Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
54Oa5PcvK1.exe

Overview

General Information

Sample name:54Oa5PcvK1.exe
renamed because original name is a hash value
Original sample name:150bd33eb83e01bd26e6ea50fb7e1058e57855f8c50753f8a3b7401d712b8351.exe
Analysis ID:1577418
MD5:7779f97c3a704491e0b217ef536d225a
SHA1:9f5943b644c8e694b3cb6296a450de5be369dcb9
SHA256:150bd33eb83e01bd26e6ea50fb7e1058e57855f8c50753f8a3b7401d712b8351
Tags:107-148-62-100exeuser-JAMESWT_MHT
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Found pyInstaller with non standard icon
Tries to harvest and steal browser information (history, passwords, etc)
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Classification

Process Tree

  • System is w10x64
  • 54Oa5PcvK1.exe (PID: 6756 cmdline: "C:\Users\user\Desktop\54Oa5PcvK1.exe" MD5: 7779F97C3A704491E0B217EF536D225A)
    • conhost.exe (PID: 6724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • 54Oa5PcvK1.exe (PID: 5216 cmdline: "C:\Users\user\Desktop\54Oa5PcvK1.exe" MD5: 7779F97C3A704491E0B217EF536D225A)
      • cmd.exe (PID: 5236 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: 54Oa5PcvK1.exeReversingLabs: Detection: 28%
Source: 54Oa5PcvK1.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: k1k2k3X9_62_PENTANOMIALp.otherp.onBasisp.tpBasisp.ppBasismX9_62_CHARACTERISTIC_TWOp.primep.char_twofieldTypeX9_62_FIELDIDX9_62_CURVEfieldIDcurvebaseECPARAMETERSvalue.named_curvevalue.parametersvalue.implicitlyCAECPKPARAMETERSprivateKeyparameterspublicKeyEC_PRIVATEKEYec_asn1_group2fieldidcrypto\ec\ec_asn1.cec_asn1_group2curveEC_GROUP_get_ecparametersEC_GROUP_get_ecpkparametersEC_GROUP_new_from_ecparametersEC_GROUP_new_from_ecpkparametersi2d_ECPKParametersd2i_ECPrivateKeyi2d_ECPrivateKeyi2d_ECParametersd2i_ECParameterso2i_ECPublicKeyi2o_ECPublicKeycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Tue Sep 3 19:22:24 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: 54Oa5PcvK1.exe, 00000002.00000002.1914321964.00007FFDFA9C7000.00000002.00000001.01000000.0000001F.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: 54Oa5PcvK1.exe, 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: 54Oa5PcvK1.exe, 00000002.00000002.1916121808.00007FFDFB111000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: cryptography_rust.pdbc source: 54Oa5PcvK1.exe, 00000002.00000002.1914321964.00007FFDFA9C7000.00000002.00000001.01000000.0000001F.sdmp
Source: Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\buffer\buffer.cBUF_MEM_growBUF_MEM_grow_cleancompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap` source: 54Oa5PcvK1.exe, 00000002.00000002.1914321964.00007FFDFA9C7000.00000002.00000001.01000000.0000001F.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: 54Oa5PcvK1.exe, 00000002.00000002.1916121808.00007FFDFB079000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: 54Oa5PcvK1.exe, 00000002.00000002.1913568145.00007FFDFA3DC000.00000002.00000001.01000000.00000022.sdmp
Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: 54Oa5PcvK1.exe, 00000002.00000002.1916121808.00007FFDFB111000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: cryptography_rust.pdb source: 54Oa5PcvK1.exe, 00000002.00000002.1914321964.00007FFDFA9C7000.00000002.00000001.01000000.0000001F.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: 54Oa5PcvK1.exe, 00000002.00000002.1897937515.0000014E9A370000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: 54Oa5PcvK1.exe, 00000002.00000002.1914321964.00007FFDFA9C7000.00000002.00000001.01000000.0000001F.sdmp
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF7887769E0 FindFirstFileExW,FindClose,0_2_00007FF7887769E0
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF788786878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF788786878
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF788786878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF788786878
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF788790A34 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF788790A34
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF788786878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,2_2_00007FF788786878
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF7887769E0 FindFirstFileExW,FindClose,2_2_00007FF7887769E0
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF788790A34 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,2_2_00007FF788790A34
Source: unknownDNS traffic detected: query: ssh.0523qyfw.com replaycode: Name error (3)
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: ssh.0523qyfw.com
Source: 54Oa5PcvK1.exe, 00000002.00000002.1908369809.0000014E9DDE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
Source: 54Oa5PcvK1.exe, 00000002.00000002.1907799326.0000014E9D9E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://aka.ms/vcpython27
Source: 54Oa5PcvK1.exe, 00000002.00000003.1852623806.0000014E9C7B9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1873917067.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865545609.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853200890.0000014E9D1C7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1880949550.0000014E9D2E6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853692270.0000014E9D18A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1866219661.0000014E9D6DD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1888734287.0000014E9D2E9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1907273070.0000014E9D6DF000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863644545.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1889443843.0000014E9D6DD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875972947.0000014E9D2FA000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1876161672.0000014E9D1AD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863115442.0000014E9D5A4000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1889741215.0000014E9D2F2000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1886446854.0000014E9D6DD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1906653844.0000014E9D5CE000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1885346946.0000014E9D1DB000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863017558.0000014E9D6D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: 54Oa5PcvK1.exe, 00000002.00000002.1909500839.0000014E9DF50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://bugs.python.org/issue23606)
Source: 54Oa5PcvK1.exe, 00000002.00000002.1910595406.0000014E9E038000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cffi.readthedocs.io/en/latest/cdef.html#ffi-cdef-limitations
Source: 54Oa5PcvK1.exe, 00000002.00000003.1852623806.0000014E9C7B9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1854227501.0000014E9D14A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860841559.0000014E9C4F0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864590621.0000014E9C810000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1866654711.0000014E9D14C000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853781333.0000014E9D144000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1811292233.0000014E9C509000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1861187734.0000014E9C4F6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853847851.0000014E9C4EE000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862082830.0000014E9C50D000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1866886822.0000014E9C516000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: 54Oa5PcvK1.exe, 00000002.00000003.1870571831.0000014E9C5F8000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1816611807.0000014E9C5EC000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862706433.0000014E9C5EE000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1813483068.0000014E9C5CF000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1873186372.0000014E9C5FA000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1811920179.0000014E9C5C0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1810919273.0000014E9C65A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577916/
Source: 54Oa5PcvK1.exe, 00000002.00000002.1905274470.0000014E9D300000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1888734287.0000014E9D2FD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875972947.0000014E9D2FA000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1889741215.0000014E9D300000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: 54Oa5PcvK1.exe, 00000002.00000003.1875170154.0000014E9D21E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853200890.0000014E9D1C7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858675566.0000014E9A7D0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1893478553.0000014E9A7F5000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1861902157.0000014E9A7E0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1899525494.0000014E9A7F5000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860901451.0000014E9A7D0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863462473.0000014E9A7F0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1866956762.0000014E9A7F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: 54Oa5PcvK1.exe, 00000002.00000003.1880949550.0000014E9D2E6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862831881.0000014E9D527000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1888734287.0000014E9D2E9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864820472.0000014E9D538000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1887224183.0000014E9D2E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: 54Oa5PcvK1.exe, 00000002.00000003.1862831881.0000014E9D527000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864820472.0000014E9D538000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlH$
Source: 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlB
Source: 54Oa5PcvK1.exe, 00000002.00000002.1905274470.0000014E9D300000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1888734287.0000014E9D2FD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875972947.0000014E9D2FA000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1889741215.0000014E9D300000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crld
Source: 54Oa5PcvK1.exe, 00000002.00000003.1890109806.0000014E9D50A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863298445.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1895072068.0000014E9D526000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: 54Oa5PcvK1.exe, 00000002.00000003.1876009699.0000014E9D364000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860216079.0000014E9D35E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1891028384.0000014E9D365000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1871310960.0000014E9D363000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: 54Oa5PcvK1.exe, 00000002.00000003.1890109806.0000014E9D50A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863298445.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1895072068.0000014E9D526000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crlK?(O
Source: 54Oa5PcvK1.exe, 00000002.00000003.1862831881.0000014E9D527000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: 54Oa5PcvK1.exe, 00000002.00000003.1876009699.0000014E9D364000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860216079.0000014E9D35E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1891028384.0000014E9D365000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1871310960.0000014E9D363000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: 54Oa5PcvK1.exe, 00000002.00000003.1862831881.0000014E9D527000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl#
Source: 54Oa5PcvK1.exe, 00000002.00000003.1875170154.0000014E9D21E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853200890.0000014E9D1C7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: 54Oa5PcvK1.exe, 00000002.00000003.1862831881.0000014E9D527000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crlA
Source: 54Oa5PcvK1.exe, 00000002.00000003.1880949550.0000014E9D2E6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1888734287.0000014E9D2E9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875972947.0000014E9D2FA000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1889741215.0000014E9D2F2000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1887224183.0000014E9D2E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: 54Oa5PcvK1.exe, 00000002.00000003.1852623806.0000014E9C7B9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853200890.0000014E9D1C7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1885346946.0000014E9D1DB000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1888570375.0000014E9C854000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1878269326.0000014E9D1DB000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875670444.0000014E9D1D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: 54Oa5PcvK1.exe, 00000002.00000003.1863115442.0000014E9D5A4000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1906653844.0000014E9D5CE000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863722379.0000014E9D5CA000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863195807.0000014E9D5B7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1889287299.0000014E9D7C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: 54Oa5PcvK1.exe, 00000002.00000002.1910595406.0000014E9DFE0000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1880949550.0000014E9D2E6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D3F6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1890503693.0000014E9D3F6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1890148299.0000014E9D616000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1908369809.0000014E9DDE0000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1888734287.0000014E9D2E9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1893623590.0000014E9D3F6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1866747958.0000014E9D5BD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863115442.0000014E9D5A4000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1889741215.0000014E9D2F2000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1906617128.0000014E9D5BF000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1909500839.0000014E9DF50000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D3F6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1886217826.0000014E9D615000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1908219521.0000014E9DCE0000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1905649488.0000014E9D3F6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863195807.0000014E9D5B7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1912162059.0000014E9E0E0000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: 54Oa5PcvK1.exe, 00000002.00000002.1908369809.0000014E9DDE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: 54Oa5PcvK1.exe, 00000002.00000002.1908076763.0000014E9DBE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: 54Oa5PcvK1.exe, 00000002.00000002.1908076763.0000014E9DBE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: 54Oa5PcvK1.exe, 00000002.00000002.1907932601.0000014E9DAE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: 54Oa5PcvK1.exe, 00000002.00000002.1903341157.0000014E9C9F0000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1904289849.0000014E9CEE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: 54Oa5PcvK1.exe, 00000002.00000003.1872084143.0000014E9D167000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852568956.0000014E9D153000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865853165.0000014E9D167000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1893310173.0000014E9D168000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/unittest.html
Source: 54Oa5PcvK1.exe, 00000002.00000002.1903341157.0000014E9C9F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/ActiveState/appdirs
Source: 54Oa5PcvK1.exe, 00000002.00000002.1905095096.0000014E9D293000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1886368793.0000014E9D292000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D265000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858252843.0000014E9D276000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
Source: 54Oa5PcvK1.exe, 00000002.00000003.1880543005.0000014E9D29A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1905130914.0000014E9D29F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D265000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858252843.0000014E9D276000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
Source: 54Oa5PcvK1.exe, 00000002.00000003.1852623806.0000014E9C7B9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863567043.0000014E9C878000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863928662.0000014E9D319000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: 54Oa5PcvK1.exe, 00000002.00000003.1889517854.0000014E9D55A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865696349.0000014E9D552000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es
Source: 54Oa5PcvK1.exe, 00000002.00000003.1889517854.0000014E9D560000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864479647.0000014E9D55F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1906320899.0000014E9D560000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es0
Source: 54Oa5PcvK1.exe, 00000002.00000002.1903341157.0000014E9C9F0000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1903198908.0000014E9C8F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: 54Oa5PcvK1.exe, 00000002.00000003.1864820472.0000014E9D538000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
Source: 54Oa5PcvK1.exe, 00000002.00000003.1862831881.0000014E9D527000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864820472.0000014E9D538000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/O$
Source: 54Oa5PcvK1.exeString found in binary or memory: http://schemas.micr
Source: 54Oa5PcvK1.exe, 00000002.00000002.1904289849.0000014E9CEE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/questions/19622133/
Source: 54Oa5PcvK1.exe, 00000002.00000003.1853515667.0000014E9D3AC000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860347372.0000014E9D401000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1890503693.0000014E9D3C7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863264579.0000014E9D3AC000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D3F6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D405000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: 54Oa5PcvK1.exe, 00000002.00000002.1912566111.0000014E9E220000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1872432884.0000014E9D6CB000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859025617.0000014E9D6CA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: 54Oa5PcvK1.exe, 00000002.00000003.1853200890.0000014E9D1C7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1878269326.0000014E9D1CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: 54Oa5PcvK1.exe, 00000002.00000002.1908369809.0000014E9DDE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: 54Oa5PcvK1.exe, 00000002.00000003.1866219661.0000014E9D6D1000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852724640.0000014E9D738000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1872993264.0000014E9D73F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1854847463.0000014E9D6D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: 54Oa5PcvK1.exe, 00000002.00000003.1889517854.0000014E9D560000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1889517854.0000014E9D55A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865696349.0000014E9D552000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864479647.0000014E9D55F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1906320899.0000014E9D560000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: 54Oa5PcvK1.exe, 00000002.00000003.1890109806.0000014E9D50A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863298445.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1906166312.0000014E9D518000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1896550045.0000014E9D516000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: 54Oa5PcvK1.exe, 00000002.00000003.1889517854.0000014E9D560000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864479647.0000014E9D55F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1906320899.0000014E9D560000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: 54Oa5PcvK1.exe, 00000002.00000003.1889517854.0000014E9D560000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864479647.0000014E9D55F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1906320899.0000014E9D560000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: 54Oa5PcvK1.exe, 00000002.00000003.1889517854.0000014E9D560000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864479647.0000014E9D55F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1906320899.0000014E9D560000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
Source: 54Oa5PcvK1.exe, 00000002.00000002.1903198908.0000014E9C8F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: 54Oa5PcvK1.exe, 00000002.00000003.1873917067.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865545609.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853692270.0000014E9D18A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863644545.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1876161672.0000014E9D1AD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1881118801.0000014E9D1B3000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: 54Oa5PcvK1.exe, 00000002.00000003.1808235992.0000014E9C5D3000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1809151431.0000014E9C5E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: 54Oa5PcvK1.exe, 00000002.00000003.1873917067.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865545609.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853692270.0000014E9D18A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1866219661.0000014E9D6DD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1907273070.0000014E9D6DF000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863644545.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1889443843.0000014E9D6DD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1876161672.0000014E9D1AD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1886446854.0000014E9D6DD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863017558.0000014E9D6D6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1854847463.0000014E9D6D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: 54Oa5PcvK1.exe, 00000002.00000002.1910595406.0000014E9E038000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.dabeaz.com/ply)
Source: 54Oa5PcvK1.exe, 00000002.00000003.1890260960.0000014E9D665000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1907136780.0000014E9D669000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.dabeaz.com/ply)F
Source: 54Oa5PcvK1.exe, 00000002.00000003.1852623806.0000014E9C7B9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1861816344.0000014E9C881000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863115442.0000014E9D5A4000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1871001126.0000014E9C886000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1906568571.0000014E9D5AA000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1867253506.0000014E9C882000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1903076365.0000014E9C897000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
Source: 54Oa5PcvK1.exe, 00000002.00000003.1860841559.0000014E9C4F0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1861187734.0000014E9C4F6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1888694158.0000014E9C51D000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853847851.0000014E9C4EE000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862082830.0000014E9C50D000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1896587599.0000014E9C523000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1866886822.0000014E9C516000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1874209287.0000014E9C51C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: 54Oa5PcvK1.exe, 00000002.00000003.1808235992.0000014E9C5D3000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1808285799.0000014E9AA89000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1809151431.0000014E9C5E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: 54Oa5PcvK1.exe, 00000002.00000003.1808235992.0000014E9C5D3000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1809151431.0000014E9C5E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: 54Oa5PcvK1.exe, 00000002.00000003.1890109806.0000014E9D50A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863298445.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1906166312.0000014E9D518000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1896550045.0000014E9D516000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps
Source: 54Oa5PcvK1.exe, 00000002.00000003.1853200890.0000014E9D1C7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1878269326.0000014E9D1CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
Source: 54Oa5PcvK1.exe, 00000002.00000003.1890109806.0000014E9D50A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863298445.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1906166312.0000014E9D518000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1896550045.0000014E9D516000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cpsQ
Source: 54Oa5PcvK1.exe, 00000002.00000003.1866219661.0000014E9D6D1000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852724640.0000014E9D738000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1872993264.0000014E9D73F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1854847463.0000014E9D6D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: 54Oa5PcvK1.exe, 00000002.00000003.1890431238.0000014E9D1A3000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1873917067.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865545609.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853692270.0000014E9D18A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863644545.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1890577290.0000014E9D1A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: 54Oa5PcvK1.exe, 00000002.00000003.1860216079.0000014E9D35E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875420977.0000014E9D35E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1896410972.0000014E9D35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
Source: 54Oa5PcvK1.exe, 00000002.00000002.1904289849.0000014E9CEE0000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1903819690.0000014E9CC10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue44497.
Source: 54Oa5PcvK1.exe, 00000002.00000002.1914321964.00007FFDFA9C7000.00000002.00000001.01000000.0000001F.sdmpString found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: 54Oa5PcvK1.exe, 00000002.00000003.1866360260.0000014E9AAEB000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1811024381.0000014E9AAF3000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860593059.0000014E9AAE8000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1869127788.0000014E9AAF5000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1814471372.0000014E9AA89000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1809807777.0000014E9AAF3000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853924980.0000014E9AA89000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859294660.0000014E9AA89000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1870867611.0000014E9AAFA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: 54Oa5PcvK1.exe, 00000002.00000003.1860841559.0000014E9C4F0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1895891104.0000014E9C4F5000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853847851.0000014E9C4EE000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875390775.0000014E9C4F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: 54Oa5PcvK1.exe, 00000002.00000003.1862135699.0000014E9AABA000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1866360260.0000014E9AAE1000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853924980.0000014E9AA89000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859294660.0000014E9AA89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html
Source: 54Oa5PcvK1.exe, 00000002.00000003.1862135699.0000014E9AABA000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1866360260.0000014E9AAE1000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853924980.0000014E9AA89000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859294660.0000014E9AA89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html#pprint.pprint
Source: 54Oa5PcvK1.exe, 00000002.00000002.1902596491.0000014E9C704000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1854590119.0000014E9C6A9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859208920.0000014E9A98C000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864133086.0000014E9C6C0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1895552211.0000014E9A98F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858675566.0000014E9A7D0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859570149.0000014E9C6BF000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1866777303.0000014E9A7D0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860901451.0000014E9A7D0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1872793967.0000014E9C6F4000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1869946544.0000014E9C6D1000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860593059.0000014E9AAE8000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1900060979.0000014E9A98F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1904289849.0000014E9CEE0000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1816611807.0000014E9C6A9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864652551.0000014E9A7D0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1870819223.0000014E9A98E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865013694.0000014E9A98D000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853924980.0000014E9AA89000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1903819690.0000014E9CC10000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1868207183.0000014E9C6C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html
Source: 54Oa5PcvK1.exe, 00000002.00000002.1903561006.0000014E9CB00000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1904289849.0000014E9CEE0000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1816405751.0000014E9D0E1000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1816405751.0000014E9D139000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html#re.sub
Source: 54Oa5PcvK1.exe, 00000002.00000002.1907932601.0000014E9DAE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: 54Oa5PcvK1.exe, 00000002.00000002.1903561006.0000014E9CB00000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1904451164.0000014E9CFE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: 54Oa5PcvK1.exe, 00000002.00000003.1860216079.0000014E9D35E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1871310960.0000014E9D363000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: 54Oa5PcvK1.exe, 00000002.00000002.1899076898.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858902955.0000014E9A733000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1867143009.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860523938.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1898176407.0000014E9A700000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1798235570.0000014E9A779000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1796228223.0000014E9A741000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859447132.0000014E9A787000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1892110731.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858979814.0000014E9A769000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1796543016.0000014E9A761000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1796949117.0000014E9A772000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864218112.0000014E9A788000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: 54Oa5PcvK1.exe, 00000002.00000002.1903341157.0000014E9C9F0000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1904451164.0000014E9CFE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: 54Oa5PcvK1.exe, 00000002.00000002.1909500839.0000014E9DF50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/psf/requests/pull/6710
Source: 54Oa5PcvK1.exe, 00000002.00000002.1914321964.00007FFDFA9C7000.00000002.00000001.01000000.0000001F.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues
Source: 54Oa5PcvK1.exe, 00000002.00000002.1914321964.00007FFDFA9C7000.00000002.00000001.01000000.0000001F.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues/8996
Source: 54Oa5PcvK1.exe, 00000002.00000002.1914321964.00007FFDFA9C7000.00000002.00000001.01000000.0000001F.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues/9253
Source: 54Oa5PcvK1.exe, 00000002.00000002.1903561006.0000014E9CB00000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1904289849.0000014E9CEE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packaging
Source: 54Oa5PcvK1.exe, 00000002.00000002.1903561006.0000014E9CB00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: 54Oa5PcvK1.exe, 00000002.00000002.1901264108.0000014E9C3D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: 54Oa5PcvK1.exe, 00000002.00000003.1816611807.0000014E9C6A9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyparsing/pyparsing/wiki
Source: 54Oa5PcvK1.exe, 00000002.00000002.1897780269.0000014E9A2F8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: 54Oa5PcvK1.exe, 00000002.00000003.1864218112.0000014E9A788000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: 54Oa5PcvK1.exe, 00000002.00000002.1899076898.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858902955.0000014E9A733000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1867143009.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860523938.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1898176407.0000014E9A700000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1798235570.0000014E9A779000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1796228223.0000014E9A741000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859447132.0000014E9A787000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1892110731.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858979814.0000014E9A769000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1796543016.0000014E9A761000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1796949117.0000014E9A772000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864218112.0000014E9A788000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: 54Oa5PcvK1.exe, 00000002.00000003.1806002599.0000014E9AA05000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1876072137.0000014E9AA2F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859377252.0000014E9A9F1000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1809807777.0000014E9AA05000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1808505883.0000014E9AA05000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1814635111.0000014E9A9FF000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1861933634.0000014E9AA2E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1876360918.0000014E9AA3F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1811024381.0000014E9AA05000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858446761.0000014E9A9EE000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860125534.0000014E9A9F2000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853924980.0000014E9A9EC000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1807487599.0000014E9AA05000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1807763706.0000014E9A9E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: 54Oa5PcvK1.exe, 00000002.00000002.1899076898.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858902955.0000014E9A733000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1867143009.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860523938.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1898176407.0000014E9A700000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1798235570.0000014E9A779000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1796228223.0000014E9A741000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859447132.0000014E9A787000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1892110731.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858979814.0000014E9A769000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1796543016.0000014E9A761000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1796949117.0000014E9A772000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864218112.0000014E9A788000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: 54Oa5PcvK1.exe, 00000002.00000002.1907932601.0000014E9DAE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: 54Oa5PcvK1.exe, 00000002.00000002.1908219521.0000014E9DCE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: 54Oa5PcvK1.exe, 00000002.00000002.1908219521.0000014E9DCE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920v
Source: 54Oa5PcvK1.exe, 00000002.00000002.1908369809.0000014E9DDE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: 54Oa5PcvK1.exe, 00000002.00000003.1873917067.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1869030319.0000014E9AA5F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853739475.0000014E9D180000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865545609.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860216079.0000014E9D35E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853692270.0000014E9D18A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859802176.0000014E9D184000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1879378094.0000014E9AA61000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863644545.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863800025.0000014E9AA5F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865545609.0000014E9D184000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863484959.0000014E9D184000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1904744322.0000014E9D184000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1861794497.0000014E9AA5E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860630937.0000014E9AA56000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853924980.0000014E9A9EC000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1854244947.0000014E9AA51000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1871310960.0000014E9D363000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
Source: 54Oa5PcvK1.exe, 00000002.00000003.1873917067.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853739475.0000014E9D180000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865545609.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853692270.0000014E9D18A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859802176.0000014E9D184000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863644545.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865545609.0000014E9D184000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863484959.0000014E9D184000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1904744322.0000014E9D184000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
Source: 54Oa5PcvK1.exe, 00000002.00000003.1887224183.0000014E9D2E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
Source: 54Oa5PcvK1.exe, 00000002.00000002.1905274470.0000014E9D300000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1888734287.0000014E9D2FD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875972947.0000014E9D2FA000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1889741215.0000014E9D300000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: 54Oa5PcvK1.exe, 00000002.00000003.1871310960.0000014E9D363000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
Source: 54Oa5PcvK1.exe, 00000002.00000002.1908219521.0000014E9DCE0000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1905649488.0000014E9D3F6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1891028384.0000014E9D365000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D3CF000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1887224183.0000014E9D2E9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1871310960.0000014E9D363000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
Source: 54Oa5PcvK1.exe, 00000002.00000003.1853200890.0000014E9D1C7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875670444.0000014E9D1D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
Source: 54Oa5PcvK1.exe, 00000002.00000002.1901264108.0000014E9C3D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: 54Oa5PcvK1.exe, 00000002.00000002.1904656791.0000014E9D139000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
Source: 54Oa5PcvK1.exe, 00000002.00000003.1896789568.0000014E9D40A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860347372.0000014E9D401000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D3F6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1905649488.0000014E9D40B000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D405000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
Source: 54Oa5PcvK1.exe, 00000002.00000003.1858949459.0000014E9A70A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1880733317.0000014E9A710000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853461840.0000014E9D6E5000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1861135005.0000014E9A70B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: 54Oa5PcvK1.exe, 00000002.00000003.1887641216.0000014E9D12C000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1904617411.0000014E9D12D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/declaring-project-metadata/
Source: 54Oa5PcvK1.exe, 00000002.00000002.1904451164.0000014E9CFE0000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1903819690.0000014E9CC10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: 54Oa5PcvK1.exe, 00000002.00000002.1901128922.0000014E9C2D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0205/
Source: 54Oa5PcvK1.exe, 00000002.00000002.1903561006.0000014E9CB00000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1904451164.0000014E9CFE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: 54Oa5PcvK1.exe, 00000002.00000003.1853200890.0000014E9D1C7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875670444.0000014E9D1D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
Source: 54Oa5PcvK1.exe, 00000002.00000002.1909500839.0000014E9DF50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://scrt.95271.pw/chrome.php
Source: 54Oa5PcvK1.exe, 00000002.00000002.1909500839.0000014E9DF50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://scrt.95271.pw/chrome.php0y
Source: 54Oa5PcvK1.exe, 00000002.00000003.1807946782.0000014E9AA89000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858902955.0000014E9A733000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1808018899.0000014E9AAED000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1870468484.0000014E9A73A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1896034640.0000014E9A73B000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1807707033.0000014E9C5DF000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1892419995.0000014E9A73B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: 54Oa5PcvK1.exe, 00000002.00000002.1903819690.0000014E9CC10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-2
Source: 54Oa5PcvK1.exe, 00000002.00000002.1903819690.0000014E9CC10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-2P
Source: 54Oa5PcvK1.exe, 00000002.00000002.1912566111.0000014E9E27C000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1908219521.0000014E9DCE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ssh.0523qyfw.com/winscp
Source: 54Oa5PcvK1.exe, 00000002.00000002.1905095096.0000014E9D293000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1886368793.0000014E9D292000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D265000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858252843.0000014E9D276000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ssh.0523qyfw.com/winscpz
Source: 54Oa5PcvK1.exe, 00000002.00000002.1902596491.0000014E9C704000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1854590119.0000014E9C6A9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859208920.0000014E9A98C000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864133086.0000014E9C6C0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1895552211.0000014E9A98F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858675566.0000014E9A7D0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859570149.0000014E9C6BF000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1866777303.0000014E9A7D0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860901451.0000014E9A7D0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1872793967.0000014E9C6F4000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1869946544.0000014E9C6D1000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860593059.0000014E9AAE8000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1900060979.0000014E9A98F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1816611807.0000014E9C6A9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864652551.0000014E9A7D0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1870819223.0000014E9A98E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865013694.0000014E9A98D000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853924980.0000014E9AA89000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1868207183.0000014E9C6C0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1816405751.0000014E9D0E1000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1816405751.0000014E9D139000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular
Source: 54Oa5PcvK1.exe, 00000002.00000003.1853200890.0000014E9D1C7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1887870392.0000014E9D1E3000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1885346946.0000014E9D1DB000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1890366997.0000014E9D208000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1878269326.0000014E9D1DB000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875670444.0000014E9D1D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: 54Oa5PcvK1.exe, 00000002.00000003.1852623806.0000014E9C7B9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853200890.0000014E9D1C7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1885346946.0000014E9D1DB000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1888570375.0000014E9C854000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1878269326.0000014E9D1DB000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875670444.0000014E9D1D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: 54Oa5PcvK1.exe, 00000002.00000003.1873917067.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865545609.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853692270.0000014E9D18A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1866219661.0000014E9D6DD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1907273070.0000014E9D6DF000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863644545.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1889443843.0000014E9D6DD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1876161672.0000014E9D1AD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1886446854.0000014E9D6DD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863017558.0000014E9D6D6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1854847463.0000014E9D6D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: 54Oa5PcvK1.exe, 00000002.00000003.1869030319.0000014E9AA5F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860216079.0000014E9D35E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1879378094.0000014E9AA61000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863800025.0000014E9AA5F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1861794497.0000014E9AA5E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860630937.0000014E9AA56000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853924980.0000014E9A9EC000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1854244947.0000014E9AA51000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1871310960.0000014E9D363000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
Source: 54Oa5PcvK1.exe, 00000002.00000002.1903198908.0000014E9C8F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://upload.pypi.org/legacy/
Source: 54Oa5PcvK1.exe, 00000002.00000002.1908219521.0000014E9DCE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: 54Oa5PcvK1.exe, 00000002.00000002.1908219521.0000014E9DCE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: 54Oa5PcvK1.exe, 00000002.00000003.1858949459.0000014E9A70A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1871410302.0000014E9A718000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1861135005.0000014E9A70B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
Source: 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D3F6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1890503693.0000014E9D3F6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1893623590.0000014E9D3F6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D3F6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1905649488.0000014E9D3F6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1872432884.0000014E9D6CB000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859025617.0000014E9D6CA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: 54Oa5PcvK1.exe, 00000002.00000003.1853200890.0000014E9D1C7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875670444.0000014E9D1D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
Source: 54Oa5PcvK1.exe, 00000002.00000003.1860347372.0000014E9D401000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D3F6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D405000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
Source: 54Oa5PcvK1.exe, 00000002.00000003.1792466627.0000014E9A749000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1897780269.0000014E9A270000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1792195668.0000014E9A749000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: 54Oa5PcvK1.exe, 00000002.00000002.1905095096.0000014E9D293000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1886368793.0000014E9D292000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D265000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858252843.0000014E9D276000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/
Source: 54Oa5PcvK1.exe, 00000002.00000002.1905274470.0000014E9D300000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1888734287.0000014E9D2FD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875972947.0000014E9D2FA000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1889741215.0000014E9D300000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/~
Source: 54Oa5PcvK1.exe, 00000002.00000003.1873917067.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853739475.0000014E9D180000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865545609.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853692270.0000014E9D18A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859802176.0000014E9D184000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863644545.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865545609.0000014E9D184000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863484959.0000014E9D184000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1904744322.0000014E9D184000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF788795DEC0_2_00007FF788795DEC
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF788794EA00_2_00007FF788794EA0
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF7887758E00_2_00007FF7887758E0
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF7887868780_2_00007FF788786878
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF7887868780_2_00007FF788786878
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF7887821DC0_2_00007FF7887821DC
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF78878D1F80_2_00007FF78878D1F8
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF78879511C0_2_00007FF78879511C
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF7887801500_2_00007FF788780150
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF788782A180_2_00007FF788782A18
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF788790A340_2_00007FF788790A34
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF78879324C0_2_00007FF78879324C
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF78878FA880_2_00007FF78878FA88
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF788798BE80_2_00007FF788798BE8
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF78878132C0_2_00007FF78878132C
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF7887803540_2_00007FF788780354
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF788788D000_2_00007FF788788D00
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF7887774200_2_00007FF788777420
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF788792DB00_2_00007FF788792DB0
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF78878FA880_2_00007FF78878FA88
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF7887826140_2_00007FF788782614
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF78877FD400_2_00007FF78877FD40
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF78878CD640_2_00007FF78878CD64
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF7887805600_2_00007FF788780560
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF7887816C40_2_00007FF7887816C4
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF7887866C40_2_00007FF7887866C4
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF788784FC00_2_00007FF788784FC0
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF78877FF440_2_00007FF78877FF44
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF7887807640_2_00007FF788780764
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF7887958A00_2_00007FF7887958A0
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF7887870FC0_2_00007FF7887870FC
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF78878D8780_2_00007FF78878D878
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF788795DEC2_2_00007FF788795DEC
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF788794EA02_2_00007FF788794EA0
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF7887868782_2_00007FF788786878
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF7887821DC2_2_00007FF7887821DC
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF78878D1F82_2_00007FF78878D1F8
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF78879511C2_2_00007FF78879511C
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF7887801502_2_00007FF788780150
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF788782A182_2_00007FF788782A18
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF788790A342_2_00007FF788790A34
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF78879324C2_2_00007FF78879324C
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF78878FA882_2_00007FF78878FA88
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF788798BE82_2_00007FF788798BE8
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF78878132C2_2_00007FF78878132C
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF7887803542_2_00007FF788780354
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF788788D002_2_00007FF788788D00
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF7887774202_2_00007FF788777420
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF788792DB02_2_00007FF788792DB0
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF78878FA882_2_00007FF78878FA88
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF7887826142_2_00007FF788782614
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF78877FD402_2_00007FF78877FD40
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF78878CD642_2_00007FF78878CD64
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF7887805602_2_00007FF788780560
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF7887816C42_2_00007FF7887816C4
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF7887866C42_2_00007FF7887866C4
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF788784FC02_2_00007FF788784FC0
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF78877FF442_2_00007FF78877FF44
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF7887807642_2_00007FF788780764
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF7887958A02_2_00007FF7887958A0
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF7887758E02_2_00007FF7887758E0
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF7887870FC2_2_00007FF7887870FC
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FFDFABB18A02_2_00007FFDFABB18A0
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: String function: 00007FF788771CB0 appears 38 times
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: String function: 00007FF788771C50 appears 89 times
Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: python3.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: 54Oa5PcvK1.exeBinary or memory string: OriginalFilename vs 54Oa5PcvK1.exe
Source: 54Oa5PcvK1.exe, 00000002.00000002.1897937515.0000014E9A370000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs 54Oa5PcvK1.exe
Source: 54Oa5PcvK1.exe, 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs 54Oa5PcvK1.exe
Source: 54Oa5PcvK1.exe, 00000002.00000002.1913681479.00007FFDFA40F000.00000002.00000001.01000000.00000022.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs 54Oa5PcvK1.exe
Source: classification engineClassification label: mal56.spyw.winEXE@6/149@1/0
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF788776670 GetLastError,FormatMessageW,WideCharToMultiByte,0_2_00007FF788776670
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6724:120:WilError_03
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeMutant created: \Sessions\1\BaseNamedObjects\Global\MyUniqueProgramMutexName12345
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562Jump to behavior
Source: 54Oa5PcvK1.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: 54Oa5PcvK1.exe, 00000002.00000002.1913568145.00007FFDFA3DC000.00000002.00000001.01000000.00000022.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 54Oa5PcvK1.exe, 00000002.00000002.1913568145.00007FFDFA3DC000.00000002.00000001.01000000.00000022.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 54Oa5PcvK1.exe, 00000002.00000002.1913568145.00007FFDFA3DC000.00000002.00000001.01000000.00000022.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 54Oa5PcvK1.exe, 00000002.00000002.1913568145.00007FFDFA3DC000.00000002.00000001.01000000.00000022.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 54Oa5PcvK1.exe, 54Oa5PcvK1.exe, 00000002.00000002.1913568145.00007FFDFA3DC000.00000002.00000001.01000000.00000022.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 54Oa5PcvK1.exe, 00000002.00000002.1913568145.00007FFDFA3DC000.00000002.00000001.01000000.00000022.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 54Oa5PcvK1.exe, 00000002.00000002.1913568145.00007FFDFA3DC000.00000002.00000001.01000000.00000022.sdmpBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: 54Oa5PcvK1.exeReversingLabs: Detection: 28%
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile read: C:\Users\user\Desktop\54Oa5PcvK1.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\54Oa5PcvK1.exe "C:\Users\user\Desktop\54Oa5PcvK1.exe"
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeProcess created: C:\Users\user\Desktop\54Oa5PcvK1.exe "C:\Users\user\Desktop\54Oa5PcvK1.exe"
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeProcess created: C:\Users\user\Desktop\54Oa5PcvK1.exe "C:\Users\user\Desktop\54Oa5PcvK1.exe"Jump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: libffi-8.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: libcrypto-3.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: libssl-3.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: libcrypto-3.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: sqlite3.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeSection loaded: rasadhlp.dllJump to behavior
Source: 54Oa5PcvK1.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: 54Oa5PcvK1.exeStatic file information: File size 23470644 > 1048576
Source: 54Oa5PcvK1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 54Oa5PcvK1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 54Oa5PcvK1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 54Oa5PcvK1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 54Oa5PcvK1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 54Oa5PcvK1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: 54Oa5PcvK1.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: 54Oa5PcvK1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: k1k2k3X9_62_PENTANOMIALp.otherp.onBasisp.tpBasisp.ppBasismX9_62_CHARACTERISTIC_TWOp.primep.char_twofieldTypeX9_62_FIELDIDX9_62_CURVEfieldIDcurvebaseECPARAMETERSvalue.named_curvevalue.parametersvalue.implicitlyCAECPKPARAMETERSprivateKeyparameterspublicKeyEC_PRIVATEKEYec_asn1_group2fieldidcrypto\ec\ec_asn1.cec_asn1_group2curveEC_GROUP_get_ecparametersEC_GROUP_get_ecpkparametersEC_GROUP_new_from_ecparametersEC_GROUP_new_from_ecpkparametersi2d_ECPKParametersd2i_ECPrivateKeyi2d_ECPrivateKeyi2d_ECParametersd2i_ECParameterso2i_ECPublicKeyi2o_ECPublicKeycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Tue Sep 3 19:22:24 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: 54Oa5PcvK1.exe, 00000002.00000002.1914321964.00007FFDFA9C7000.00000002.00000001.01000000.0000001F.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: 54Oa5PcvK1.exe, 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: 54Oa5PcvK1.exe, 00000002.00000002.1916121808.00007FFDFB111000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: cryptography_rust.pdbc source: 54Oa5PcvK1.exe, 00000002.00000002.1914321964.00007FFDFA9C7000.00000002.00000001.01000000.0000001F.sdmp
Source: Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\buffer\buffer.cBUF_MEM_growBUF_MEM_grow_cleancompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap` source: 54Oa5PcvK1.exe, 00000002.00000002.1914321964.00007FFDFA9C7000.00000002.00000001.01000000.0000001F.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: 54Oa5PcvK1.exe, 00000002.00000002.1916121808.00007FFDFB079000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: 54Oa5PcvK1.exe, 00000002.00000002.1913568145.00007FFDFA3DC000.00000002.00000001.01000000.00000022.sdmp
Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: 54Oa5PcvK1.exe, 00000002.00000002.1916121808.00007FFDFB111000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: cryptography_rust.pdb source: 54Oa5PcvK1.exe, 00000002.00000002.1914321964.00007FFDFA9C7000.00000002.00000001.01000000.0000001F.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: 54Oa5PcvK1.exe, 00000002.00000002.1897937515.0000014E9A370000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: 54Oa5PcvK1.exe, 00000002.00000002.1914321964.00007FFDFA9C7000.00000002.00000001.01000000.0000001F.sdmp
Source: 54Oa5PcvK1.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 54Oa5PcvK1.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 54Oa5PcvK1.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 54Oa5PcvK1.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 54Oa5PcvK1.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: api-ms-win-crt-multibyte-l1-1-0.dll.0.drStatic PE information: 0xC6B9A1B8 [Mon Aug 26 14:12:08 2075 UTC]
Source: 54Oa5PcvK1.exeStatic PE information: section name: _RDATA
Source: mfc140u.dll.0.drStatic PE information: section name: .didat
Source: VCRUNTIME140.dll.0.drStatic PE information: section name: fothk
Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
Source: libcrypto-3.dll.0.drStatic PE information: section name: .00cfg
Source: libssl-3.dll.0.drStatic PE information: section name: .00cfg
Source: python311.dll.0.drStatic PE information: section name: PyRuntim

