33A0FFCCB85F884035C60D4A360EEBCE65BE704
                                                                                                                                                                                                          Function 00007FF8A7FEE570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Arg_Err_NoneParseSizeTuple_
                                                                                                                                                                                                          • String ID: i:_testfunc
                                                                                                                                                                                                          • API String ID: 3294110026-2179347680
                                                                                                                                                                                                          • Opcode ID: 1f52de62a1cd60aaddd131ee0ce51f825f6e8d6aaecd181c1331260fdbbf3fd6
                                                                                                                                                                                                          • Instruction ID: 497ad4513bc5c265fa6f82d2e3cd3e275a88c794bead370c5c92889e8a80550c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1f52de62a1cd60aaddd131ee0ce51f825f6e8d6aaecd181c1331260fdbbf3fd6
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3EF0E562B0E542E1EB049F65E89017C23A1FF84BC5F945435D60D47664DE6CD689D700
                                                                                                                                                                                                          Function 00007FF8A7FE33D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: write_raw_float_data$write_raw_float_data: bad float size
                                                                                                                                                                                                          • API String ID: 0-3509257061
                                                                                                                                                                                                          • Opcode ID: 038a4621818376051a9cc1456757b0f6d31ce2c7002fac2137a316bc100ea136
                                                                                                                                                                                                          • Instruction ID: 01bbc17c63693119da38333b5808dd3fb2010989f0ef80ba0dccf190ef26f895
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 038a4621818376051a9cc1456757b0f6d31ce2c7002fac2137a316bc100ea136
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 32E08674E17A06B5D9659F37DC914782221EF66780FA44731C20C15414FE5D62DAB700
                                                                                                                                                                                                          Function 00007FF8A7FE2E60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_ItemStringTuple_
                                                                                                                                                                                                          • String ID: elements
                                                                                                                                                                                                          • API String ID: 2162364271-1145702237
                                                                                                                                                                                                          • Opcode ID: ac0cd38b110f2b26480fc63e173de6174b40e1c81e00c27d14ea549e116ff3b2
                                                                                                                                                                                                          • Instruction ID: 1000b196df8c73c4e2a61d315b1f46914f0defe4f1fa7d76977280437e7c45fb
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ac0cd38b110f2b26480fc63e173de6174b40e1c81e00c27d14ea549e116ff3b2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 97E09266B0BA1391EB049F35D85527C23E1FF88B95F944035C90D46360EFADE69BE701
                                                                                                                                                                                                          Function 00007FF8A7FE2EB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_ItemStringTuple_
                                                                                                                                                                                                          • String ID: relements
                                                                                                                                                                                                          • API String ID: 2162364271-422848457
                                                                                                                                                                                                          • Opcode ID: 63a911fc31dd61c34cbd01cd92c7998490e3c19749229aff379a075a4898c19c
                                                                                                                                                                                                          • Instruction ID: 18b9ec9870072e13274d97e4489ffb9e67ae559e039e47e90385db6d41430852
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 63a911fc31dd61c34cbd01cd92c7998490e3c19749229aff379a075a4898c19c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 32E0ED26A0BA1291EA049F35D85513C23A0FF8CB84F444035C90D4A260EEACE69BE700
                                                                                                                                                                                                          Function 00007FF8A7FE26A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 12sleepwindowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000002.00000002.2249603453.00007FF8A7FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 00007FF8A7FE0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249578233.00007FF8A7FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249634454.00007FF8A7FFC000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249660754.00007FF8A8009000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000002.00000002.2249686478.00007FF8A800F000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff8a7fe0000_qhos.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSleep
                                                                                                                                                                                                          • String ID: Python-CFFI error
                                                                                                                                                                                                          • API String ID: 578018706-1839111994
                                                                                                                                                                                                          • Opcode ID: ede8aa22deb80eaa6ab3546a15dcbbc0ec76f4b222b413cb8c77dff3dd07da66
                                                                                                                                                                                                          • Instruction ID: 05a19aaa399aaaaa122bd3a3602fe036f871457c9f6a98c5bb67b15fa8602e28
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ede8aa22deb80eaa6ab3546a15dcbbc0ec76f4b222b413cb8c77dff3dd07da66
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FBD05EB5E0AA16A1FB046F31FC057A82270EB087C5F801837C40DA32A0CFBC929EE300