Persistence and Installation Behavior

barindex
Found pyInstaller with non standard icon
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeProcess created: "C:\Users\user\Desktop\54Oa5PcvK1.exe"
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\_cffi_backend.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\win32\win32evtlog.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\PublicKey\_ed448.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\PublicKey\_ec_ws.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Util\_strxor.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\win32\_win32sysloader.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\libssl-3.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\win32\win32trace.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\pywin32_system32\pythoncom311.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\PublicKey\_ed25519.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\zstandard\backend_c.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\markupsafe\_speedups.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography\hazmat\bindings\_rust.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\_overlapped.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\VCRUNTIME140_1.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\libcrypto-3.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\pywin32_system32\pywintypes311.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-file-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\sqlite3.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Pythonwin\win32ui.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\charset_normalizer\md__mypyc.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-console-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Util\_cpuid_c.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\libffi-8.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\PublicKey\_x25519.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\_asyncio.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_keccak.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\_multiprocessing.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-file-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\_queue.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\win32\win32crypt.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\charset_normalizer\md.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\python311.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-file-l2-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_poly1305.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Math\_modexp.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\win32\win32api.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\ucrtbase.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\win32com\shell\shell.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Pythonwin\mfc140u.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-util-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\tinyaes.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\zstandard\_cffi.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\select.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Protocol\_scrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\_sqlite3.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-multibyte-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_ghash_portable.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\VCRUNTIME140.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF788772F20 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF788772F20
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\_cffi_backend.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\win32\win32evtlog.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\PublicKey\_ed448.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\PublicKey\_ec_ws.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Util\_strxor.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\win32\_win32sysloader.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\win32\win32trace.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\pywin32_system32\pythoncom311.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\PublicKey\_ed25519.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\zstandard\backend_c.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\markupsafe\_speedups.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography\hazmat\bindings\_rust.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\_overlapped.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\pywin32_system32\pywintypes311.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-file-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Pythonwin\win32ui.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\charset_normalizer\md__mypyc.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-console-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Util\_cpuid_c.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\PublicKey\_x25519.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\_asyncio.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_keccak.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\_multiprocessing.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-file-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\_queue.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\charset_normalizer\md.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\win32\win32crypt.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\python311.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-file-l2-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Math\_modexp.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_poly1305.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\win32\win32api.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\win32com\shell\shell.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Pythonwin\mfc140u.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-util-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\tinyaes.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\zstandard\_cffi.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\select.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Protocol\_scrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\_sqlite3.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-multibyte-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_ghash_portable.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-16384
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeAPI coverage: 6.5 %
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF7887769E0 FindFirstFileExW,FindClose,0_2_00007FF7887769E0
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF788786878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF788786878
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF788786878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF788786878
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF788790A34 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF788790A34
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF788786878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,2_2_00007FF788786878
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF7887769E0 FindFirstFileExW,FindClose,2_2_00007FF7887769E0
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF788790A34 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,2_2_00007FF788790A34
Source: 54Oa5PcvK1.exe, 00000002.00000003.1859208920.0000014E9A98C000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1895552211.0000014E9A98F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1808505883.0000014E9A982000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1900060979.0000014E9A98F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1870819223.0000014E9A98E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865013694.0000014E9A98D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF78877AA2C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF78877AA2C
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF788792620 GetProcessHeap,0_2_00007FF788792620
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF78877A180 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF78877A180
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF78877AA2C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF78877AA2C
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF78877ABD4 SetUnhandledExceptionFilter,0_2_00007FF78877ABD4
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF788789C44 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF788789C44
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF78877A180 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FF78877A180
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF78877AA2C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FF78877AA2C
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF78877ABD4 SetUnhandledExceptionFilter,2_2_00007FF78877ABD4
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FF788789C44 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FF788789C44
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FFDFABB2A90 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFDFABB2A90
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 2_2_00007FFDFABB3058 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFDFABB3058
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeProcess created: C:\Users\user\Desktop\54Oa5PcvK1.exe "C:\Users\user\Desktop\54Oa5PcvK1.exe"Jump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF788798A30 cpuid 0_2_00007FF788798A30
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\charset_normalizer VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography-43.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography-43.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography-43.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography-43.0.1.dist-info\license_files VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography-43.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography-43.0.1.dist-info\license_files VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pyreadline3-3.5.4.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pyreadline3-3.5.4.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pyreadline3-3.5.4.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\ucrtbase.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\tinyaes.cp311-win_amd64.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\tinyaes.cp311-win_amd64.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\tinyaes.cp311-win_amd64.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\_ctypes.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\_bz2.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\_lzma.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\_socket.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\select.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pyexpat.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\_queue.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pywin32_system32\pywintypes311.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pywin32_system32\pythoncom311.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\win32\win32api.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\win32com VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\win32com VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\win32com VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography-43.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pyreadline3-3.5.4.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography-43.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography-43.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pyreadline3-3.5.4.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pyreadline3-3.5.4.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography-43.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pyreadline3-3.5.4.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography-43.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography-43.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562\pyreadline3-3.5.4.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67562 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeQueries volume information: C:\Users\user\Desktop\54Oa5PcvK1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF78877A910 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF78877A910
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeCode function: 0_2_00007FF788794EA0 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF788794EA0

Stealing of Sensitive Information

barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
Source: C:\Users\user\Desktop\54Oa5PcvK1.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Native API		1
DLL Side-Loading		11
Process Injection		11
Process Injection		1
OS Credential Dumping		2
System Time Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory21
Security Software Discovery		Remote Desktop Protocol1
Data from Local System		1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Obfuscated Files or Information		Security Account Manager1
File and Directory Discovery		SMB/Windows Admin SharesData from Network Shared Drive1
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Timestomp		NTDS22
System Information Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
DLL Side-Loading		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1577418 Sample: 54Oa5PcvK1.exe Startdate: 18/12/2024 Architecture: WINDOWS Score: 56 27 ssh.0523qyfw.com 2->27 29 Multi AV Scanner detection for submitted file 2->29 8 54Oa5PcvK1.exe 172 2->8         started        signatures3 process4 file5 19 C:\Users\...\backend_c.cp311-win_amd64.pyd, PE32+ 8->19 dropped 21 C:\Users\user\...\_cffi.cp311-win_amd64.pyd, PE32+ 8->21 dropped 23 C:\Users\user\AppData\Local\...\shell.pyd, PE32+ 8->23 dropped 25 119 other files (none is malicious) 8->25 dropped 31 Found pyInstaller with non standard icon 8->31 12 54Oa5PcvK1.exe 10 8->12         started        15 conhost.exe 8->15         started        signatures6 process7 signatures8 33 Tries to harvest and steal browser information (history, passwords, etc) 12->33 17 cmd.exe 1 12->17         started        process9

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
54Oa5PcvK1.exe29%ReversingLabsWin32.Ransomware.Generic

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_ARC4.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_Salsa20.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_chacha20.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_pkcs1_decode.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_aes.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_aesni.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_arc2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_blowfish.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_cast.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_cbc.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_cfb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_ctr.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_des.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_des3.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_ecb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_eksblowfish.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_ocb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_ofb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_BLAKE2b.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_BLAKE2s.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_MD2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_MD4.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_MD5.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_RIPEMD160.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_SHA1.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_SHA224.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_SHA256.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_SHA384.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_SHA512.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_ghash_clmul.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_ghash_portable.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_keccak.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_poly1305.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Math\_modexp.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Protocol\_scrypt.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\PublicKey\_ec_ws.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\PublicKey\_ed25519.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\PublicKey\_ed448.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\PublicKey\_x25519.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Util\_cpuid_c.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Util\_strxor.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Pythonwin\mfc140u.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\Pythonwin\win32ui.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\VCRUNTIME140.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\VCRUNTIME140_1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\_asyncio.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\_bz2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\_cffi_backend.cp311-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\_ctypes.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\_decimal.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\_hashlib.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\_lzma.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\_multiprocessing.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\_overlapped.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\_queue.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\_socket.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\_sqlite3.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\_ssl.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-console-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-datetime-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-debug-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-errorhandling-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-file-l1-1-0.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-2P0%Avira URL Cloudsafe
http://www.dabeaz.com/ply)F0%Avira URL Cloudsafe
http://www.dabeaz.com/ply)0%Avira URL Cloudsafe
https://scrt.95271.pw/chrome.php0%Avira URL Cloudsafe
http://bugs.python.org/issue23606)0%Avira URL Cloudsafe
https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-20%Avira URL Cloudsafe
https://wwww.certigna.fr/autorites/~0%Avira URL Cloudsafe
https://scrt.95271.pw/chrome.php0y0%Avira URL Cloudsafe
http://cffi.readthedocs.io/en/latest/cdef.html#ffi-cdef-limitations0%Avira URL Cloudsafe
http://repository.swisssign.com/O$0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
ssh.0523qyfw.com
unknown
unknownfalse
    		unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf54Oa5PcvK1.exe, 00000002.00000003.1858949459.0000014E9A70A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1880733317.0000014E9A710000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853461840.0000014E9D6E5000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1861135005.0000014E9A70B000.00000004.00000020.00020000.00000000.sdmpfalse
      		high
      http://www.dabeaz.com/ply)F54Oa5PcvK1.exe, 00000002.00000003.1890260960.0000014E9D665000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1907136780.0000014E9D669000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://www.dabeaz.com/ply)54Oa5PcvK1.exe, 00000002.00000002.1910595406.0000014E9E038000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/pyca/cryptography/issues/899654Oa5PcvK1.exe, 00000002.00000002.1914321964.00007FFDFA9C7000.00000002.00000001.01000000.0000001F.sdmpfalse
        		high
        https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-2P54Oa5PcvK1.exe, 00000002.00000002.1903819690.0000014E9CC10000.00000004.00001000.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        		unknown
        http://aka.ms/vcpython2754Oa5PcvK1.exe, 00000002.00000002.1907799326.0000014E9D9E0000.00000004.00001000.00020000.00000000.sdmpfalse
          		high
          http://docs.python.org/library/unittest.html54Oa5PcvK1.exe, 00000002.00000003.1872084143.0000014E9D167000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852568956.0000014E9D153000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865853165.0000014E9D167000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1893310173.0000014E9D168000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#54Oa5PcvK1.exe, 00000002.00000002.1899076898.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858902955.0000014E9A733000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1867143009.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860523938.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1898176407.0000014E9A700000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1798235570.0000014E9A779000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1796228223.0000014E9A741000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859447132.0000014E9A787000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1892110731.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858979814.0000014E9A769000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1796543016.0000014E9A761000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1796949117.0000014E9A772000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864218112.0000014E9A788000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              http://crl.dhimyotis.com/certignarootca.crlB54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                https://tools.ietf.org/html/rfc2388#section-4.454Oa5PcvK1.exe, 00000002.00000003.1853200890.0000014E9D1C7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1887870392.0000014E9D1E3000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1885346946.0000014E9D1DB000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1890366997.0000014E9D208000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1878269326.0000014E9D1DB000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875670444.0000014E9D1D7000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base6454Oa5PcvK1.exe, 00000002.00000003.1866360260.0000014E9AAEB000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1811024381.0000014E9AAF3000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860593059.0000014E9AAE8000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1869127788.0000014E9AAF5000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1814471372.0000014E9AA89000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1809807777.0000014E9AAF3000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853924980.0000014E9AA89000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859294660.0000014E9AA89000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1870867611.0000014E9AAFA000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://github.com/pypa/packaging54Oa5PcvK1.exe, 00000002.00000002.1903561006.0000014E9CB00000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1904289849.0000014E9CEE0000.00000004.00001000.00020000.00000000.sdmpfalse
                      		high
                      http://stackoverflow.com/questions/19622133/54Oa5PcvK1.exe, 00000002.00000002.1904289849.0000014E9CEE0000.00000004.00001000.00020000.00000000.sdmpfalse
                        		high
                        https://refspecs.linuxfoundation.org/elf/gabi454Oa5PcvK1.exe, 00000002.00000002.1903561006.0000014E9CB00000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1904451164.0000014E9CFE0000.00000004.00001000.00020000.00000000.sdmpfalse
                          		high
                          http://cffi.readthedocs.io/en/latest/cdef.html#ffi-cdef-limitations54Oa5PcvK1.exe, 00000002.00000002.1910595406.0000014E9E038000.00000004.00001000.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://github.com/urllib3/urllib3/issues/2192#issuecomment-82183296354Oa5PcvK1.exe, 00000002.00000002.1907932601.0000014E9DAE0000.00000004.00001000.00020000.00000000.sdmpfalse
                            		high
                            http://docs.python.org/3/library/subprocess#subprocess.Popen.kill54Oa5PcvK1.exe, 00000002.00000002.1908076763.0000014E9DBE0000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              https://tools.ietf.org/html/rfc361054Oa5PcvK1.exe, 00000002.00000003.1852623806.0000014E9C7B9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853200890.0000014E9D1C7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1885346946.0000014E9D1DB000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1888570375.0000014E9C854000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1878269326.0000014E9D1DB000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875670444.0000014E9D1D7000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://peps.python.org/pep-0205/54Oa5PcvK1.exe, 00000002.00000002.1901128922.0000014E9C2D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		high
                                  http://crl.dhimyotis.com/certignarootca.crl54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    http://curl.haxx.se/rfc/cookie_spec.html54Oa5PcvK1.exe, 00000002.00000002.1908369809.0000014E9DDE0000.00000004.00001000.00020000.00000000.sdmpfalse
                                      		high
                                      http://ocsp.accv.es54Oa5PcvK1.exe, 00000002.00000003.1889517854.0000014E9D55A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865696349.0000014E9D552000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode54Oa5PcvK1.exe, 00000002.00000002.1908076763.0000014E9DBE0000.00000004.00001000.00020000.00000000.sdmpfalse
                                          		high
                                          https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy54Oa5PcvK1.exe, 00000002.00000002.1908219521.0000014E9DCE0000.00000004.00001000.00020000.00000000.sdmpfalse
                                            		high
                                            https://docs.python.org/3/library/pprint.html54Oa5PcvK1.exe, 00000002.00000003.1862135699.0000014E9AABA000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1866360260.0000014E9AAE1000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853924980.0000014E9AA89000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859294660.0000014E9AA89000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L68854Oa5PcvK1.exe, 00000002.00000002.1897780269.0000014E9A2F8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		high
                                                https://httpbin.org/get54Oa5PcvK1.exe, 00000002.00000002.1908219521.0000014E9DCE0000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1905649488.0000014E9D3F6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1891028384.0000014E9D365000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D3CF000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1887224183.0000014E9D2E9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1871310960.0000014E9D363000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://crl.xrampsecurity.com/XGCA.crlA54Oa5PcvK1.exe, 00000002.00000003.1862831881.0000014E9D527000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access54Oa5PcvK1.exe, 00000002.00000003.1807946782.0000014E9AA89000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858902955.0000014E9A733000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1808018899.0000014E9AAED000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1870468484.0000014E9A73A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1896034640.0000014E9A73B000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1807707033.0000014E9C5DF000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1892419995.0000014E9A73B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://wwww.certigna.fr/autorites/0m54Oa5PcvK1.exe, 00000002.00000002.1905274470.0000014E9D300000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1888734287.0000014E9D2FD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875972947.0000014E9D2FA000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1889741215.0000014E9D300000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://wwww.certigna.fr/autorites/~54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader54Oa5PcvK1.exe, 00000002.00000002.1899076898.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858902955.0000014E9A733000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1867143009.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860523938.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1898176407.0000014E9A700000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1798235570.0000014E9A779000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1796228223.0000014E9A741000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859447132.0000014E9A787000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1892110731.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858979814.0000014E9A769000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1796543016.0000014E9A761000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1796949117.0000014E9A772000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864218112.0000014E9A788000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://github.com/python/cpython/issues/86361.54Oa5PcvK1.exe, 00000002.00000003.1806002599.0000014E9AA05000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1876072137.0000014E9AA2F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859377252.0000014E9A9F1000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1809807777.0000014E9AA05000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1808505883.0000014E9AA05000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1814635111.0000014E9A9FF000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1861933634.0000014E9AA2E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1876360918.0000014E9AA3F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1811024381.0000014E9AA05000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858446761.0000014E9A9EE000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860125534.0000014E9A9F2000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853924980.0000014E9A9EC000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1807487599.0000014E9AA05000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1807763706.0000014E9A9E6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://httpbin.org/54Oa5PcvK1.exe, 00000002.00000003.1871310960.0000014E9D363000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://wwww.certigna.fr/autorites/54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file54Oa5PcvK1.exe, 00000002.00000002.1914321964.00007FFDFA9C7000.00000002.00000001.01000000.0000001F.sdmpfalse
                                                                  		high
                                                                  http://www.cl.cam.ac.uk/~mgk25/iso-time.html54Oa5PcvK1.exe, 00000002.00000003.1808235992.0000014E9C5D3000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1809151431.0000014E9C5E2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://schemas.micr54Oa5PcvK1.exefalse
                                                                      		high
                                                                      http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l53554Oa5PcvK1.exe, 00000002.00000003.1852623806.0000014E9C7B9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863567043.0000014E9C878000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863928662.0000014E9D319000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy54Oa5PcvK1.exe, 00000002.00000002.1899076898.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858902955.0000014E9A733000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1867143009.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860523938.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1898176407.0000014E9A700000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1798235570.0000014E9A779000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1796228223.0000014E9A741000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859447132.0000014E9A787000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1892110731.0000014E9A788000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858979814.0000014E9A769000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1796543016.0000014E9A761000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1796949117.0000014E9A772000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864218112.0000014E9A788000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://crl.xrampsecurity.com/XGCA.crl#54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://docs.python.org/3/library/multiprocessing.html54Oa5PcvK1.exe, 00000002.00000003.1860841559.0000014E9C4F0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1895891104.0000014E9C4F5000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853847851.0000014E9C4EE000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875390775.0000014E9C4F1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://docs.python.org/3/library/re.html54Oa5PcvK1.exe, 00000002.00000002.1902596491.0000014E9C704000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1854590119.0000014E9C6A9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859208920.0000014E9A98C000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864133086.0000014E9C6C0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1895552211.0000014E9A98F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858675566.0000014E9A7D0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859570149.0000014E9C6BF000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1866777303.0000014E9A7D0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860901451.0000014E9A7D0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1872793967.0000014E9C6F4000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1869946544.0000014E9C6D1000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860593059.0000014E9AAE8000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1900060979.0000014E9A98F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1904289849.0000014E9CEE0000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1816611807.0000014E9C6A9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864652551.0000014E9A7D0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1870819223.0000014E9A98E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865013694.0000014E9A98D000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853924980.0000014E9AA89000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1903819690.0000014E9CC10000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1868207183.0000014E9C6C0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://github.com/pypa/setuptools/issues/417#issuecomment-39229840154Oa5PcvK1.exe, 00000002.00000002.1901264108.0000014E9C3D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://github.com/ActiveState/appdirs54Oa5PcvK1.exe, 00000002.00000002.1903341157.0000014E9C9F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://wiki.debian.org/XDGBaseDirectorySpecification#state54Oa5PcvK1.exe, 00000002.00000003.1858949459.0000014E9A70A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1871410302.0000014E9A718000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1861135005.0000014E9A70B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://crl.securetrust.com/STCA.crl54Oa5PcvK1.exe, 00000002.00000003.1862831881.0000014E9D527000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://wwwsearch.sf.net/):54Oa5PcvK1.exe, 00000002.00000003.1860216079.0000014E9D35E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875420977.0000014E9D35E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1896410972.0000014E9D35E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt054Oa5PcvK1.exe, 00000002.00000003.1889517854.0000014E9D560000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1889517854.0000014E9D55A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865696349.0000014E9D552000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864479647.0000014E9D55F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1906320899.0000014E9D560000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://www.accv.es/legislacion_c.htm54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://tools.ietf.org/html/rfc6125#section-6.4.354Oa5PcvK1.exe, 00000002.00000002.1908369809.0000014E9DDE0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://repository.swisssign.com/O$54Oa5PcvK1.exe, 00000002.00000003.1862831881.0000014E9D527000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864820472.0000014E9D538000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                http://crl.xrampsecurity.com/XGCA.crl054Oa5PcvK1.exe, 00000002.00000003.1875170154.0000014E9D21E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853200890.0000014E9D1C7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://bugs.python.org/issue44497.54Oa5PcvK1.exe, 00000002.00000002.1904289849.0000014E9CEE0000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1903819690.0000014E9CC10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://scrt.95271.pw/chrome.php0y54Oa5PcvK1.exe, 00000002.00000002.1909500839.0000014E9DF50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    http://www.cert.fnmt.es/dpcs/54Oa5PcvK1.exe, 00000002.00000003.1873917067.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865545609.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853692270.0000014E9D18A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863644545.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1876161672.0000014E9D1AD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1881118801.0000014E9D1B3000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://google.com/mail54Oa5PcvK1.exe, 00000002.00000003.1873917067.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853739475.0000014E9D180000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865545609.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853692270.0000014E9D18A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859802176.0000014E9D184000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863644545.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865545609.0000014E9D184000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863484959.0000014E9D184000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1904744322.0000014E9D184000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://packaging.python.org/specifications/entry-points/54Oa5PcvK1.exe, 00000002.00000002.1904451164.0000014E9CFE0000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1903819690.0000014E9CC10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://github.com/jaraco/jaraco.functools/issues/554Oa5PcvK1.exe, 00000002.00000002.1903341157.0000014E9C9F0000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1904451164.0000014E9CFE0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://www.accv.es0054Oa5PcvK1.exe, 00000002.00000003.1889517854.0000014E9D560000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864479647.0000014E9D55F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1906320899.0000014E9D560000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py54Oa5PcvK1.exe, 00000002.00000003.1864218112.0000014E9A788000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm54Oa5PcvK1.exe, 00000002.00000003.1808235992.0000014E9C5D3000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1809151431.0000014E9C5E2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://www.rfc-editor.org/info/rfc725354Oa5PcvK1.exe, 00000002.00000003.1866219661.0000014E9D6D1000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852724640.0000014E9D738000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1872993264.0000014E9D73F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1854847463.0000014E9D6D0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://scrt.95271.pw/chrome.php54Oa5PcvK1.exe, 00000002.00000002.1909500839.0000014E9DF50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                    • Avira URL Cloud: safe
                                                                                                                    		unknown
                                                                                                                    https://github.com/pyca/cryptography/issues54Oa5PcvK1.exe, 00000002.00000002.1914321964.00007FFDFA9C7000.00000002.00000001.01000000.0000001F.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://bugs.python.org/issue23606)54Oa5PcvK1.exe, 00000002.00000002.1909500839.0000014E9DF50000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                      • Avira URL Cloud: safe
                                                                                                                      		unknown
                                                                                                                      http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf54Oa5PcvK1.exe, 00000002.00000003.1852623806.0000014E9C7B9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853200890.0000014E9D1C7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1885346946.0000014E9D1DB000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1888570375.0000014E9C854000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1878269326.0000014E9D1DB000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875670444.0000014E9D1D7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://foss.heptapod.net/pypy/pypy/-/issues/353954Oa5PcvK1.exe, 00000002.00000002.1907932601.0000014E9DAE0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://google.com/54Oa5PcvK1.exe, 00000002.00000002.1905095096.0000014E9D293000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1886368793.0000014E9D292000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D265000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858252843.0000014E9D276000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://mahler:8092/site-updates.py54Oa5PcvK1.exe, 00000002.00000003.1896789568.0000014E9D40A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860347372.0000014E9D401000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D3F6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1905649488.0000014E9D40B000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D405000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://crl.securetrust.com/SGCA.crl54Oa5PcvK1.exe, 00000002.00000003.1890109806.0000014E9D50A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863298445.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1895072068.0000014E9D526000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://.../back.jpeg54Oa5PcvK1.exe, 00000002.00000002.1908369809.0000014E9DDE0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://tools.ietf.org/html/rfc586954Oa5PcvK1.exe, 00000002.00000003.1853200890.0000014E9D1C7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1878269326.0000014E9D1CE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    http://www.quovadisglobal.com/cpsQ54Oa5PcvK1.exe, 00000002.00000003.1890109806.0000014E9D50A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863298445.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1906166312.0000014E9D518000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1896550045.0000014E9D516000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://www.python.org/download/releases/2.3/mro/.54Oa5PcvK1.exe, 00000002.00000003.1792466627.0000014E9A749000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1897780269.0000014E9A270000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1792195668.0000014E9A749000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html54Oa5PcvK1.exe, 00000002.00000003.1852623806.0000014E9C7B9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1873917067.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865545609.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853200890.0000014E9D1C7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1880949550.0000014E9D2E6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853692270.0000014E9D18A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1866219661.0000014E9D6DD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1888734287.0000014E9D2E9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1907273070.0000014E9D6DF000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863644545.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1889443843.0000014E9D6DD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875972947.0000014E9D2FA000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1876161672.0000014E9D1AD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863115442.0000014E9D5A4000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1889741215.0000014E9D2F2000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1886446854.0000014E9D6DD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1906653844.0000014E9D5CE000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1885346946.0000014E9D1DB000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863017558.0000014E9D6D6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://httpbin.org/post54Oa5PcvK1.exe, 00000002.00000003.1853200890.0000014E9D1C7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875670444.0000014E9D1D7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            http://crl.securetrust.com/SGCA.crlK?(O54Oa5PcvK1.exe, 00000002.00000003.1890109806.0000014E9D50A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863298445.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1895072068.0000014E9D526000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://github.com/Ousret/charset_normalizer54Oa5PcvK1.exe, 00000002.00000003.1860216079.0000014E9D35E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1871310960.0000014E9D363000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                http://www.firmaprofesional.com/cps054Oa5PcvK1.exe, 00000002.00000003.1852623806.0000014E9C7B9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1861816344.0000014E9C881000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863115442.0000014E9D5A4000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1871001126.0000014E9C886000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1906568571.0000014E9D5AA000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1867253506.0000014E9C882000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1903076365.0000014E9C897000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://docs.python.org/3/library/re.html#re.sub54Oa5PcvK1.exe, 00000002.00000002.1903561006.0000014E9CB00000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1904289849.0000014E9CEE0000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1816405751.0000014E9D0E1000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1816405751.0000014E9D139000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://github.com/urllib3/urllib3/issues/292054Oa5PcvK1.exe, 00000002.00000002.1908219521.0000014E9DCE0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      http://crl.securetrust.com/SGCA.crl054Oa5PcvK1.exe, 00000002.00000003.1876009699.0000014E9D364000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860216079.0000014E9D35E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1891028384.0000014E9D365000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1871310960.0000014E9D363000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://yahoo.com/54Oa5PcvK1.exe, 00000002.00000003.1873917067.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853739475.0000014E9D180000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865545609.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853692270.0000014E9D18A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859802176.0000014E9D184000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863644545.0000014E9D18E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865545609.0000014E9D184000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863484959.0000014E9D184000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1904744322.0000014E9D184000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          http://crl.securetrust.com/STCA.crl054Oa5PcvK1.exe, 00000002.00000003.1876009699.0000014E9D364000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860216079.0000014E9D35E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1891028384.0000014E9D365000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1871310960.0000014E9D363000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-254Oa5PcvK1.exe, 00000002.00000002.1903819690.0000014E9CC10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                                            		unknown
                                                                                                                                                            https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular54Oa5PcvK1.exe, 00000002.00000002.1902596491.0000014E9C704000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1854590119.0000014E9C6A9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859208920.0000014E9A98C000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864133086.0000014E9C6C0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1895552211.0000014E9A98F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858675566.0000014E9A7D0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859570149.0000014E9C6BF000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1866777303.0000014E9A7D0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860901451.0000014E9A7D0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1872793967.0000014E9C6F4000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1869946544.0000014E9C6D1000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1860593059.0000014E9AAE8000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1900060979.0000014E9A98F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1816611807.0000014E9C6A9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864652551.0000014E9A7D0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1870819223.0000014E9A98E000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1865013694.0000014E9A98D000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853924980.0000014E9AA89000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1868207183.0000014E9C6C0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1816405751.0000014E9D0E1000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1816405751.0000014E9D139000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-654Oa5PcvK1.exe, 00000002.00000003.1860841559.0000014E9C4F0000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1861187734.0000014E9C4F6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1888694158.0000014E9C51D000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1853847851.0000014E9C4EE000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862082830.0000014E9C50D000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1896587599.0000014E9C523000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1866886822.0000014E9C516000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1874209287.0000014E9C51C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://html.spec.whatwg.org/multipage/54Oa5PcvK1.exe, 00000002.00000002.1905274470.0000014E9D300000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1888734287.0000014E9D2FD000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875972947.0000014E9D2FA000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1889741215.0000014E9D300000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  http://www.quovadisglobal.com/cps054Oa5PcvK1.exe, 00000002.00000003.1853200890.0000014E9D1C7000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D169000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1878269326.0000014E9D1CE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://github.com/pyparsing/pyparsing/wiki54Oa5PcvK1.exe, 00000002.00000003.1816611807.0000014E9C6A9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl54Oa5PcvK1.exe, 00000002.00000003.1890109806.0000014E9D50A000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1863298445.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1906166312.0000014E9D518000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1896550045.0000014E9D516000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings54Oa5PcvK1.exe, 00000002.00000002.1908219521.0000014E9DCE0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl054Oa5PcvK1.exe, 00000002.00000003.1889517854.0000014E9D560000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852044676.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1864479647.0000014E9D55F000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1862214836.0000014E9D504000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000002.1906320899.0000014E9D560000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://www.rfc-editor.org/rfc/rfc8259#section-8.154Oa5PcvK1.exe, 00000002.00000002.1905095096.0000014E9D293000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1886368793.0000014E9D292000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1852328372.0000014E9D265000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1858252843.0000014E9D276000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://github.com/pyca/cryptography/issues/925354Oa5PcvK1.exe, 00000002.00000002.1914321964.00007FFDFA9C7000.00000002.00000001.01000000.0000001F.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf54Oa5PcvK1.exe, 00000002.00000003.1880949550.0000014E9D2E6000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1888734287.0000014E9D2E9000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1875972947.0000014E9D2FA000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1889741215.0000014E9D2F2000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1887224183.0000014E9D2E9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  http://www.iana.org/time-zones/repository/tz-link.html54Oa5PcvK1.exe, 00000002.00000003.1808235992.0000014E9C5D3000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1808285799.0000014E9AA89000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1809151431.0000014E9C5E2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    http://tools.ietf.org/html/rfc529754Oa5PcvK1.exe, 00000002.00000002.1912566111.0000014E9E220000.00000004.00001000.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1872432884.0000014E9D6CB000.00000004.00000020.00020000.00000000.sdmp, 54Oa5PcvK1.exe, 00000002.00000003.1859025617.0000014E9D6CA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://upload.pypi.org/legacy/54Oa5PcvK1.exe, 00000002.00000002.1903198908.0000014E9C8F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high

                                                                                                                                                                                        World Map of Contacted IPs

                                                                                                                                                                                        ⊘No contacted IP infos

                                                                                                                                                                                        General Information

                                                                                                                                                                                        Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                        Analysis ID:1577418
                                                                                                                                                                                        Start date and time:2024-12-18 13:16:45 +01:00
                                                                                                                                                                                        Joe Sandbox product:CloudBasic
                                                                                                                                                                                        Overall analysis duration:0h 8m 4s
                                                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                                                        Report type:full
                                                                                                                                                                                        Cookbook file name:default.jbs
                                                                                                                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                        Number of analysed new started processes analysed:7
                                                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                                                        Number of injected processes analysed:0
                                                                                                                                                                                        Technologies:
                                                                                                                                                                                        • HCA enabled
                                                                                                                                                                                        • EGA enabled
                                                                                                                                                                                        • AMSI enabled
                                                                                                                                                                                        Analysis Mode:default
                                                                                                                                                                                        Analysis stop reason:Timeout
                                                                                                                                                                                        Sample name:54Oa5PcvK1.exe
                                                                                                                                                                                        renamed because original name is a hash value
                                                                                                                                                                                        Original Sample Name:150bd33eb83e01bd26e6ea50fb7e1058e57855f8c50753f8a3b7401d712b8351.exe
                                                                                                                                                                                        Detection:MAL
                                                                                                                                                                                        Classification:mal56.spyw.winEXE@6/149@1/0
                                                                                                                                                                                        EGA Information:
                                                                                                                                                                                        • Successful, ratio: 100%
                                                                                                                                                                                        HCA Information:
                                                                                                                                                                                        • Successful, ratio: 56%
                                                                                                                                                                                        • Number of executed functions: 65
                                                                                                                                                                                        • Number of non-executed functions: 131
                                                                                                                                                                                        Cookbook Comments:
                                                                                                                                                                                        • Found application associated with file extension: .exe
                                                                                                                                                                                        • Stop behavior analysis, all processes terminated

                                                                                                                                                                                        Warnings

                                                                                                                                                                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
                                                                                                                                                                                        • Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.63
                                                                                                                                                                                        • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                        • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                        • VT rate limit hit for: 54Oa5PcvK1.exe

                                                                                                                                                                                        Simulations

                                                                                                                                                                                        Behavior and APIs

                                                                                                                                                                                        ⊘No simulations

                                                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                                                        IPs

                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                        Domains

                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                        ASNs

                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                        JA3 Fingerprints

                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                        Dropped Files

                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_Salsa20.pydLmZVhGD5jF.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                          7EznMik8Fw.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                            MkWMm5piE5.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                              okG6LaM2yP.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                JxrkpYVdCp.exeGet hashmaliciousPython Stealer, BabadedaBrowse
                                                                                                                                                                                                  hSyJxPUUDx.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    u08NgsGNym.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                      MkWMm5piE5.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                        L5OMdZqWzq.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                          ssPp3zvWwN.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_ARC4.pydLmZVhGD5jF.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                              zW72x5d91l.batGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                7EznMik8Fw.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                  MkWMm5piE5.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                    okG6LaM2yP.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                      JxrkpYVdCp.exeGet hashmaliciousPython Stealer, BabadedaBrowse
                                                                                                                                                                                                                        hSyJxPUUDx.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                          u08NgsGNym.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                            MkWMm5piE5.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                              L5OMdZqWzq.exeGet hashmaliciousPython StealerBrowse

                                                                                                                                                                                                                                Created / dropped Files

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_ARC4.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11264
                                                                                                                                                                                                                                Entropy (8bit):4.703513333396807
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:nDzb9VD9daQ2iTrqT+6Zdp/Q0I1uLfcC75JiC4Rs89EcYyGDV90OcX6gY/7ECFV:Dzz9damqTrpYTst0E5DVPcqgY/79X
                                                                                                                                                                                                                                MD5:6176101B7C377A32C01AE3EDB7FD4DE6
                                                                                                                                                                                                                                SHA1:5F1CB443F9D677F313BEC07C5241AEAB57502F5E
                                                                                                                                                                                                                                SHA-256:EFEA361311923189ECBE3240111EFBA329752D30457E0DBE9628A82905CD4BDB
                                                                                                                                                                                                                                SHA-512:3E7373B71AE0834E96A99595CFEF2E96C0F5230429ADC0B5512F4089D1ED0D7F7F0E32A40584DFB13C41D257712A9C4E9722366F0A21B907798AE79D8CEDCF30
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Joe Sandbox View:
                                                                                                                                                                                                                                • Filename: LmZVhGD5jF.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: zW72x5d91l.bat, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: 7EznMik8Fw.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: MkWMm5piE5.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: okG6LaM2yP.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: JxrkpYVdCp.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: hSyJxPUUDx.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: u08NgsGNym.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: MkWMm5piE5.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: L5OMdZqWzq.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                Reputation:moderate, very likely benign file
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d....e.........." ...%............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13312
                                                                                                                                                                                                                                Entropy (8bit):4.968452734961967
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:JF3TgNlF/1Nt5aSd4+1ijg0NLfFNJSCqsstXHTeH5ht47qMbxbfDqbwYH/kcX6gT:WF/1nb2mhQtkXHTeZ87VDqrMcqgYvEp
                                                                                                                                                                                                                                MD5:371776A7E26BAEB3F75C93A8364C9AE0
                                                                                                                                                                                                                                SHA1:BF60B2177171BA1C6B4351E6178529D4B082BDA9
                                                                                                                                                                                                                                SHA-256:15257E96D1CA8480B8CB98F4C79B6E365FE38A1BA9638FC8C9AB7FFEA79C4762
                                                                                                                                                                                                                                SHA-512:C23548FBCD1713C4D8348917FF2AB623C404FB0E9566AB93D147C62E06F51E63BDAA347F2D203FE4F046CE49943B38E3E9FA1433F6455C97379F2BC641AE7CE9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Joe Sandbox View:
                                                                                                                                                                                                                                • Filename: LmZVhGD5jF.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: 7EznMik8Fw.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: MkWMm5piE5.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: okG6LaM2yP.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: JxrkpYVdCp.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: hSyJxPUUDx.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: u08NgsGNym.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: MkWMm5piE5.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: L5OMdZqWzq.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: ssPp3zvWwN.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                Reputation:moderate, very likely benign file
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8......x9..d....`.......P..L............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..L....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_chacha20.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13824
                                                                                                                                                                                                                                Entropy (8bit):5.061461040216793
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ldF/1nb2mhQtkXn0t/WS60YYDEiqvdvGyv9lkVcqgYvEMo:v2f6XSZ6XYD6vdvGyv9MgYvEMo
                                                                                                                                                                                                                                MD5:CB5238E2D4149636377F9A1E2AF6DC57
                                                                                                                                                                                                                                SHA1:038253BABC9E652BA4A20116886209E2BCCF35AC
                                                                                                                                                                                                                                SHA-256:A8D3BB9CD6A78EBDB4F18693E68B659080D08CB537F9630D279EC9F26772EFC7
                                                                                                                                                                                                                                SHA-512:B1E6AB509CF1E5ECC6A60455D6900A76514F8DF43F3ABC3B8D36AF59A3DF8A868B489ED0B145D0D799AAC8672CBF5827C503F383D3F38069ABF6056ECCD87B21
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:moderate, very likely benign file
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13824
                                                                                                                                                                                                                                Entropy (8bit):5.236167046748013
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:/siHXqpoUol3xZhRyQX5lDnRDFYav+tcqgRvE:h6D+XBDgDgRvE
                                                                                                                                                                                                                                MD5:D9E7218460AEE693BEA07DA7C2B40177
                                                                                                                                                                                                                                SHA1:9264D749748D8C98D35B27BEFE6247DA23FF103D
                                                                                                                                                                                                                                SHA-256:38E423D3BCC32EE6730941B19B7D5D8872C0D30D3DD8F9AAE1442CB052C599AD
                                                                                                                                                                                                                                SHA-512:DDB579E2DEA9D266254C0D9E23038274D9AE33F0756419FD53EC6DC1A27D1540828EE8F4AD421A5CFFD9B805F1A68F26E70BDC1BAB69834E8ACD6D7BB7BDB0DB
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K..*...*...*...R...*...U...*..R...*...*...*...U...*...U...*...U...*.....*.....*...}..*.....*..Rich.*..........................PE..d....e.........." ...%............P.....................................................`..........................................9.......9..d....`.......P..|............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......,..............@....pdata..|....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):36352
                                                                                                                                                                                                                                Entropy (8bit):6.558176937399355
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:Dz2P+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuCLg46:DzeqWB7YJlmLJ3oD/S4j990th9VCsC
                                                                                                                                                                                                                                MD5:F751792DF10CDEED391D361E82DAF596
                                                                                                                                                                                                                                SHA1:3440738AF3C88A4255506B55A673398838B4CEAC
                                                                                                                                                                                                                                SHA-256:9524D1DADCD2F2B0190C1B8EDE8E5199706F3D6C19D3FB005809ED4FEBF3E8B5
                                                                                                                                                                                                                                SHA-512:6159F245418AB7AD897B02F1AADF1079608E533B9C75006EFAF24717917EAA159846EE5DFC0E85C6CFF8810319EFECBA80C1D51D1F115F00EC1AFF253E312C00
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d....e.........." ...%.H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):15872
                                                                                                                                                                                                                                Entropy (8bit):5.285191078037458
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:wJBjJHEkEPYi3Xd+dc26E4++yuqAyXW9wifD4jqccqgwYUMvEW:ikRwi3wO26Ef+yuIm9PfD7wgwYUMvE
                                                                                                                                                                                                                                MD5:BBEA5FFAE18BF0B5679D5C5BCD762D5A
                                                                                                                                                                                                                                SHA1:D7C2721795113370377A1C60E5CEF393473F0CC5
                                                                                                                                                                                                                                SHA-256:1F4288A098DA3AAC2ADD54E83C8C9F2041EC895263F20576417A92E1E5B421C1
                                                                                                                                                                                                                                SHA-512:0932EC5E69696D6DD559C30C19FC5A481BEFA38539013B9541D84499F2B6834A2FFE64A1008A1724E456FF15DDA6268B7B0AD8BA14918E2333567277B3716CC4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........TX..:...:...:.....:..;...:...;...:...;...:..?...:..>...:..9...:..R2...:..R:...:..R....:..R8...:.Rich..:.................PE..d....e.........." ...%. ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text...h........ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):16384
                                                                                                                                                                                                                                Entropy (8bit):5.505471888568532
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:vd9VkyQ5f8vjVaCHpKpTTjaNe7oca2DW3Q2dhmdcqgwNeecBih:JkP5cjIGpKlqD2D4kzgwNeE
                                                                                                                                                                                                                                MD5:D2175300E065347D13211F5BF7581602
                                                                                                                                                                                                                                SHA1:3AE92C0B0ECDA1F6B240096A4E68D16D3DB1FFB0
                                                                                                                                                                                                                                SHA-256:94556934E3F9EE73C77552D2F3FC369C02D62A4C9E7143E472F8E3EE8C00AEE1
                                                                                                                                                                                                                                SHA-512:6156D744800206A431DEE418A1C561FFB45D726DC75467A91D26EE98503B280C6595CDEA02BDA6A023235BD010835EA1FC9CB843E9FEC3501980B47B6B490AF7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20992
                                                                                                                                                                                                                                Entropy (8bit):6.06124024160806
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:bUv5cJMOZA0nmwBD+XpJgLa0Mp8Qpg4P2llyM:0K1XBD+DgLa1yTi
                                                                                                                                                                                                                                MD5:45616B10ABE82D5BB18B9C3AB446E113
                                                                                                                                                                                                                                SHA1:91B2C0B0F690AE3ABFD9B0B92A9EA6167049B818
                                                                                                                                                                                                                                SHA-256:F348DB1843B8F38A23AEE09DD52FB50D3771361C0D529C9C9E142A251CC1D1EC
                                                                                                                                                                                                                                SHA-512:ACEA8C1A3A1FA19034FD913C8BE93D5E273B7719D76CB71C36F510042918EA1D9B44AC84D849570F9508D635B4829D3E10C36A461EC63825BA178F5AC1DE85FB
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_cast.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):25088
                                                                                                                                                                                                                                Entropy (8bit):6.475467273446457
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:oc6HLZiMDFuGu+XHZXmrfXA+UA10ol31tuXy4IYgLWi:B6H1TZXX5XmrXA+NNxWiFdLWi
                                                                                                                                                                                                                                MD5:CF3C2F35C37AA066FA06113839C8A857
                                                                                                                                                                                                                                SHA1:39F3B0AEFB771D871A93681B780DA3BD85A6EDD0
                                                                                                                                                                                                                                SHA-256:1261783F8881642C3466B96FA5879A492EA9E0DAB41284ED9E4A82E8BCF00C80
                                                                                                                                                                                                                                SHA-512:1C36B80AAE49FD5E826E95D83297AE153FDB2BC652A47D853DF31449E99D5C29F42ED82671E2996AF60DCFB862EC5536BB0A68635D4E33D33F8901711C0C8BE6
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....#.......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12288
                                                                                                                                                                                                                                Entropy (8bit):4.838534302892255
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:0F/1nb2mhQtkr+juOxKbDbnHcqgYvEkrK:u2f6iuOsbDtgYvEmK
                                                                                                                                                                                                                                MD5:20708935FDD89B3EDDEEA27D4D0EA52A
                                                                                                                                                                                                                                SHA1:85A9FE2C7C5D97FD02B47327E431D88A1DC865F7
                                                                                                                                                                                                                                SHA-256:11DD1B49F70DB23617E84E08E709D4A9C86759D911A24EBDDFB91C414CC7F375
                                                                                                                                                                                                                                SHA-512:F28C31B425DC38B5E9AD87B95E8071997E4A6F444608E57867016178CD0CA3E9F73A4B7F2A0A704E45F75B7DCFF54490510C6BF8461F3261F676E9294506D09B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13824
                                                                                                                                                                                                                                Entropy (8bit):4.9047185025862925
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:NRgPX8lvI+KnwSDTPUDEhKWPXcqgzQkvEd:2og9rUD9mpgzQkvE
                                                                                                                                                                                                                                MD5:43BBE5D04460BD5847000804234321A6
                                                                                                                                                                                                                                SHA1:3CAE8C4982BBD73AF26EB8C6413671425828DBB7
                                                                                                                                                                                                                                SHA-256:FAA41385D0DB8D4EE2EE74EE540BC879CF2E884BEE87655FF3C89C8C517EED45
                                                                                                                                                                                                                                SHA-512:DBC60F1D11D63BEBBAB3C742FB827EFBDE6DFF3C563AE1703892D5643D5906751DB3815B97CBFB7DA5FCD306017E4A1CDCC0CDD0E61ADF20E0816F9C88FE2C9B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*...*...*...RQ..*...U...*..R...*...*...*...U...*...U...*...U...*......*......*...=..*......*..Rich.*..................PE..d....e.........." ...%..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):14848
                                                                                                                                                                                                                                Entropy (8bit):5.300163691206422
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:j0J1gSHxKkwv0i8XSi3Sm57NEEE/qexUEtDrdkrRcqgUF6+6vEX:jM01si8XSi3SACqe7tDeDgUUjvE
                                                                                                                                                                                                                                MD5:C6B20332B4814799E643BADFFD8DF2CD
                                                                                                                                                                                                                                SHA1:E7DA1C1F09F6EC9A84AF0AB0616AFEA55A58E984
                                                                                                                                                                                                                                SHA-256:61C7A532E108F67874EF2E17244358DF19158F6142680F5B21032BA4889AC5D8
                                                                                                                                                                                                                                SHA-512:D50C7F67D2DFB268AD4CF18E16159604B6E8A50EA4F0C9137E26619FD7835FAAD323B5F6A2B8E3EC1C023E0678BCBE5D0F867CD711C5CD405BD207212228B2B4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K,..*B..*B..*B..R...*B..UC..*B.RC..*B..*C..*B..UG..*B..UF..*B..UA..*B..J..*B..B..*B....*B..@..*B.Rich.*B.........................PE..d....e.........." ...%..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_des.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):57856
                                                                                                                                                                                                                                Entropy (8bit):4.260220483695234
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:9XUqVT1dZ/GHkJnYcZiGKdZHDLtiduprZNZY0JAIg+v:99HGHfJidSK
                                                                                                                                                                                                                                MD5:0B538205388FDD99A043EE3AFAA074E4
                                                                                                                                                                                                                                SHA1:E0DD9306F1DBE78F7F45A94834783E7E886EB70F
                                                                                                                                                                                                                                SHA-256:C4769D3E6EB2A2FECB5DEC602D45D3E785C63BB96297268E3ED069CC4A019B1A
                                                                                                                                                                                                                                SHA-512:2F4109E42DB7BC72EB50BCCC21EB200095312EA00763A255A38A4E35A77C04607E1DB7BB69A11E1D80532767B20BAA4860C05F52F32BF1C81FE61A7ECCEB35ED
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d....e.........." ...%.8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_des3.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):58368
                                                                                                                                                                                                                                Entropy (8bit):4.276870967324261
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:9jUqho9weF5/eHkRnYcZiGKdZHDL7idErZjZYXGg:9RCneH//id42
                                                                                                                                                                                                                                MD5:6C3E976AB9F47825A5BD9F73E8DBA74E
                                                                                                                                                                                                                                SHA1:4C6EB447FE8F195CF7F4B594CE7EAF928F52B23A
                                                                                                                                                                                                                                SHA-256:238CDB6B8FB611DB4626E6D202E125E2C174C8F73AE8A3273B45A0FC18DEA70C
                                                                                                                                                                                                                                SHA-512:B19516F00CC0484D9CDA82A482BBFE41635CDBBE19C13F1E63F033C9A68DD36798C44F04D6BD8BAE6523A845E852D81ACADD0D5DD86AF62CC9D081B803F8DF7B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d....e.........." ...%.:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):10752
                                                                                                                                                                                                                                Entropy (8bit):4.578113904149635
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:R0qVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EpmFWLOXDwo2Pj15XkcX6gbW6z:DVddiT7pgTctEEI4qXDo11kcqgbW6
                                                                                                                                                                                                                                MD5:FEE13D4FB947835DBB62ACA7EAFF44EF
                                                                                                                                                                                                                                SHA1:7CC088AB68F90C563D1FE22D5E3C3F9E414EFC04
                                                                                                                                                                                                                                SHA-256:3E0D07BBF93E0748B42B1C2550F48F0D81597486038C22548224584AE178A543
                                                                                                                                                                                                                                SHA-512:DEA92F935BC710DF6866E89CC6EB5B53FC7ADF0F14F3D381B89D7869590A1B0B1F98F347664F7A19C6078E7AA3EB0F773FFCB711CC4275D0ECD54030D6CF5CB2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):22016
                                                                                                                                                                                                                                Entropy (8bit):6.143719741413071
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:IUv5cRUtPQtjLJiKMjNrDF6pJgLa0Mp8Q90gYP2lXCM:BKR8I+K0lDFQgLa17zU
                                                                                                                                                                                                                                MD5:76F88D89643B0E622263AF676A65A8B4
                                                                                                                                                                                                                                SHA1:93A365060E98890E06D5C2D61EFBAD12F5D02E06
                                                                                                                                                                                                                                SHA-256:605C86145B3018A5E751C6D61FD0F85CF4A9EBF2AD1F3009A4E68CF9F1A63E49
                                                                                                                                                                                                                                SHA-512:979B97AAC01633C46C048010FA886EBB09CFDB5520E415F698616987AE850FD342A4210A8DC0FAC1E059599F253565862892171403F5E4F83754D02D2EF3F366
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):17920
                                                                                                                                                                                                                                Entropy (8bit):5.353267174592179
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:7PHNP3Mj7Be/yB/6sB3yxcb+IMcOYqQViCBD8bg6Vf4A:hPcnB8KSsB34cb+bcOYpMCBDX
                                                                                                                                                                                                                                MD5:D48BFFA1AF800F6969CFB356D3F75AA6
                                                                                                                                                                                                                                SHA1:2A0D8968D74EBC879A17045EFE86C7FB5C54AEE6
                                                                                                                                                                                                                                SHA-256:4AA5E9CE7A76B301766D3ECBB06D2E42C2F09D0743605A91BF83069FEFE3A4DE
                                                                                                                                                                                                                                SHA-512:30D14AD8C68B043CC49EAFB460B69E83A15900CB68B4E0CBB379FF5BA260194965EF300EB715308E7211A743FF07FA7F8779E174368DCAA7F704E43068CC4858
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12288
                                                                                                                                                                                                                                Entropy (8bit):4.741247880746506
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:0F/1nb2mhQtkgU7L9D037tfcqgYvEJPb:u2f6L9DSJxgYvEJj
                                                                                                                                                                                                                                MD5:4D9182783EF19411EBD9F1F864A2EF2F
                                                                                                                                                                                                                                SHA1:DDC9F878B88E7B51B5F68A3F99A0857E362B0361
                                                                                                                                                                                                                                SHA-256:C9F4C5FFCDD4F8814F8C07CE532A164AB699AE8CDE737DF02D6ECD7B5DD52DBD
                                                                                                                                                                                                                                SHA-512:8F983984F0594C2CAC447E9D75B86D6EC08ED1C789958AFA835B0D1239FD4D7EBE16408D080E7FCE17C379954609A93FC730B11BE6F4A024E7D13D042B27F185
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):14848
                                                                                                                                                                                                                                Entropy (8bit):5.212941287344097
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:2F/1nb2mhQtkRySMfJ2ycxFzShJD9bAal2QDeJKcqgQx2QY:M2fKRQB2j8JD2fJagQx2QY
                                                                                                                                                                                                                                MD5:F4EDB3207E27D5F1ACBBB45AAFCB6D02
                                                                                                                                                                                                                                SHA1:8EAB478CA441B8AD7130881B16E5FAD0B119D3F0
                                                                                                                                                                                                                                SHA-256:3274F49BE39A996C5E5D27376F46A1039B6333665BB88AF1CA6D37550FA27B29
                                                                                                                                                                                                                                SHA-512:7BDEBF9829CB26C010FCE1C69E7580191084BCDA3E2847581D0238AF1CAA87E68D44B052424FDC447434D971BB481047F8F2DA1B1DEF6B18684E79E63C6FBDC5
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%..... ......P.....................................................`..........................................9......|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):14336
                                                                                                                                                                                                                                Entropy (8bit):5.181291194389683
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:hF/1nb2mhQt7fSOp/CJPvADQHKtxSOvbcqgEvcM+:N2fNKOZWPIDnxVlgEvL
                                                                                                                                                                                                                                MD5:9D28433EA8FFBFE0C2870FEDA025F519
                                                                                                                                                                                                                                SHA1:4CC5CF74114D67934D346BB39CA76F01F7ACC3E2
                                                                                                                                                                                                                                SHA-256:FC296145AE46A11C472F99C5BE317E77C840C2430FBB955CE3F913408A046284
                                                                                                                                                                                                                                SHA-512:66B4D00100D4143EA72A3F603FB193AFA6FD4EFB5A74D0D17A206B5EF825E4CC5AF175F5FB5C40C022BDE676BA7A83087CB95C9F57E701CA4E7F0A2FCE76E599
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_MD2.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):14336
                                                                                                                                                                                                                                Entropy (8bit):5.140195114409974
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:RsiHXqpo0cUp8XnUp8XjEQnlDtJI6rcqgcx2:f6DcUp8XUp8AclDA69gcx2
                                                                                                                                                                                                                                MD5:8A92EE2B0D15FFDCBEB7F275154E9286
                                                                                                                                                                                                                                SHA1:FA9214C8BBF76A00777DFE177398B5F52C3D972D
                                                                                                                                                                                                                                SHA-256:8326AE6AD197B5586222AFA581DF5FE0220A86A875A5E116CB3828E785FBF5C2
                                                                                                                                                                                                                                SHA-512:7BA71C37AAF6CB10FC5C595D957EB2846032543626DE740B50D7CB954FF910DCF7CEAA56EB161BAB9CC1F663BADA6CA71973E6570BAC7D6DA4D4CC9ED7C6C3DA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_MD4.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13824
                                                                                                                                                                                                                                Entropy (8bit):5.203867759982304
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:WsiHXqpwUiv6wPf+4WVrd1DFrCqwWwcqgfvE:s6biio2Pd1DFmlgfvE
                                                                                                                                                                                                                                MD5:FE16E1D12CF400448E1BE3FCF2D7BB46
                                                                                                                                                                                                                                SHA1:81D9F7A2C6540F17E11EFE3920481919965461BA
                                                                                                                                                                                                                                SHA-256:ADE1735800D9E82B787482CCDB0FBFBA949E1751C2005DCAE43B0C9046FE096F
                                                                                                                                                                                                                                SHA-512:A0463FF822796A6C6FF3ACEBC4C5F7BA28E7A81E06A3C3E46A0882F536D656D3F8BAF6FB748008E27F255FE0F61E85257626010543FC8A45A1E380206E48F07C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text...X........................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_MD5.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):15360
                                                                                                                                                                                                                                Entropy (8bit):5.478301937972917
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:hZ9WXA7M93g8U7soSchhiLdjM5J6ECTGmDZkRsP0rcqgjPrvE:8Q0gH7zSccA5J6ECTGmDua89gjPrvE
                                                                                                                                                                                                                                MD5:34EBB5D4A90B5A39C5E1D87F61AE96CB
                                                                                                                                                                                                                                SHA1:25EE80CC1E647209F658AEBA5841F11F86F23C4E
                                                                                                                                                                                                                                SHA-256:4FC70CB9280E414855DA2C7E0573096404031987C24CF60822854EAA3757C593
                                                                                                                                                                                                                                SHA-512:82E27044FD53A7309ABAECA06C077A43EB075ADF1EF0898609F3D9F42396E0A1FA4FFD5A64D944705BBC1B1EBB8C2055D8A420807693CC5B70E88AB292DF81B7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%. ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):18432
                                                                                                                                                                                                                                Entropy (8bit):5.69608744353984
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:nkP5RjF7GsIyV6Lx41NVYaVmtShQRKAa8+DSngkov:onx7RI26LuuHKz8+DbN
                                                                                                                                                                                                                                MD5:42C2F4F520BA48779BD9D4B33CD586B9
                                                                                                                                                                                                                                SHA1:9A1D6FFA30DCA5CE6D70EAC5014739E21A99F6D8
                                                                                                                                                                                                                                SHA-256:2C6867E88C5D3A83D62692D24F29624063FCE57F600483BAD6A84684FF22F035
                                                                                                                                                                                                                                SHA-512:1F0C18E1829A5BAE4A40C92BA7F8422D5FE8DBE582F7193ACEC4556B4E0593C898956065F398ACB34014542FCB3365DC6D4DA9CE15CB7C292C8A2F55FB48BB2B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.*... ......P.....................................................`..........................................I.......J..d....p.......`..................,....D..............................PC..@............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data...8....P.......>..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc..,............F..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_SHA1.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19456
                                                                                                                                                                                                                                Entropy (8bit):5.7981108922569735
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:qPHNP3MjevhSY/8EBbVxcJ0ihTLdFDuPHgj+kf4D:sPcKvr/jUJ0sbDGAj+t
                                                                                                                                                                                                                                MD5:AB0BCB36419EA87D827E770A080364F6
                                                                                                                                                                                                                                SHA1:6D398F48338FB017AACD00AE188606EB9E99E830
                                                                                                                                                                                                                                SHA-256:A927548ABEA335E6BCB4A9EE0A949749C9E4AA8F8AAD481CF63E3AC99B25A725
                                                                                                                                                                                                                                SHA-512:3580FB949ACEE709836C36688457908C43860E68A36D3410F3FA9E17C6A66C1CDD7C081102468E4E92E5F42A0A802470E8F4D376DAA4ED7126818538E0BD0BC4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.0..........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text..../.......0.................. ..`.rdata.......@.......4..............@..@.data........P.......B..............@....pdata..X....`.......D..............@..@.rsrc........p.......H..............@..@.reloc..,............J..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_SHA224.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):22016
                                                                                                                                                                                                                                Entropy (8bit):5.865452719694432
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:y1jwGPJHLvzcY1EEerju9LcTZ6RO3RouLKtcyDNOcwgjxo:QjwyJUYToZwOLuzDNB1j
                                                                                                                                                                                                                                MD5:C8FE3FF9C116DB211361FBB3EA092D33
                                                                                                                                                                                                                                SHA1:180253462DD59C5132FBCCC8428DEA1980720D26
                                                                                                                                                                                                                                SHA-256:25771E53CFECB5462C0D4F05F7CAE6A513A6843DB2D798D6937E39BA4B260765
                                                                                                                                                                                                                                SHA-512:16826BF93C8FA33E0B5A2B088FB8852A2460E0A02D699922A39D8EB2A086E981B5ACA2B085F7A7DA21906017C81F4D196B425978A10F44402C5DB44B2BF4D00A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_SHA256.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):22016
                                                                                                                                                                                                                                Entropy (8bit):5.867732744112887
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:51jwGPJHLxzcY1EEerju9LcTZ6RO3RouLKtcyDNIegjxo:rjwyJOYToZwOLuzDNI7j
                                                                                                                                                                                                                                MD5:A442EA85E6F9627501D947BE3C48A9DD
                                                                                                                                                                                                                                SHA1:D2DEC6E1BE3B221E8D4910546AD84FE7C88A524D
                                                                                                                                                                                                                                SHA-256:3DBCB4D0070BE355E0406E6B6C3E4CE58647F06E8650E1AB056E1D538B52B3D3
                                                                                                                                                                                                                                SHA-512:850A00C7069FFDBA1EFE1324405DA747D7BD3BA5D4E724D08A2450B5A5F15A69A0D3EAF67CEF943F624D52A4E2159A9F7BDAEAFDC6C689EACEA9987414250F3B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_SHA384.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):27136
                                                                                                                                                                                                                                Entropy (8bit):5.860044313282322
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:xFDL3RqE3MjjQ95UnLa+1WT1aA7qHofg5JptfISH2mDDXfgjVx2:jDLh98jjRe+1WT1aAeIfMzxH2mDDIj
                                                                                                                                                                                                                                MD5:59BA0E05BE85F48688316EE4936421EA
                                                                                                                                                                                                                                SHA1:1198893F5916E42143C0B0F85872338E4BE2DA06
                                                                                                                                                                                                                                SHA-256:C181F30332F87FEECBF930538E5BDBCA09089A2833E8A088C3B9F3304B864968
                                                                                                                                                                                                                                SHA-512:D772042D35248D25DB70324476021FB4303EF8A0F61C66E7DED490735A1CC367C2A05D7A4B11A2A68D7C34427971F96FF7658D880E946C31C17008B769E3B12F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.J..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text...hH.......J.................. ..`.rdata..X....`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_SHA512.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):27136
                                                                                                                                                                                                                                Entropy (8bit):5.917025846093607
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:tFYLXRqEnMgj969GUnLa+1WT1aA7qHofg5JptfIS320DXwElrgjhig:PYLB9Mgj0e+1WT1aAeIfMzx320DXD+j
                                                                                                                                                                                                                                MD5:8194D160FB215498A59F850DC5C9964C
                                                                                                                                                                                                                                SHA1:D255E8CCBCE663EE5CFD3E1C35548D93BFBBFCC0
                                                                                                                                                                                                                                SHA-256:55DEFCD528207D4006D54B656FD4798977BD1AAE6103D4D082A11E0EB6900B08
                                                                                                                                                                                                                                SHA-512:969EEAA754519A58C352C24841852CF0E66C8A1ADBA9A50F6F659DC48C3000627503DDFB7522DA2DA48C301E439892DE9188BF94EEAF1AE211742E48204C5E42
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.J..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12800
                                                                                                                                                                                                                                Entropy (8bit):4.999870226643325
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:DzFRF/1nb2mhQtk4axusjfkgZhoYDQgRjcqgQvEty:DzFd2f64axnTTz5D1gQvEty
                                                                                                                                                                                                                                MD5:C89BECC2BECD40934FE78FCC0D74D941
                                                                                                                                                                                                                                SHA1:D04680DF546E2D8A86F60F022544DB181F409C50
                                                                                                                                                                                                                                SHA-256:E5B6E58D6DA8DB36B0673539F0C65C80B071A925D2246C42C54E9FCDD8CA08E3
                                                                                                                                                                                                                                SHA-512:715B3F69933841BAADC1C30D616DB34E6959FD9257D65E31C39CD08C53AFA5653B0E87B41DCC3C5E73E57387A1E7E72C0A668578BD42D5561F4105055F02993C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d....e.........." ...%............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13312
                                                                                                                                                                                                                                Entropy (8bit):5.025153056783597
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:AF/1nb2mhQtks0iiNqdF4mtPjD02A5APYcqgYvEL2x:62f6fFA/4GjDFcgYvEL2x
                                                                                                                                                                                                                                MD5:C4CC05D3132FDFB05089F42364FC74D2
                                                                                                                                                                                                                                SHA1:DA7A1AE5D93839577BBD25952A1672C831BC4F29
                                                                                                                                                                                                                                SHA-256:8F3D92DE840ABB5A46015A8FF618FF411C73009CBAA448AC268A5C619CF84721
                                                                                                                                                                                                                                SHA-512:C597C70B7AF8E77BEEEBF10C32B34C37F25C741991581D67CF22E0778F262E463C0F64AA37F92FBC4415FE675673F3F92544E109E5032E488F185F1CFBC839FE
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_keccak.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):16384
                                                                                                                                                                                                                                Entropy (8bit):5.235115741550938
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:XTRgffnRaNfBj9xih1LPK73jm6AXiN4rSRIh42gDhgvrjcqgCieT3WQ:XafgNpj9cHW3jqXeBRamDOZgCieT
                                                                                                                                                                                                                                MD5:1E201DF4B4C8A8CD9DA1514C6C21D1C4
                                                                                                                                                                                                                                SHA1:3DC8A9C20313AF189A3FFA51A2EAA1599586E1B2
                                                                                                                                                                                                                                SHA-256:A428372185B72C90BE61AC45224133C4AF6AE6682C590B9A3968A757C0ABD6B4
                                                                                                                                                                                                                                SHA-512:19232771D4EE3011938BA2A52FA8C32E00402055038B5EDF3DDB4C8691FA7AE751A1DC16766D777A41981B7C27B14E9C1AD6EBDA7FFE1B390205D0110546EE29
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%."... ......P.....................................................`.........................................`I......TJ..d....p.......`..p...............,....C...............................B..@............@...............................text...(!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......6..............@....pdata..p....`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Hash\_poly1305.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):15360
                                                                                                                                                                                                                                Entropy (8bit):5.133714807569085
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:JZNGXEgvUh43G6coX2SSwmPL4V7wTdDlpaY2cqgWjvE:EVMhuGGF2L4STdDyYWgWjvE
                                                                                                                                                                                                                                MD5:76C84B62982843367C5F5D41B550825F
                                                                                                                                                                                                                                SHA1:B6DE9B9BD0E2C84398EA89365E9F6D744836E03A
                                                                                                                                                                                                                                SHA-256:EBCD946F1C432F93F396498A05BF07CC77EE8A74CE9C1A283BF9E23CA8618A4C
                                                                                                                                                                                                                                SHA-512:03F8BB1D0D63BF26D8A6FFF62E94B85FFB4EA1857EB216A4DEB71C806CDE107BA0F9CC7017E3779489C5CEF5F0838EDB1D70F710BCDEB629364FC288794E6AFE
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%..... ......P.....................................................`......................................... 9.......9..d....`.......P..|............p..,....3...............................1..@............0...............................text...X........................... ..`.rdata..(....0......."..............@..@.data........@.......2..............@....pdata..|....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Math\_modexp.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):35840
                                                                                                                                                                                                                                Entropy (8bit):5.928082706906375
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:8bEkzS7+k9rMUb8cOe9rs9ja+V/Mhjh56GS:8bEP779rMtcOCs0I/Mhf
                                                                                                                                                                                                                                MD5:B41160CF884B9E846B890E0645730834
                                                                                                                                                                                                                                SHA1:A0F35613839A0F8F4A87506CD59200CCC3C09237
                                                                                                                                                                                                                                SHA-256:48F296CCACE3878DE1148074510BD8D554A120CAFEF2D52C847E05EF7664FFC6
                                                                                                                                                                                                                                SHA-512:F4D57351A627DD379D56C80DA035195292264F49DC94E597AA6638DF5F4CF69601F72CC64FC3C29C5CBE95D72326395C5C6F4938B7895C69A8D839654CFC8F26
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.|.U./.U./.U./.-a/.U./.*...U./A-...U./.U./!U./.*...U./.*...U./.*...U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.^...0......`.....................................................`..........................................~..|...\...d...............................,....s...............................q..@............p..(............................text...8].......^.................. ..`.rdata.......p.......b..............@..@.data................v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Protocol\_scrypt.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12288
                                                                                                                                                                                                                                Entropy (8bit):4.799063285091512
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:nkCfXASTMeAk4OepIXcADp/X6RcqgO5vE:ZJMcPepIXcAD563gO5vE
                                                                                                                                                                                                                                MD5:BA46602B59FCF8B01ABB135F1534D618
                                                                                                                                                                                                                                SHA1:EFF5608E05639A17B08DCA5F9317E138BEF347B5
                                                                                                                                                                                                                                SHA-256:B1BAB0E04AC60D1E7917621B03A8C72D1ED1F0251334E9FA12A8A1AC1F516529
                                                                                                                                                                                                                                SHA-512:A5E2771623DA697D8EA2E3212FBDDE4E19B4A12982A689D42B351B244EFBA7EFA158E2ED1A2B5BC426A6F143E7DB810BA5542017AB09B5912B3ECC091F705C6E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*...*...*...RQ..*...U...*..R...*...*...*...U...*...U...*...U...*......*......*...=..*......*..Rich.*..................PE..d....e.........." ...%............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):754688
                                                                                                                                                                                                                                Entropy (8bit):7.624959985050181
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:I1UrmZ9HoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h9:gYmzHoxJFf1p34hcrn5Go9yQO6L
                                                                                                                                                                                                                                MD5:3F20627FDED2CF90E366B48EDF031178
                                                                                                                                                                                                                                SHA1:00CED7CD274EFB217975457906625B1B1DA9EBDF
                                                                                                                                                                                                                                SHA-256:E36242855879D71AC57FBD42BB4AE29C6D80B056F57B18CEE0B6B1C0E8D2CF57
                                                                                                                                                                                                                                SHA-512:05DE7C74592B925BB6D37528FC59452C152E0DCFC1D390EA1C48C057403A419E5BE40330B2C5D5657FEA91E05F6B96470DDDF9D84FF05B9FD4192F73D460093C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&:..b[.Lb[.Lb[.Lk#sLd[.Lw$.M`[.L)#.Ma[.Lb[.LI[.Lw$.Mn[.Lw$.Mj[.Lw$.Ma[.LX..Mg[.LX..Mc[.LX..Lc[.LX..Mc[.LRichb[.L........................PE..d....e.........." ...%.n..........`.....................................................`..........................................p..d...tq..d...............0...............4...@Z...............................Y..@...............(............................text....l.......n.................. ..`.rdata...............r..............@..@.data................j..............@....pdata..0............r..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\PublicKey\_ed25519.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):27648
                                                                                                                                                                                                                                Entropy (8bit):5.792654050660321
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:hBwi/rOF26VZW1n0n/Is42g9qhrnW0mvPauYhz35sWJftjb1Ddsia15gkbQ0e1:/L/g28Ufsxg9GmvPauYLxtX1D/kf
                                                                                                                                                                                                                                MD5:290D936C1E0544B6EC98F031C8C2E9A3
                                                                                                                                                                                                                                SHA1:CAEEA607F2D9352DD605B6A5B13A0C0CB1EA26EC
                                                                                                                                                                                                                                SHA-256:8B00C859E36CBCE3EC19F18FA35E3A29B79DE54DA6030AAAD220AD766EDCDF0A
                                                                                                                                                                                                                                SHA-512:F08B67B633D3A3F57F1183950390A35BF73B384855EAAB3AE895101FBC07BCC4990886F8DE657635AD528D6C861BC2793999857472A5307FFAA963AA6685D7E8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..........)......................................R......R......RE.....R.....Rich...........PE..d....e.........." ...%.F...(......P.....................................................`..........................................j..0....k..d...............................,...pc..............................0b..@............`...............................text...xD.......F.................. ..`.rdata.."....`.......J..............@..@.data................\..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..,............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\PublicKey\_ed448.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):67072
                                                                                                                                                                                                                                Entropy (8bit):6.060461288575063
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:nqctkGACFI5t35q2JbL0UbkrwwOoKXyMH1B7M9rMdccdWxRLpq:nqctkGACFI5t35q2JbgrwwOoqLTM9rMh
                                                                                                                                                                                                                                MD5:5782081B2A6F0A3C6B200869B89C7F7D
                                                                                                                                                                                                                                SHA1:0D4E113FB52FE1923FE05CDF2AB9A4A9ABEFC42E
                                                                                                                                                                                                                                SHA-256:E72E06C721DD617140EDEBADD866A91CF97F7215CBB732ECBEEA42C208931F49
                                                                                                                                                                                                                                SHA-512:F7FD695E093EDE26FCFD0EE45ADB49D841538EB9DAAE5B0812F29F0C942FB13762E352C2255F5DB8911F10FA1B6749755B51AAE1C43D8DF06F1D10DE5E603706
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.|.U./.U./.U./.-a/.U./.*...U./A-...U./.U./!U./.*...U./.*...U./.*...U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.....8......`........................................@............`.........................................`...h.......d.... .......................0..,.......................................@............................................text............................... ..`.rdata..*...........................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..,....0......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\PublicKey\_x25519.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):10752
                                                                                                                                                                                                                                Entropy (8bit):4.488437566846231
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:tpVVdJvbrqTu6ZdpvY0IluLfcC75JiC4cs89EfqADwhDTAbcX6gn/7EC:5VddiT7pgTctdErDwDTicqgn/7
                                                                                                                                                                                                                                MD5:289EBF8B1A4F3A12614CFA1399250D3A
                                                                                                                                                                                                                                SHA1:66C05F77D814424B9509DD828111D93BC9FA9811
                                                                                                                                                                                                                                SHA-256:79AC6F73C71CA8FDA442A42A116A34C62802F0F7E17729182899327971CFEB23
                                                                                                                                                                                                                                SHA-512:4B95A210C9A4539332E2FB894D7DE4E1B34894876CCD06EEC5B0FC6F6E47DE75C0E298CF2F3B5832C9E028861A53B8C8E8A172A3BE3EC29A2C9E346642412138
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.h.r.h.r.h.{...p.h.g.i.p.h.9.i.q.h.r.i.V.h.g.m.y.h.g.l.z.h.g.k.q.h.H.`.s.h.H.h.s.h.H...s.h.H.j.s.h.Richr.h.........................PE..d....e.........." ...%............P........................................p............`..........................................'..P...0(..P....P.......@...............`..,...P#..............................."..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Util\_cpuid_c.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):10240
                                                                                                                                                                                                                                Entropy (8bit):4.730605326965181
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:MJVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EVAElIijKDQGrbMZYJWJcX6gbW6s:CVddiT7pgTctEEaEDKDlMCWJcqgbW6
                                                                                                                                                                                                                                MD5:4D9C33AE53B38A9494B6FBFA3491149E
                                                                                                                                                                                                                                SHA1:1A069E277B7E90A3AB0DCDEE1FE244632C9C3BE4
                                                                                                                                                                                                                                SHA-256:0828CAD4D742D97888D3DFCE59E82369317847651BBA0F166023CB8ACA790B2B
                                                                                                                                                                                                                                SHA-512:BDFBF29198A0C7ED69204BF9E9B6174EBB9E3BEE297DD1EB8EB9EA6D7CAF1CC5E076F7B44893E58CCF3D0958F5E3BDEE12BD090714BEB5889836EE6F12F0F49E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`..........................................'..|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Crypto\Util\_strxor.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):10240
                                                                                                                                                                                                                                Entropy (8bit):4.685843290341897
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:6ZVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EMz3DHWMoG4BcX6gbW6O:IVddiT7pgTctEEO3DLoHcqgbW6
                                                                                                                                                                                                                                MD5:8F4313755F65509357E281744941BD36
                                                                                                                                                                                                                                SHA1:2AAF3F89E56EC6731B2A5FA40A2FE69B751EAFC0
                                                                                                                                                                                                                                SHA-256:70D90DDF87A9608699BE6BBEDF89AD469632FD0ADC20A69DA07618596D443639
                                                                                                                                                                                                                                SHA-512:FED2B1007E31D73F18605FB164FEE5B46034155AB5BB7FE9B255241CFA75FF0E39749200EB47A9AB1380D9F36F51AFBA45490979AB7D112F4D673A0C67899EF4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Pythonwin\mfc140u.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5653424
                                                                                                                                                                                                                                Entropy (8bit):6.729277267882055
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:EuEsNcEc8/CK4b11P5ViH8gw0+NVQD5stWIlE7lva8iposS9j5fzSQzs7ID+AVuS:EnL8+5fiEnQFLOAkGkzdnEVomFHKnPS
                                                                                                                                                                                                                                MD5:03A161718F1D5E41897236D48C91AE3C
                                                                                                                                                                                                                                SHA1:32B10EB46BAFB9F81A402CB7EFF4767418956BD4
                                                                                                                                                                                                                                SHA-256:E06C4BD078F4690AA8874A3DEB38E802B2A16CCB602A7EDC2E077E98C05B5807
                                                                                                                                                                                                                                SHA-512:7ABCC90E845B43D264EE18C9565C7D0CBB383BFD72B9CEBB198BA60C4A46F56DA5480DA51C90FF82957AD4C84A4799FA3EB0CEDFFAA6195F1315B3FF3DA1BE47
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d....~.a.........." .....(-..X)......X,.......................................V......YV...`A..........................................:.....h.;.......?......`=..8....V..'...PU.0p..p.5.T...........................`...8............@-.P...0.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\Pythonwin\win32ui.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1143296
                                                                                                                                                                                                                                Entropy (8bit):6.042100978272984
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:+jUcbgAIjeB47XV6LMDANfo4KR0fpCTuWpG0LwP8Ehzf3N:+DbOG47X3ANfoNnTt40TEhL3
                                                                                                                                                                                                                                MD5:0E96B5724C2213300864CEB36363097A
                                                                                                                                                                                                                                SHA1:151931D9162F9E63E8951FC44A9B6D89AF7AF446
                                                                                                                                                                                                                                SHA-256:85CF3081B0F1ADAFDBDCF164D7788A7F00E52BACDF02D1505812DE4FACFC962F
                                                                                                                                                                                                                                SHA-512:46E8FEE7B12F061EA8A7AB0CD4A8E683946684388498D6117AFC404847B9FBB0A16DC0E5480609B1352DF8F61457DCDBDA317248CA81082CC4F30E29A3242D3B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k.N..~...~...~..r....~.v.....~..a....~...z...~...}...~...{...~.......~.......~.v.w...~.v.~...~.v.....~.v.|...~.Rich..~.........................PE..d......d.........." .........r......T.....................................................`.........................................@....T..Hr..h...............................p\..p...T.......................(......8................0...........................text............................... ..`.rdata..f...........................@..@.data...............................@....pdata...............d..............@..@.rsrc...............................@..@.reloc..p\.......^..................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\VCRUNTIME140.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):119192
                                                                                                                                                                                                                                Entropy (8bit):6.6016214745004635
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
                                                                                                                                                                                                                                MD5:BE8DBE2DC77EBE7F88F910C61AEC691A
                                                                                                                                                                                                                                SHA1:A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
                                                                                                                                                                                                                                SHA-256:4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
                                                                                                                                                                                                                                SHA-512:0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\VCRUNTIME140_1.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):49528
                                                                                                                                                                                                                                Entropy (8bit):6.662491747506177
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
                                                                                                                                                                                                                                MD5:F8DFA78045620CF8A732E67D1B1EB53D
                                                                                                                                                                                                                                SHA1:FF9A604D8C99405BFDBBF4295825D3FCBC792704
                                                                                                                                                                                                                                SHA-256:A113F192195F245F17389E6ECBED8005990BCB2476DDAD33F7C4C6C86327AFE5
                                                                                                                                                                                                                                SHA-512:BA7F8B7AB0DEB7A7113124C28092B543E216CA08D1CF158D9F40A326FB69F4A2511A41A59EA8482A10C9EC4EC8AC69B70DFE9CA65E525097D93B819D498DA371
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9@.W}!..}!..}!...S...!..{....!..tYJ.v!..}!..N!..{...x!..{...z!..{...f!..{...|!..{.&.|!..{...|!..Rich}!..................PE..d.....v..........." ...&.<...8.......B...................................................`A........................................Pm.......m..x....................r..xO......D....c..p...........................`b..@............P..`............................text...p:.......<.................. ..`.rdata...#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\_asyncio.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):65304
                                                                                                                                                                                                                                Entropy (8bit):6.188956852878315
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:g2NcWvZEvWjtzE6OAz9WFIbOnP17Sy/xXY:g2NcefdE6OAz9WFIbOn9DY
                                                                                                                                                                                                                                MD5:41806866D74E5EDCE05EDC0AD47752B9
                                                                                                                                                                                                                                SHA1:C3D603C029FDAC45BAC37BB2F449FAB86B8845DD
                                                                                                                                                                                                                                SHA-256:76DB93BD64CB4A36EDB37694456F89BB588DB98CF2733EB436F000B309EEC3B2
                                                                                                                                                                                                                                SHA-512:2A019EFAF3315B8B98BE93AC4BEA15CEC8B9ECC6EAB298FA93D3947BAD2422B5A126D52CB4998363BDC82641FBA9B8F42D589AFE52D02914E55A5A6116989FDE
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z2.T.Sq..Sq..Sq..+...Sq..,p..Sq..,t..Sq..,u..Sq..,r..Sq.$.p..Sq.U+p..Sq..Sp..Sq.$.|..Sq.$.q..Sq.$...Sq.$.s..Sq.Rich.Sq.................PE..d......e.........." ...%.R..........`.....................................................`.........................................@...P.......d......................../..........`w..T........................... v..@............p...............................text....P.......R.................. ..`.rdata...J...p...L...V..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\_bz2.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):84760
                                                                                                                                                                                                                                Entropy (8bit):6.5702075964298015
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:xqgz7lGeu595+NHRGYWlnswz108Lh3uwtIbCVW7Syqx7T:AgzxAbl3nLhJtIbCVW8T
                                                                                                                                                                                                                                MD5:37EACE4B806B32F829DE08DB3803B707
                                                                                                                                                                                                                                SHA1:8A4E2BB2D04685856D1DE95B00F3FFC6EA1E76B9
                                                                                                                                                                                                                                SHA-256:1BE51EF2B5ACBE490217AA1FF12618D24B95DF6136C6844714B9CA997B4C7F9B
                                                                                                                                                                                                                                SHA-512:1591A263DE16373EE84594943A0993721B1E1A2F56140D348A646347A8E9760930DF4F632ADCEE9C9870F9C20D7818A3A8C61B956723BF94777E0B7FB7689B2D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R...S..R.....R...W..R...V..R...Q..R...S..R..S..R..S..R..._..R...R..R......R...P..R.Rich.R.........................PE..d...)..e.........." ...%.....^...............................................P....../.....`.........................................p...H............0....... .. ......../...@..........T...........................p...@............................................text...G........................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\_cffi_backend.cp311-win_amd64.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):178176
                                                                                                                                                                                                                                Entropy (8bit):6.165902427203749
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:87aw5iwiVHprp0+/aSdXUONX9dAXS7qkSTLkKh23/qZl:87kBVHplaSdRj4LkSTLLhW/q
                                                                                                                                                                                                                                MD5:739D352BD982ED3957D376A9237C9248
                                                                                                                                                                                                                                SHA1:961CF42F0C1BB9D29D2F1985F68250DE9D83894D
                                                                                                                                                                                                                                SHA-256:9AEE90CF7980C8FF694BB3FFE06C71F87EB6A613033F73E3174A732648D39980
                                                                                                                                                                                                                                SHA-512:585A5143519ED9B38BB53F912CEA60C87F7CE8BA159A1011CF666F390C2E3CC149E0AC601B008E039A0A78EAF876D7A3F64FFF612F5DE04C822C6E214BC2EFDE
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A:.#.[.p.[.p.[.p.#.p.[.p..q.[.p..zp.[.p..q.[.p..q.[.p..q.[.pN#.q.[.pj.q.[.p.[.p.[.pM.q.[.p.#.p.[.pM.q.[.pM.xp.[.pM.q.[.pRich.[.p................PE..d......f.........." ...).....B............................................... ............`.........................................PX..l....X.......................................?...............................=..@............................................text...X........................... ..`.rdata..............................@..@.data....].......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\_ctypes.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):124696
                                                                                                                                                                                                                                Entropy (8bit):6.042889733169693
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:bZMeF788mzTWJMNufLI2qV6phIzRIbLPMV:bmeGWWNufLI2ichyZ
                                                                                                                                                                                                                                MD5:A25CDCF630C024047A47A53728DC87CD
                                                                                                                                                                                                                                SHA1:8555AE488E0226A272FD7DB9F9BDBB7853E61A21
                                                                                                                                                                                                                                SHA-256:3D43869A4507ED8ECE285AE85782D83BB16328CF636170ACB895C227EBB142AC
                                                                                                                                                                                                                                SHA-512:F6A4272DEDDC5C5C033A06E80941A16F688E28179EAB3DBC4F7A9085EA4AD6998B89FC9AC501C5BF6FEA87E0BA1D9F2EDA819AD183B6FA7B6DDF1E91366C12AF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........X...X...X...Q.*.^...M...Z...M...T...M...P...M...\...b...Z.......Y.......^.......[...X.......b...^...b...Y...b.F.Y...b...Y...RichX...........PE..d...%..e.........." ...%.............\....................................................`..........................................Q.......Q..................P......../..............T...........................`...@............................................text............................... ..`.rdata..2m.......n..................@..@.data...$=...p...8...`..............@....pdata..P...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\_decimal.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):253720
                                                                                                                                                                                                                                Entropy (8bit):6.552393878399124
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:F4aNJPKHCXqKEyKOxVpclJeMvfrZNxKl9qWM53pLW1A+6teJCxc:O2JyHCXqKIMpgeMnr5K4lRxc
                                                                                                                                                                                                                                MD5:E4E032221ACA4033F9D730F19DC3B21A
                                                                                                                                                                                                                                SHA1:584A3B4BC26A323CE268A64AAD90C746731F9A48
                                                                                                                                                                                                                                SHA-256:23BDD07B84D2DBCB077624D6DCBFC66AB13A9EF5F9EEBE31DC0FFECE21B9E50C
                                                                                                                                                                                                                                SHA-512:4A350BA9E8481B66E7047C9E6C68E6729F8074A29EF803ED8452C04D6D61F8F70300D5788C4C3164B0C8FB63E7C9715236C0952C3166B606E1C7D7FFF36B7C4C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mBP\.,.\.,.\.,.Ut..R.,.Is-.^.,.Is).Q.,.Is(.T.,.Is/.X.,.f.-._.,..t-.^.,.\.-...,.f./.].,.f.!.S.,.f.,.].,.f...].,.f...].,.Rich\.,.........PE..d......e.........." ...%.x...<.......................................................2....`......................................... T..P...pT...................&......./......P.......T...........................`...@............................................text...1v.......x.................. ..`.rdata..l............|..............@..@.data....*...p...$...T..............@....pdata...&.......(...x..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\_hashlib.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):65304
                                                                                                                                                                                                                                Entropy (8bit):6.254250311701017
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:0WuY1lTorKnYzF9G0pLOjWNBgFIbOIp7Sy0Vxu:tuYc9GIOjiBgFIbOIpqC
                                                                                                                                                                                                                                MD5:BA682DFCDD600A4BB43A51A0D696A64C
                                                                                                                                                                                                                                SHA1:DF85AD909E9641F8FCAA0F8F5622C88D904E9E20
                                                                                                                                                                                                                                SHA-256:2AD55E11BDDB5B65CDF6E9E126D82A3B64551F7AD9D4CBF74A1058FD7E5993BD
                                                                                                                                                                                                                                SHA-512:79C607E58881D3C3DFB83886FE7AA4CDDB5221C50499D33FE21E1EFB0FFA1FD0D3F52CBE97B16B04FBE2B067D6EB5997AC66DEC9D2A160D3CB6D44FFCA0F5636
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t..n'..n'..n'..'..n'.o&..n'.k&..n'.j&..n'.m&..n'..o&..n'.xo&..n'..o'r.n'.xc&..n'.xn&..n'.x.'..n'.xl&..n'Rich..n'........PE..d...D..e.........." ...%.T...~......0@...............................................~....`.............................................P................................/......X...P}..T............................|..@............p..0............................text....S.......T.................. ..`.rdata..rO...p...P...X..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\_lzma.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):159512
                                                                                                                                                                                                                                Entropy (8bit):6.8416618325941725
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:OJlBQV6AniiMeSznf09mNogMKNA/ZttIbZ1bW/9:OJlozifF8YOgbihtL
                                                                                                                                                                                                                                MD5:3273720DDF2C5B75B072A1FB13476751
                                                                                                                                                                                                                                SHA1:5FE0A4F98E471EB801A57B8C987F0FEB1781CA8B
                                                                                                                                                                                                                                SHA-256:663F1087C2ED664C5995A3FFA64546D2E33A0FCE8A9121B48CC7C056B74A2948
                                                                                                                                                                                                                                SHA-512:919DBBFCC2F5913655D77F6C4AE9BAA3A300153A5821DC9F23E0ACEB89F69CB9FB86D6CE8F367B9301E0F7B6027E6B2F0911A2E73255AB5150A74B862F8AF18E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RH...)t..)t..)t..Q...)t..Vu..)t..Vq..)t..Vp..)t..Vw..)t.,.u..)t.]Qu..)t..)u.p)t.,.y.,)t.,.t..)t.,....)t.,.v..)t.Rich.)t.................PE..d...F..e.........." ...%.d...........6....................................................`..........................................%..L...\%..x....p.......P.......@.../......8.......T...............................@............................................text....b.......d.................. ..`.rdata..............h..............@..@.data........@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..8............>..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\_multiprocessing.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):34584
                                                                                                                                                                                                                                Entropy (8bit):6.412362180449176
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:rkLI6Rwc95w5lTdywGnJj1IbWtNS5YiSyvjAMxkEHB:kIk95klTdywGJj1IbWtNQ7Sy7xrB
                                                                                                                                                                                                                                MD5:758128E09779A4BAA28E68A8B9EE2476
                                                                                                                                                                                                                                SHA1:4E81C682CF18E2A4B46E50F037799C43C6075F11
                                                                                                                                                                                                                                SHA-256:3C5B0823E30810AEE47FDFAD567491BC33DD640C37E35C8600E75C5A8D05CE2A
                                                                                                                                                                                                                                SHA-512:5096F0DAACF72012A7AD08B177C366B4FE1DED3A18AEBFE438820B79C7CB735350EF831A7FB7D10482EEFD4C0B8A41511042BB41F4507BBC0332C52DF9288088
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........*..y..y..y..y..y...x..y...x..y...x..y...x..y.L.x..y..y..y...x..y.L.x..y.L.x..y.Loy..y.L.x..yRich..y........PE..d......e.........." ...%.....<......0.....................................................`.........................................0D..`....D..x....p.......`.......X.../...........4..T...........................p3..@............0...............................text............................... ..`.rdata..^....0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\_overlapped.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):51480
                                                                                                                                                                                                                                Entropy (8bit):6.391641395965735
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:z4Cryw+9YWFx6Zc7FXuhAnYRlgVvEEkC59fYJIbXtA5YiSyvgrAMxkEDV:zJh8FXZVvvkCnfYJIbXtS7Sy4LxN
                                                                                                                                                                                                                                MD5:E2A301B3FD3BDFEC3BF6CA006189B2AC
                                                                                                                                                                                                                                SHA1:86B29EE1A42DE70135A6786CDCE69987F1F61193
                                                                                                                                                                                                                                SHA-256:4990F62E11C0A5AB15A9FFCE9D054F06D0BC9213AEA0C2A414A54FA01A5EB6DC
                                                                                                                                                                                                                                SHA-512:4E5493CC4061BE923B253164FD785685D5ECCF16FD3ACB246B9D840F6F7D9ED53555F53725AF7956157D89EAA248A3505C30BD88C26E04AABDAE62E4774FFA4E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8j.{|.w(|.w(|.w(us.(x.w(itv)~.w(itr)p.w(its)t.w(itt)..w(F.v)~.w(|.v(..w(7sv)y.w(7ss)}.w(F.z)}.w(F.w)}.w(F..(}.w(F.u)}.w(Rich|.w(................PE..d......e.........." ...%.B...Z......p.....................................................`............................................X...(............................/......,....f..T............................e..@............`...............................text...NA.......B.................. ..`.rdata...5...`...6...F..............@..@.data................|..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\_queue.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):32536
                                                                                                                                                                                                                                Entropy (8bit):6.447575038735403
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:c+yFY6rbXmxU1RIbQU+5YiSyvzZAMxkEC:c+wJbXWU1RIbQU07SyLBxu
                                                                                                                                                                                                                                MD5:284FBC1B32F0282FC968045B922A4EE2
                                                                                                                                                                                                                                SHA1:7CCEA7A48084F2C8463BA30DDAE8AF771538AE82
                                                                                                                                                                                                                                SHA-256:AC3B144D7D7C8EE39F29D8749C5A35C4314B5365198821605C883FD11807E766
                                                                                                                                                                                                                                SHA-512:BAA75F7553CF595AD78C84CBB0F2A50917C93596ECE1FF6221E64272ADC6FACDD8376E00918C6C3246451211D9DFC66442D31759BD52C26985C7F133CF011065
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z2.X.Sa..Sa..Sa..+...Sa..,`..Sa..,d..Sa..,e..Sa..,b..Sa.$.`..Sa.U+`..Sa..S`.TSa.$.l..Sa.$.a..Sa.$...Sa.$.c..Sa.Rich.Sa.................PE..d......e.........." ...%.....8............................................................`..........................................C..L....C..d....p.......`.......P.../..........p4..T...........................03..@............0..0............................text............................... ..`.rdata..R....0......................@..@.data...x....P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\_socket.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):79640
                                                                                                                                                                                                                                Entropy (8bit):6.290718686906052
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:sEbflgPFXTcf3uj79/s+S+pzpp+iTFVf7JRIbLw87Sy8Ckxt:smG1U3uj79/sT+pzH+YFVTJRIbLw8eCg
                                                                                                                                                                                                                                MD5:485D998A2DE412206F04FA028FE6BA90
                                                                                                                                                                                                                                SHA1:286E29D4F91A46171BA1E3C8229E6DE94B499F1D
                                                                                                                                                                                                                                SHA-256:8F9EDE5044643413C3B072CD31A565956498CA07CDD17FB6A04483D388FDAD76
                                                                                                                                                                                                                                SHA-512:68591522E9188F06FF81CD2B3506B40B9AD508D6E34F0111819BF5EFF47ED9ADF95EBFAE5D05B685C4F53B186D15CC45E0D831D96BE926F7A5762EE2F1341F1F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h...............q.......v.......v.......v.......v.......................q........................l.............Rich....................PE..d...@..e.........." ...%.l...........%.......................................P......G.....`.............................................P............0....... ..x......../...@..........T...............................@............................................text...*k.......l.................. ..`.rdata...t.......v...p..............@..@.data...............................@....pdata..x.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\_sqlite3.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):120088
                                                                                                                                                                                                                                Entropy (8bit):6.256550171739811
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:w2nLU/Nk3qkD0ii3CLl147ZvV9NdrRvdO5ylAuCoVMJtcMYqsJFIbOQ5e:XLU/NgqkVD5ZJtOP
                                                                                                                                                                                                                                MD5:8C9F7BEEEEB75816CC0C1F8474023029
                                                                                                                                                                                                                                SHA1:96A49C164BDFCE7A0D90D87074E0C9B5F8077610
                                                                                                                                                                                                                                SHA-256:D077E236B709B5242D62CE4923FEDDBFCC719EC26612ED474ED3B25EE290D0AC
                                                                                                                                                                                                                                SHA-512:ABA229C8B843C07EA8D59AC901D06263A3EEFE6824E71C4B4BEB47D5071BE34068F13CE13A962B0A8583C834C3DC4D045185C47FB8B2922E853FDB78BF4F6F77
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............`..`..`.....`...a...`.....`...e..`...d..`...c...`..:a..`...a...`..a..`..:m..`..:`..`..:...`..:b..`.Rich.`.........PE..d...C..e.........." ...%............p...............................................-D....`..........................................Z..P....Z.........................../..............T...........................p...@............................................text............................... ..`.rdata..l...........................@..@.data................n..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\_ssl.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):176920
                                                                                                                                                                                                                                Entropy (8bit):5.955569171525942
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:UZIQQj5DC1z/39/2uX36XjRylB9d43Olh59YL48PMrN/WgAlNiVtIbC7N7d:rj5mRPxb36Xj44TLiVn
                                                                                                                                                                                                                                MD5:E5B1A076E9828985EA8EA07D22C6ABD0
                                                                                                                                                                                                                                SHA1:2A2827938A490CD847EA4E67E945DEB4EEF8CBB1
                                                                                                                                                                                                                                SHA-256:591589DADC659D1AD4856D16CD25DC8E57EAA085BF68EB2929F8F93ABA69DB1B
                                                                                                                                                                                                                                SHA-512:0AFD20F581EFB08A7943A1984E469F1587C96252E44B3A05CA3DFB6C7B8B9D1B9FD609E03A292DE6EC63B6373AEACC822E30D550B2F2D35BF7BF8DD6FC11F54F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........wf*...y...y...y.n.y...y.i.x...y.i.x...y.i.x...y.i.x...y...x...y...yL..y.n.x...y...x...y...x...y...y...y...x...yRich...y........................PE..d...C..e.........." ...%............l+....................................................`.........................................0...d................................/......|...P...T...............................@............................................text.............................. ..`.rdata...".......$..................@..@.data...............................@....pdata...............\..............@..@.rsrc................h..............@..@.reloc..|............r..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-console-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19864
                                                                                                                                                                                                                                Entropy (8bit):6.993481836017306
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:vWEhWQy36q0GftpBjqVsVERHRN75UVplCADZgJq:/0kisKEBq8ADZg4
                                                                                                                                                                                                                                MD5:7699C096202DA0DB6B07FAFC914D60ED
                                                                                                                                                                                                                                SHA1:6E952BE34B9457B0CC3E4AA372D941030407A0FC
                                                                                                                                                                                                                                SHA-256:0052515763A1A31D2527A2EB2523FB7B88D8E55C4E4DA5EF352B565476BF21E0
                                                                                                                                                                                                                                SHA-512:AE93507CAE8D2096C688850D369F8EF282699770B1E27621ED8EBEEDE1BB285A290F1E2E06A6E9287A05C243B907371977501F1AA4181810913763E0D5BCC2C0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0......u\....`.........................................`...+............ ...................?..............8............................................................................rdata..@...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-datetime-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19352
                                                                                                                                                                                                                                Entropy (8bit):7.001842888356878
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:4WEhWRMoq0GftpBjCtOSbERHRN7qlZwHcC:ufaiEbEBGwB
                                                                                                                                                                                                                                MD5:928BE2A3FC2E88BDA5CA0808324E97C4
                                                                                                                                                                                                                                SHA1:B1E1BF73C5DFA99AD69BDC83EC6B6F65CEF1C3E2
                                                                                                                                                                                                                                SHA-256:CC6C2FDF1C34FA82036165B111F91220BCF7E43AAB79DFB284F982F0590BEBB1
                                                                                                                                                                                                                                SHA-512:FC83A74DBD60ADA174798D7F40D839F30EF4A288805121EA8D303E39C5FC81188F9EE86131C3DF3E2B37EDFCCA2BFEB3F69AA14E93A0D5D87A6255C6E87C73A7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`................ ...................?..............8............................................................................rdata..$...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-debug-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19352
                                                                                                                                                                                                                                Entropy (8bit):7.007097657416164
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:EWEhWbC2Jq0GftpBjDNACiERHRN7lVTdlrltm:SoLifNiEBDl
                                                                                                                                                                                                                                MD5:4CB14835B061F42179D5251E744FD667
                                                                                                                                                                                                                                SHA1:4A1B0B32963A20C479927E4E008BFA9B4168F226
                                                                                                                                                                                                                                SHA-256:F9AAAABF78FEB39A1D8E971F5CE047D1C4A896A80409B800F1F7112CDCE420ED
                                                                                                                                                                                                                                SHA-512:20C11B2DCF8A928D04CFE6A0130716CC474D48C996025950214D6F9E97BF26B0EC6E2A68F954B0875FC05CA49811BC6E943F91B592FECD14CC8FDDD3201841E9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0......43....`.........................................`................ ...................?..............8............................................................................rdata..0...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-errorhandling-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19376
                                                                                                                                                                                                                                Entropy (8bit):7.031341799850956
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:QvfC5WEhWHy36q0GftpBjTIPaHHCERHRN7sylTIw3R/E/M9:Qi5FkifCEBjR/mC
                                                                                                                                                                                                                                MD5:6177998C2CE574A177E524746B77EFE7
                                                                                                                                                                                                                                SHA1:21F262C4826E6EDD8534A9196AFDFAE9AC0E3D51
                                                                                                                                                                                                                                SHA-256:A0AA340274D4BB46B6D9547D647AB7DC16C229577BBAB836E6A4F3307F310332
                                                                                                                                                                                                                                SHA-512:AF8D6BBACD38B23F48F27BB472BEB81EE4EE6200AE54317D282ADA104252777B57B056FD5DE5FF0463EDE1BE8B734A8741D80C65A70B37910C13F04D85005117
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0............`.........................................`................ ...................?..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-file-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):22928
                                                                                                                                                                                                                                Entropy (8bit):6.941304537427584
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:SBPvVX7WEhWqC2Jq0GftpBjQXERHRN7qulfgOBU/Xwm:yPvVXD3LiaXEBuW2X5
                                                                                                                                                                                                                                MD5:33636552339A4A04D75B7C32DBEC59D9
                                                                                                                                                                                                                                SHA1:6457C3941D57BEBBC3A737C84377D102B6ECE18F
                                                                                                                                                                                                                                SHA-256:05B478718540A6F410A3AD859F7D5E56C223D6786EACC7E9BC80264F587FD0C7
                                                                                                                                                                                                                                SHA-512:B0F9FFED8B8861C9599E5CF0FBC5374E7CD8D170A360A3DFEB37D381DABEF941875EAF325666978071D25AA8F49D729684D8BE71D12C1B5A8928A7C00156ED03
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................@............`.........................................`................0...................?..............8............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-file-l1-2-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19344
                                                                                                                                                                                                                                Entropy (8bit):7.019387794302155
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:8ZWEhW4Moq0GftpBjbFZERHRN7rklkETkA:8ZGaiDZEBLETf
                                                                                                                                                                                                                                MD5:9D8413744097196F92327F632A85ACEE
                                                                                                                                                                                                                                SHA1:DFC07F5E5A0634DD1F15FDC9FF9731748FBFF919
                                                                                                                                                                                                                                SHA-256:6878D8168D5CC159EFE58F14E5BA10310D99B53AB8495521E54C966994DAC50B
                                                                                                                                                                                                                                SHA-512:A8F6E9EE1C5D65F68B8B20D406D3E666C186E15CB3B92575257B5637FE7DD5AC7D75E9AD51C839BA4490512F68F6B48822FC9EDD316DD7625D3627D3B975FB2A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0............`.........................................`...L............ ...................?..............8............................................................................rdata..\...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-file-l2-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19336
                                                                                                                                                                                                                                Entropy (8bit):7.07368062664954
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:oVxWEhWWy36q0GftpBjHAdsERHRN7wUlZwHcv:oVhukiqdsEBwUww
                                                                                                                                                                                                                                MD5:361C6BCFCEA263749419B0FBED7A0CE8
                                                                                                                                                                                                                                SHA1:03DB13108CE9D5FC01CECF3199619FFBCCBD855A
                                                                                                                                                                                                                                SHA-256:B74AEFD6FA638BE3F415165C8109121A2093597421101ABC312EE7FFA1130278
                                                                                                                                                                                                                                SHA-512:AA8B585000CC65F9841B938E4523D91D8F6DB650E0B4BB11EFD740C27309BF81CDB77F05D0BEDA2489BF26F4FBC6D02C93CE3B64946502E2C044EEA89696CC76
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...).NV.........." .........................................................0......kw....`.........................................`................ ...................?..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-handle-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19352
                                                                                                                                                                                                                                Entropy (8bit):7.021074039268697
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:fWEhWmy36q0GftpBj4PERHRN7lmlfgOBU/g:POkiuPEBtW2g
                                                                                                                                                                                                                                MD5:C2CD29370B21C0361D7F79D248C05860
                                                                                                                                                                                                                                SHA1:52EFDA4BA402C793D4C75E6CE185720AE1432249
                                                                                                                                                                                                                                SHA-256:550B4F5BA95108B01A24F05496576A4E73642334A10DDE61B09846E0EFB9F260
                                                                                                                                                                                                                                SHA-512:D2165032403277BA10BFBB7861BBE7395A8B0847A669588D3780953D07C1B0EA4461ACC49753E8D4978840307B1C50F9E814AB5B62B8E341159E02109BCBAB71
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0............`.........................................`..._............ ...................?..............8............................................................................rdata..t...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-heap-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19856
                                                                                                                                                                                                                                Entropy (8bit):6.9919788904502065
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:VlzWEhW9Moq0GftpBjEwkcERHRN7AuhlCADZgJAq:LHaiwcEB4ADZgN
                                                                                                                                                                                                                                MD5:E93F34FDCD8E5FFC34AF48C90F6F95D1
                                                                                                                                                                                                                                SHA1:1CDAFB0DFB29712D37307BC5E5EDEFAB0EEF6D78
                                                                                                                                                                                                                                SHA-256:ECA63FC5C873CE8B36C507E2B9A88CAAEA9617C84669886B15F6BC38BD0024C6
                                                                                                                                                                                                                                SHA-512:3BF430A6A20B020F60627AE68D6385F3ABB7A89B16CCCC4AED1939C28527680FCE7A426F69353041C7AC50A177A8E7C3A631078E46BC73A8BF0E2B2E83A779A8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0.......m....`.........................................`................ ...................?..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-interlocked-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19368
                                                                                                                                                                                                                                Entropy (8bit):7.0296234740052705
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:GWEhW4C2Jq0GftpBjG/ERHRN7YlTIw3R/E/Mp1:cRLiKEB+R/mU1
                                                                                                                                                                                                                                MD5:28FD20B58320F0ED023D9CA19DA3A06D
                                                                                                                                                                                                                                SHA1:B7948DA624D84596055A9AE2A45AEA3A9B2D7B9B
                                                                                                                                                                                                                                SHA-256:2F2F9660F4FFA814F465676D5B9CB9BB70D0B7C5FC5EB14C34CFE94A50883B21
                                                                                                                                                                                                                                SHA-512:822E34CACC70EE151FF534F960D0820AE7D184A764B41CE23828E8E0E80DAF4888F528C9B1351A76883EEA2C6EB9674C8418F1787C1999EA06191D67D3928418
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`................ ...................?..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-libraryloader-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19888
                                                                                                                                                                                                                                Entropy (8bit):7.038753075266474
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:svuBL3BXWEhWDy36q0GftpBjxCnERHRN7n81lZwHcK:fBL3B3RkiCEB8xwv
                                                                                                                                                                                                                                MD5:B45F933A57E388CFC5399645CDB696F3
                                                                                                                                                                                                                                SHA1:D85450A4169C79B249D4EF64AD475F6645DC311C
                                                                                                                                                                                                                                SHA-256:2F9C3B077DA02C587964A59E9C4E2F383FF8357229EAB4B4F04814DF94D78FF0
                                                                                                                                                                                                                                SHA-512:E0DF0637BDAA4293EF0B4C0A5B9E40E5D2EA891DBB2CE465394EFEF8A1F07DF52630069E63D5E800575BA55C78C79CE095AACE3983258B4C576CDE500EF3A3BE
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0.......X....`.........................................`................ ...................?..............8............................................................................rdata..(...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-localization-l1-2-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):21936
                                                                                                                                                                                                                                Entropy (8bit):7.020074477976467
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:NOMw3zdp3bwjGjue9/0jCRrndbkWEhW9Moq0GftpBjciv9ERHRN7h3olfgOBU/J2:NOMwBprwjGjue9/0jCRrndbyDaiysEBY
                                                                                                                                                                                                                                MD5:B402ED77D6F31D825BDA175DBC0C4F92
                                                                                                                                                                                                                                SHA1:1F2A4B8753B3AAE225FEAC5487CC0011B73C0EB7
                                                                                                                                                                                                                                SHA-256:6ED17FB3CA5156B39FBC1EF7D1EEFA95E739857607DE4CD8D41CECFCD1350705
                                                                                                                                                                                                                                SHA-512:EC04013139F3FD9DBF22B92121D82B2EB97E136F8619790CDE2D0B660280E838962F9006D3E4C3A359627B017F2B6ADE7EDFF3BBC26E559C3DE37540585602D9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0......Y[....`.........................................`................ ...................?..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-memory-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19856
                                                                                                                                                                                                                                Entropy (8bit):7.015225750103134
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:QqWEhWdfC2Jq0GftpBj42ERHRN7LXLlZwHc6k:riLi5EBDLwu
                                                                                                                                                                                                                                MD5:CA3906B115461654EED0DB5933EEF5D5
                                                                                                                                                                                                                                SHA1:0F03527A70C14413A7D114431F60D610D1805B8B
                                                                                                                                                                                                                                SHA-256:76A3AA52D49DD0D8E0451F4045F4D8BA05D2332D0DB2A39408B85CD2E43B84A3
                                                                                                                                                                                                                                SHA-512:CE6E067C528C76714C01CD2AAF052E170C2DB0F77EEC6486D15F08DF357ABE06A849B56506F89B95F1431A942B2B515F9CC626C7EC2847F4289FB613C91F6122
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`...l............ ...................?..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-namedpipe-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19360
                                                                                                                                                                                                                                Entropy (8bit):7.074084808178223
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:XWEhWCy36q0GftpBj/2QERHRN7nlkETk0:3qkil2QEByET/
                                                                                                                                                                                                                                MD5:F24F386CFA5F097B523CCFBA5C8CDCA3
                                                                                                                                                                                                                                SHA1:FC97363843226BB69B8A1F56D8B8735A087AC103
                                                                                                                                                                                                                                SHA-256:B1B2595494072A52F1FC44586DEBF52312EAB1A245A7A16185D7B1AF37B159A6
                                                                                                                                                                                                                                SHA-512:EB6C38A7CA3B627FC52B8DE65E8564004923B4533B9C4C920666D1D4C32C762E65CC181742B39C688654C8639DF6A385F7EA1FBE50A89471B2F938F897DF4278
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0......%.....`.........................................`................ ...................?..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-processenvironment-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20424
                                                                                                                                                                                                                                Entropy (8bit):6.985652301775137
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:TWWEhWcaCIc3q0GftpBj6Iz4ERHRN7soIslfgOBU/g:oti34EBsdW2g
                                                                                                                                                                                                                                MD5:04729245832E3BF24CB5B28F9C2E9C1C
                                                                                                                                                                                                                                SHA1:1AACEA212EA11758AB8C6C64CF7C501A3F713696
                                                                                                                                                                                                                                SHA-256:BF11319EB6BE15633E47AB8F247D1ACC9A9ECDF37181FC0DDFE9388AB82AC90A
                                                                                                                                                                                                                                SHA-512:11001746AA23C5999778D9A17892DA029DFF5E8E34265EFB40AB5704F4D5F52CC4750EFBE0D8B911E1AEB1875E4F0A4398655E1BF63143ABAD83B39643C00B5A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0............`.........................................`...G............ ...................?..............8............................................................................rdata..h...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-processthreads-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):21432
                                                                                                                                                                                                                                Entropy (8bit):7.014491925577937
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:OWXk1JzNcKSImWEhWqC2Jq0GftpBj1vzt6ERHRN7+OlTIw3R/E/Mb:ObcKSdjLirAEB1R/mU
                                                                                                                                                                                                                                MD5:C9DBB0DE9907BB628F5733C81F973462
                                                                                                                                                                                                                                SHA1:DD51E5840BA634F8FF0D6B57510622C16BA4706A
                                                                                                                                                                                                                                SHA-256:7646EBA0C683FC3E1B00F0B3B2B5912621B2016A6CEB7D53181CD1C3FA64785A
                                                                                                                                                                                                                                SHA-512:E9B754B6A79808EF353F3991EA98B951867308AB73CAE2A666B039922190394A73BCC849744823A77754519C3E5178213D75E5B787B18032AB9BE0A5DCB2A813
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0......qJ....`.........................................`................ ...................?..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-processthreads-l1-1-1.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19896
                                                                                                                                                                                                                                Entropy (8bit):7.0278343042073805
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:9DfIeAWEhWdC2Jq0GftpBjDL8ERHRN79j9lkETk8O:Gem6LiJ8EB9gETPO
                                                                                                                                                                                                                                MD5:3D872BE898581F00D0310D7AB9ABAF2B
                                                                                                                                                                                                                                SHA1:420E0AB98BB748723130DE414F0FFED117EF3F7E
                                                                                                                                                                                                                                SHA-256:4DE821884CBEF4182B29D8C33CFE13E43E130AD58EE1281679E8D40A2EDCB8EA
                                                                                                                                                                                                                                SHA-512:35CFB9888A5F4299403A0D9C57F0BA79E3625431A9ACC5E04AE2AE101B3DC521A0DCFF5D4A1BF508B25DBF05DD432F6987D860FF494D15538ED95673A8B7376B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`................ ...................?..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-profile-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):18840
                                                                                                                                                                                                                                Entropy (8bit):7.100702524260397
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:uVhWEhWoC2Jq0GftpBjJnERHRN75QrrhlkETkFd:q1Li3EB5UrwETgd
                                                                                                                                                                                                                                MD5:AEC5EBAC6404B541565026C3CB290E0B
                                                                                                                                                                                                                                SHA1:E541075842DE9DD7D0400CA0E55019D080697AB5
                                                                                                                                                                                                                                SHA-256:4CA44EDE30B46F1F23905CECFA27F0EDB26EE960DBA10F9BF8002D79ED77C3E5
                                                                                                                                                                                                                                SHA-512:74F4D501460C4A6F93888AE9B25D9732584C07EFD86ED9487B0D75E71E2EB03A840C37002C74967738088804192D42B9B443F5A826C8D66F1171232F6166D93E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0............`.........................................`................ ...................?..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-rtlsupport-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19880
                                                                                                                                                                                                                                Entropy (8bit):6.991784429601899
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:cGeVdWEhWm4y36q0GftpBjjQJykGERHRN7zQTlfgOBU/pMw:cGeVFpHki5SZGEBzbW2pL
                                                                                                                                                                                                                                MD5:B8CEC282FB1491EB1D2BE2D969E96FE2
                                                                                                                                                                                                                                SHA1:F9011802509B3BF617E76D5B0F16A2802749A5BF
                                                                                                                                                                                                                                SHA-256:09B7F0A7F68A12602E7F4DBD5A7F1CDFB3E93FD54326884E48F36E2E200ACCE9
                                                                                                                                                                                                                                SHA-512:339B6D129B4660F2FD377BF28F6819E941BA7D36377C9B59A1B9098C3BFEF0A62D4955E9A5338F09174C6A875AC1F420EFF5C422F63AB00194E2BA206FD42ED3
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0.......!....`.........................................`................ ...................?..............8............................................................................rdata..,...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-string-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19352
                                                                                                                                                                                                                                Entropy (8bit):7.046756061074216
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:9yMvfWEhWcC2Jq0GftpBjKuERHRN7l2wlfgOBU/2:9yMvP9LikuEBgxW22
                                                                                                                                                                                                                                MD5:059BB41588D83C95CAEAC5D06CB0B59F
                                                                                                                                                                                                                                SHA1:C8B26D26AE2118D7AE25FC87399FB2CD03E7F4DA
                                                                                                                                                                                                                                SHA-256:3EDA46E395FAD6EC222AB44188D6A46A468B0FD4AFF28252938F4E6A9A3E3893
                                                                                                                                                                                                                                SHA-512:0F4C0208BBEA87EC54453D718FAE2F4708524B3B6923B947E96A8C465DD8A9DE00BE2E5C90CB2B39A24D064DBED5417E7F954981689E89EA50B2C769C0BE64E1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0......7^....`.........................................`................ ...................?..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-synch-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):21392
                                                                                                                                                                                                                                Entropy (8bit):6.96535561797727
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:Ldv3V0dfpkXc0vVaEWEhW3YDy36q0GftpBj0eERHRN7mlgHrIQ8:Ldv3VqpkXc0vVaSqBkivEBjrIl
                                                                                                                                                                                                                                MD5:56BE6B76756E6D4F81DFB8F251B63739
                                                                                                                                                                                                                                SHA1:BB1DF800B0728D965FCC754DAD08AE63D6B54C06
                                                                                                                                                                                                                                SHA-256:83C1DF33DF30DF48AB161A5A1D6C3CB4BDAEBFF330EE6E81E871AFE3990D7A65
                                                                                                                                                                                                                                SHA-512:C6B453ED68E2FEFDBA53928AAC6AC6B79D1366C427370BA6043A795C0EAF79A77BAC9E019F4413E24B8EEA9A787125C01B839C08DAD0099A79751C2BF73AC128
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0......j.....`.........................................`...V............ ...................?..............8............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-synch-l1-2-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19856
                                                                                                                                                                                                                                Entropy (8bit):7.060103337490769
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:xtZ3lWEhWtE8y36q0GftpBjEn9ERHRN71QUlfgOBU/ml:7t7kis9EB1QVW2A
                                                                                                                                                                                                                                MD5:1742DA4D8DF54767064BCB50B4B5C32D
                                                                                                                                                                                                                                SHA1:50F0AE8E41F0EB2573F41B308882610C6897C574
                                                                                                                                                                                                                                SHA-256:E000C6685719C2B07355C1EDDBFDAE7C6794AA6C0AC883D34AF33DFC8BF40779
                                                                                                                                                                                                                                SHA-512:99823EA5553CEDE3A0C8C19A3BDD18E31E2BA92BF7EE4808257B660F621DE66EB596CFCB7BE5C13EBE8DDD3759809F258C4ECDD72D8D39D9C2D10B9624CB3D95
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0............`.........................................`...v............ ...................?..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-sysinfo-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20376
                                                                                                                                                                                                                                Entropy (8bit):6.987462274389362
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:vB2WEhW3y36q0GftpBjPjERHRN7ogDlCADZgJz:vBslkidjEBoRADZg1
                                                                                                                                                                                                                                MD5:79B6580C25F8C572376CBF39BB41BE05
                                                                                                                                                                                                                                SHA1:40DBA231AD9CFD891BCE54C44DC9F73E54C8532B
                                                                                                                                                                                                                                SHA-256:F5BF492FE568EB57D2E7111B1C3927F1EE897B5A1109BC68EBE011A2DFDEF2FE
                                                                                                                                                                                                                                SHA-512:E5A64E4F7AFC8693634F5D92AA5EF6F4C241CA2F246A641B728D54C1E82E856793DBEC40F4FD9A2653E962C0B6A4F179221594B3084116A7995AF5E3E769DDFA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0......O.....`.........................................`...E............ ...................?..............8............................................................................rdata..\...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-timezone-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19360
                                                                                                                                                                                                                                Entropy (8bit):7.0871177471347195
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:MWEhWhy36q0GftpBj+YERHRN7nwlCADZgJc:KLkiHEBnJADZgy
                                                                                                                                                                                                                                MD5:6C180C8DE3ECF27DE7A5812FF055737E
                                                                                                                                                                                                                                SHA1:3AAD20B71BB374BB2C5F7431A1B75B60956A01FD
                                                                                                                                                                                                                                SHA-256:630466FD77AC7009C947A8370A0D0C20652169824C54DDCB8C05E8DF45E23197
                                                                                                                                                                                                                                SHA-512:E4AA79EB2B6B3BE9B545E8CB8B43CD6052036DC5CCE7077BE40441B9942931B30D76C475D550A178D4E94C9C366CABC852F500E482B7FDCD361FC2A08E41C00E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0......C2....`.........................................`................ ...................?..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-core-util-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19336
                                                                                                                                                                                                                                Entropy (8bit):7.00947187660432
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:/PWEhWvaNy3WUuDBks/nGfe4pBjSHdWm78RFAII1RHnhWgN7acWcrD+Rqnajjvun:nWEhWIy36q0GftpBjtERHRN77elZwHc+
                                                                                                                                                                                                                                MD5:0C33A3762C1E583342D80E9B6483F74B
                                                                                                                                                                                                                                SHA1:0EF41C8C68BE764D6C2F23E04279D6F12F32603C
                                                                                                                                                                                                                                SHA-256:187D47EBCC1E96ABE635F23C92D2C63FC8CD741FCB03FE2DD5FC3054CB3D6D92
                                                                                                                                                                                                                                SHA-512:93C907AE0C864A4FBA5EEF82AA2473FCBB5F376906A6918896294A4259F5B062A6FE4D9E455FC43741004ED928D8C6BB4D4BC10479BC9A4AC81A711542EC229F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0......$f....`.........................................`...9............ ...................?..............8............................................................................rdata..L...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-conio-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20368
                                                                                                                                                                                                                                Entropy (8bit):7.0048171461365465
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:LN+WEhW0C2Jq0GftpBjNgfERHRN79lCADZgJJ:mpLiUfEBiADZgn
                                                                                                                                                                                                                                MD5:84A950E3C162D67F98516BB1744139E0
                                                                                                                                                                                                                                SHA1:05FF2FE60C5748C33BA8605AAF609B3BDFE2772F
                                                                                                                                                                                                                                SHA-256:91F4DB05C69C58ECB2493E30ACC5297043C41B1CE6DB50CEE4E2922CD4BCD7F2
                                                                                                                                                                                                                                SHA-512:7328C6A512D450F2538EFEABF3F467489A898ED7C1D45C1952B98D118D898083510C9849182BC425411A408C113A351A28B41BEDEB5B8DE61427144B3FA87C80
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`................ ...................?..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-convert-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):23448
                                                                                                                                                                                                                                Entropy (8bit):6.8592303562068695
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:WDyuWEhWYy36q0GftpBjBt6ERHRN7Kr3lgHrIQDm:yokiTt6EB0ArIz
                                                                                                                                                                                                                                MD5:D749AFFFA2B3BE4B2A9EDAC50C20B28B
                                                                                                                                                                                                                                SHA1:972253ED12C344B85290F7B3D5F9608A7F7B0670
                                                                                                                                                                                                                                SHA-256:E64FBAC3491B4693E79A3F7B0DB1D788F93608D3FC82133EDF25A868C80D2153
                                                                                                                                                                                                                                SHA-512:4447B6960A6C178F7C37DBD38E9AEC24BA5A0C58E19AFCFAA2B70DCA7D7BBE87AD7AA1AC9D48AB9B56B1F375768D4C4CB28D5AFCF714102F9757FAA2B3E728D9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................@............`.........................................`................0...................?..............8............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-environment-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19872
                                                                                                                                                                                                                                Entropy (8bit):6.992251797681991
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:BWEhWxy36q0GftpBjUERHRN7QklgHrIQQ:RHki+EBQRrIN
                                                                                                                                                                                                                                MD5:7A2874FE036F7DC86ED5F712ADAA38E6
                                                                                                                                                                                                                                SHA1:440F2DC5379CEEE35D29571C195DC7A76E8B70E7
                                                                                                                                                                                                                                SHA-256:DD054E4DE84144C2130FA8D28D563252A7C4089A58872E49D63BC43C9A1A3CB8
                                                                                                                                                                                                                                SHA-512:D20811025F714B5FD3754D607422F4FB5CD6C456FFCEEF139EDCB0CFAACD9B63A694CE2EA737DB78385F0B23DDCFC283282A319B79E7A0E4BD50034E87AACB9A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`..."............ ...................?..............8............................................................................rdata..<...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-filesystem-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):21408
                                                                                                                                                                                                                                Entropy (8bit):7.005777635258922
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:r81nWm5CcWEhWMLy36q0GftpBjhERHRN7qEOlZwHcs:rOnWm5C6rmki/EBIwv
                                                                                                                                                                                                                                MD5:73E14D927D075CA273B3237116351E8F
                                                                                                                                                                                                                                SHA1:0C15CEA3C83C7F7E692DC6F8BD856B615C727D49
                                                                                                                                                                                                                                SHA-256:966A7F15BFB2E0FF7888D583638EBD675D8F46B264194CF332F78140B7C129E1
                                                                                                                                                                                                                                SHA-512:664F72D7ADF48F8499321F8A5DF952C6043532AAE09BAE9FFBD59DA77B161CD43211A3AAEF1BA85529DFE00498D1AC3A933A7C9CF437095C6A337C9BC0816B3F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0.......]....`.........................................`................ ...................?..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-heap-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20360
                                                                                                                                                                                                                                Entropy (8bit):6.973623049512662
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:4QWEhWJC2Jq0GftpBj+WU9ERHRN7LlgHrIQ3m:4WyLiC9EBMrIf
                                                                                                                                                                                                                                MD5:01370C79EBABD534E7B58D35072D2866
                                                                                                                                                                                                                                SHA1:8CD0CD21FF838A2A314246DEF4BD858BAB184A5D
                                                                                                                                                                                                                                SHA-256:742BB9BF4C232F84AD8008AF4AF8EDA7A1EC3EB76F05D9D7EBB95F6A5CABD2D8
                                                                                                                                                                                                                                SHA-512:B07D9634AC804B476D61B6A0FC87894947E88744CC3EECF7D68EDE3714ACD938FAE14452E43F9110919B8F8F9F5D4222E9DE2CA97A915DD07B3231D674729761
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`................ ...................?..............8............................................................................rdata..(...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-locale-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19856
                                                                                                                                                                                                                                Entropy (8bit):7.051566271525755
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:b9DWEhWIy36q0GftpBjyK5ERHRN7WlgHrIQsa:NEkizEBTrI7a
                                                                                                                                                                                                                                MD5:BACB72FA56DE18D5AC63E4A0A3FE768F
                                                                                                                                                                                                                                SHA1:7DB19EFE649D30337781AFD62616C0549255046E
                                                                                                                                                                                                                                SHA-256:25905676B543C4F05E9DAE135F929C03A57686A6941CE59BE2B3450521FEB943
                                                                                                                                                                                                                                SHA-512:78D82962C11E5928E77C5BD0377ECB6B00C2ECA242D637F76E68FBF907BCE7381F3A5294100D055C30F6E2AEE164DB0B95DCF0C0C77E39EDCEC4A046CFC63ED4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0......-.....`.........................................`...e............ ...................?..............8............................................................................rdata..|...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-math-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):28552
                                                                                                                                                                                                                                Entropy (8bit):6.654016239428645
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:FZVacWM4Oe59Ckb1hgmLiWEhWXy36q0GftpBjbERHRN7RlgHrIQE+:FZVJWMq59Bb1jQ9ki5EBqrIT+
                                                                                                                                                                                                                                MD5:85893A96A568BA9781F50F876ED303CD
                                                                                                                                                                                                                                SHA1:FB7473BC5B1E88E978B7E5664B45D69770C8F4FA
                                                                                                                                                                                                                                SHA-256:08E34F12DE24E89379A0533F21A23CE6FECBEA05D4062796D4FFD4ADC3012316
                                                                                                                                                                                                                                SHA-512:864FA39423B8CA9C43FA177ACA1484EC2FFAE4868A434E7A8016EFE88F396B67FB8CA3766F611DE7218E9983653A8B7B88B07C2591B252DD93A0D9638980E7FF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........,...............................................P......U.....`.........................................`....%...........@...............0...?..............8............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-multibyte-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):29128
                                                                                                                                                                                                                                Entropy (8bit):4.764864996734757
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:6A/kPLPmIHJI6/CpG3t2G3t4odXLtWBhWUUTNQ3Jllz3VW:R/kjPmIHJI6OXYQr4
                                                                                                                                                                                                                                MD5:2E75BA5BC87963D4244AE9BAC3457466
                                                                                                                                                                                                                                SHA1:A624F1EB6AE3B7EE01FEE889E65E0D7A4253FFA8
                                                                                                                                                                                                                                SHA-256:77328A716589BE3C3BCF1F3D3134B4AD050380F504DBC1A3FA076380D77ED0F8
                                                                                                                                                                                                                                SHA-512:C3AB9BD515A52AA19767F0CBE5EFDC4A8D145BDA959AE13EB3E587C1C20D05C9B3563DC2665699B597D34DA0593F8A324D197C1407ABAAD8118D0D599F5279FC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d................." .........P...............................................`......j.....`A........................................P.... ...........P...............P...!..............p............................................................................rdata..D".......0..................@..@.data........@......................@....rsrc........P.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-process-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20376
                                                                                                                                                                                                                                Entropy (8bit):6.990619239924047
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:OitIlWEhWHy36q0GftpBj05MrERHRN7lQkklfgOBU/Ux:v6dkiomEBPW2Ux
                                                                                                                                                                                                                                MD5:9EE275466394A2088D7DFBBC0C716671
                                                                                                                                                                                                                                SHA1:4D2F94674587251C60805889395AB7377E8C5E17
                                                                                                                                                                                                                                SHA-256:C68A61C260454C0AEB051DDB2BED52CBCA44B96D50046017CBC351B41F225DC0
                                                                                                                                                                                                                                SHA-512:996212D07B0B6E55F54E17D6A053F017B1FD00F50906DB9DE25B8AE5632EEAC9C197E91DB1C293E7ABF0E8B823937CB18E26F43E166F76C02A6914C9776A72B3
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0......n.....`.........................................`...x............ ...................?..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-runtime-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):23960
                                                                                                                                                                                                                                Entropy (8bit):6.8615759821856575
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:E42r77WEhW+y36q0GftpBjLleERHRN7lXMl8tazs:E42r7DSkiNleEBzt9
                                                                                                                                                                                                                                MD5:55B80C522731ECB92914BF9CDED028C2
                                                                                                                                                                                                                                SHA1:424C61BC659CAF04281959EDE1B1F03B703934ED
                                                                                                                                                                                                                                SHA-256:4C787FF8D40BB803E75FE6218FEC36A672CFA6CFC7F6E80E68A7EB0B77A10E5A
                                                                                                                                                                                                                                SHA-512:3779B530C7DBA624369CB0F5D15154D89547ADC3C4C7CC0571F1E8326588165098B9B5768D0052ECF1EA4F2DC84AE7DCF4712E3BC9EBDADB5FCA4B0F4DE43812
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................@............`.........................................`...4............0...................?..............8............................................................................rdata..H...........................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-stdio-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):25480
                                                                                                                                                                                                                                Entropy (8bit):6.8150529690105115
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:u3vAmiFVhFWEhW/y36q0GftpBjpq+cpfERHRN7ulZwHcP1:cvYjNki5eEBSwu
                                                                                                                                                                                                                                MD5:4614D03A94D46C0E9D1C5D96A3FE1D78
                                                                                                                                                                                                                                SHA1:CACB73CA3C7E31A4B8F749854060B7A422497050
                                                                                                                                                                                                                                SHA-256:C7919BE431CE2FA1906FF9EEB19E4CB19A30A4680107EF8737CE894654B21A5A
                                                                                                                                                                                                                                SHA-512:4F30E8C5893662D7889A049C206B08559AD1A34EB7927BE313086D6DAE40DCA3571DE3852DBA2AD9324E028FA86E8A391A58EC48BA5DBD5C4A88660FFE8B30DF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." ......... ...............................................@............`.........................................`...a............0...............$...?..............8............................................................................rdata..t...........................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-string-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):25496
                                                                                                                                                                                                                                Entropy (8bit):6.809287749827101
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:a5yguNvZ5VQgx3SbwA71IkFZjkiJ9EBj8r95j:a5yguNvZ5VQgx3SbwA71Iijkm9EBwx5
                                                                                                                                                                                                                                MD5:7A2799F4BC45505E7104E06DC8E254F8
                                                                                                                                                                                                                                SHA1:323BC35E0101B351A4ABDE1FCE698520832518A8
                                                                                                                                                                                                                                SHA-256:92F72F495A6897F7D7CF2C2064B2B65F6B4FBD4F30911A534A5CD0DE73395EBE
                                                                                                                                                                                                                                SHA-512:2627DA183779F17FCC9709A6DA2E2916A296F61124ADB9BF563C80D723ADA9B769806CAB8FBC4ED916F54FD4CDE18F25E7AD53ED6C75E7E61FDEF37C2F1EC9B2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." ......... ...............................................@......+.....`.........................................`................0...............$...?..............8............................................................................rdata..............................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-time-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):21896
                                                                                                                                                                                                                                Entropy (8bit):6.938332058802964
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:OPEzaWEhWIZC2Jq0GftpBjxERHRN71YXlgHrIQD:E0YPLi7EB3rI2
                                                                                                                                                                                                                                MD5:38B633F132F8E2B3ABC268537FA415EC
                                                                                                                                                                                                                                SHA1:CCCCB8C3E31DCE7B6B952022D245C11FF3AE8122
                                                                                                                                                                                                                                SHA-256:46CB7B3A9F8AAC5ADCDBE23494E458F3195ADF4B8ED1C71F2D934DDDE651E57E
                                                                                                                                                                                                                                SHA-512:23BD77D61C20B1AF7F13B5BCBEB9FA74EE807F809BB3D4DD40C7709CA4870078FA6E8E94EEFC83A725C0245C0CE02E3ADBD4F370D6B986F0C9442CCBC2C2AB96
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0......:U....`.........................................`................ ...................?..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\api-ms-win-crt-utility-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20928
                                                                                                                                                                                                                                Entropy (8bit):4.525945528506043
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:evbjfHQduLWBhWVWYnO/VWQ4uWM6cA5E8qnajTw+CCevq:UfFWBhWFUix5E8lvwDDq
                                                                                                                                                                                                                                MD5:E79464524FBC2C266DA52D0A903D85D3
                                                                                                                                                                                                                                SHA1:6BAD715617992277751A8DDFC180BA291BA75D59
                                                                                                                                                                                                                                SHA-256:6C78D4ABA91877C5BB33E545B6A69A818F377E07FF62E791B804FA5B4D2BCF02
                                                                                                                                                                                                                                SHA-512:DEF71789E238ECD3B2D68DBD204ACC62537AD39CE50A5BF09F320FC8CACC1B3F561822784D006AB2145EAB5AB7BE3F74C1C773FBE814EFA040A1DBB3FFA6744E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d...F............." .........0...............................................@......a9....`A........................................P...^............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\base_library.zip

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1852021
                                                                                                                                                                                                                                Entropy (8bit):5.576123239051486
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:mQR5pATG8/R5lUKdcubgAnyPb6l2X0iwh6E+dmzNPaaMVTC+dWwhcHHY:mQR5pE/R/2vN8+ww1
                                                                                                                                                                                                                                MD5:EA42C63637A86AFC5C6C2A8A6BD39754
                                                                                                                                                                                                                                SHA1:8E1C44CF9E0B05FFEB3A5B52BCA6B0B505D3CB6C
                                                                                                                                                                                                                                SHA-256:C7EB35EEBE6C8E3FD311B1EE5FF1EE6D70AF2D6200782E7D14E61C0958E924BC
                                                                                                                                                                                                                                SHA-512:E124389DBD00E7F9209A324331BB80F860432A3E2CF3217404349F6A2BB085EC9326E0763B0D2B64BB1063A7BD157C006D715BB4F1ABBE5B751278C0B62C454B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:PK..........!.h%..b...b......._collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\certifi\cacert.pem

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):299427
                                                                                                                                                                                                                                Entropy (8bit):6.047872935262006
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
                                                                                                                                                                                                                                MD5:50EA156B773E8803F6C1FE712F746CBA
                                                                                                                                                                                                                                SHA1:2C68212E96605210EDDF740291862BDF59398AEF
                                                                                                                                                                                                                                SHA-256:94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
                                                                                                                                                                                                                                SHA-512:01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\charset_normalizer\md.cp311-win_amd64.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):10752
                                                                                                                                                                                                                                Entropy (8bit):4.673454313041419
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:KG+p72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFliHUWQcX6g8cim1qeSju1:A2HzzU2bRYoeLHkcqgvimoe
                                                                                                                                                                                                                                MD5:723EC2E1404AE1047C3EF860B9840C29
                                                                                                                                                                                                                                SHA1:8FC869B92863FB6D2758019DD01EDBEF2A9A100A
                                                                                                                                                                                                                                SHA-256:790A11AA270523C2EFA6021CE4F994C3C5A67E8EAAAF02074D5308420B68BD94
                                                                                                                                                                                                                                SHA-512:2E323AE5B816ADDE7AAA14398F1FDB3EFE15A19DF3735A604A7DB6CADC22B753046EAB242E0F1FBCD3310A8FBB59FF49865827D242BAF21F44FD994C3AC9A878
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..............................M....................................... ...?.......?.......?.a.....?.......Rich............................PE..d...siAe.........." ...%.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):119296
                                                                                                                                                                                                                                Entropy (8bit):5.872097486056729
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:OzgMw0g+m/+rxC9Jtd960WsCyqPD1/bZMlDML48Be9zGTVmZRJIRbvB:OsTH+VC9Jtd9VdCr7fMp/8yGTVmzmZ
                                                                                                                                                                                                                                MD5:9EA8098D31ADB0F9D928759BDCA39819
                                                                                                                                                                                                                                SHA1:E309C85C1C8E6CE049EEA1F39BEE654B9F98D7C5
                                                                                                                                                                                                                                SHA-256:3D9893AA79EFD13D81FCD614E9EF5FB6AAD90569BEEDED5112DE5ED5AC3CF753
                                                                                                                                                                                                                                SHA-512:86AF770F61C94DFBF074BCC4B11932BBA2511CAA83C223780112BDA4FFB7986270DC2649D4D3EA78614DBCE6F7468C8983A34966FC3F2DE53055AC6B5059A707
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..r...r...r......r...s...r...s...r...w...r...v..r...q...r.#.s...r...s...r..8z...r..8r...r..8....r..8p...r.Rich..r.........................PE..d...siAe.........." ...%.*..........0........................................ ............`.........................................p...d..........................................Px...............................w..@............@...............................text...X).......*.................. ..`.rdata...X...@...Z..................@..@.data...8=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography-43.0.1.dist-info\INSTALLER

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4
                                                                                                                                                                                                                                Entropy (8bit):1.5
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:Mn:M
                                                                                                                                                                                                                                MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:pip.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography-43.0.1.dist-info\METADATA

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5440
                                                                                                                                                                                                                                Entropy (8bit):5.074342830021076
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:DlaQIUQIhQIKQILbQIRIaMPktjaVxsxA2TtLDmplH7dwnqTIvrUmA0JQTQCQx5KN:LcPuP1srTtLDmplH7JTIvYX0JQTQ9x54
                                                                                                                                                                                                                                MD5:554DC6138FDBF98B7F1EDFE207AF3D67
                                                                                                                                                                                                                                SHA1:B6C806E2AFF9A0F560916A90F793348DBF0514BA
                                                                                                                                                                                                                                SHA-256:0064A9B5FD2AC18605E512EF7127318AD9CF259E9445488C169F237A590602E1
                                                                                                                                                                                                                                SHA-512:3A71B533874F4D0F94F15192791D2FA4DF9E8EBF184C711F1D4FA97230C04764C1C9A93258355B08107E5B72053C6901E883E3DB577E8A204D5B9EB3F8BC7BFC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:Metadata-Version: 2.3.Name: cryptography.Version: 43.0.1.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography-43.0.1.dist-info\RECORD

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:CSV text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):15579
                                                                                                                                                                                                                                Entropy (8bit):5.567690749632252
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:bX1Tojoz5jF4ELZVhXau4WPE6FGotqw++NX6in55qw/n+B:bXejohCEJaiPE6FGotqw++96in5+B
                                                                                                                                                                                                                                MD5:850C89F8185D4BD3C91322CED9FF0941
                                                                                                                                                                                                                                SHA1:585713DC0113561CEFD4D2003E9ABBB7FA175077
                                                                                                                                                                                                                                SHA-256:059F4DD4D777F49808924B27DB2B7F7F413DB91729A42F7CD5F10C605AA211CF
                                                                                                                                                                                                                                SHA-512:4DBFAD178A7496CA853951261FD15D99F27D102BAB15EA883FBBD896CA4248B3876DB85E9C25F0D1BB81A741AFE018E16D31AAF23D53EBFCFE893ADDF59AC31E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:cryptography-43.0.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-43.0.1.dist-info/METADATA,sha256=AGSptf0qwYYF5RLvcScxitnPJZ6URUiMFp8jelkGAuE,5440..cryptography-43.0.1.dist-info/RECORD,,..cryptography-43.0.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-43.0.1.dist-info/WHEEL,sha256=8_4EnrLvbhzH224YH8WypoB7HFn-vpbwr_zHlr3XUBI,94..cryptography-43.0.1.dist-info/license_files/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-43.0.1.dist-info/license_files/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-43.0.1.dist-info/license_files/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=pY_pmYXjJTK-LjfCu7ot0NMj0QC2dkD1dCPyV8QjISM,445..cryptography/__init__.py,sha256=mthuUrTd4FROCpUYrTIqhjz6s6T9djAZrV7nZ1oMm2o,364..cryptography/__pycache__/__about__.cpython-311.pyc,,..cryptography/__pycache__/__ini

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography-43.0.1.dist-info\WHEEL

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):94
                                                                                                                                                                                                                                Entropy (8bit):5.016084900984752
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:RtEeX5pGogP+tkKciH/KQb:RtvoTWKTQb
                                                                                                                                                                                                                                MD5:C869D30012A100ADEB75860F3810C8C9
                                                                                                                                                                                                                                SHA1:42FD5CFA75566E8A9525E087A2018E8666ED22CB
                                                                                                                                                                                                                                SHA-256:F3FE049EB2EF6E1CC7DB6E181FC5B2A6807B1C59FEBE96F0AFFCC796BDD75012
                                                                                                                                                                                                                                SHA-512:B29FEAF6587601BBE0EDAD3DF9A87BFC82BB2C13E91103699BABD7E039F05558C0AC1EF7D904BCFAF85D791B96BC26FA9E39988DD83A1CE8ECCA85029C5109F0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:Wheel-Version: 1.0.Generator: maturin (1.7.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography-43.0.1.dist-info\license_files\LICENSE

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):197
                                                                                                                                                                                                                                Entropy (8bit):4.61968998873571
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
                                                                                                                                                                                                                                MD5:8C3617DB4FB6FAE01F1D253AB91511E4
                                                                                                                                                                                                                                SHA1:E442040C26CD76D1B946822CAF29011A51F75D6D
                                                                                                                                                                                                                                SHA-256:3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
                                                                                                                                                                                                                                SHA-512:77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:This software is made available under the terms of *either* of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of *both* these licenses..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography-43.0.1.dist-info\license_files\LICENSE.APACHE

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11360
                                                                                                                                                                                                                                Entropy (8bit):4.426756947907149
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
                                                                                                                                                                                                                                MD5:4E168CCE331E5C827D4C2B68A6200E1B
                                                                                                                                                                                                                                SHA1:DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
                                                                                                                                                                                                                                SHA-256:AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
                                                                                                                                                                                                                                SHA-512:F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography-43.0.1.dist-info\license_files\LICENSE.BSD

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1532
                                                                                                                                                                                                                                Entropy (8bit):5.058591167088024
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
                                                                                                                                                                                                                                MD5:5AE30BA4123BC4F2FA49AA0B0DCE887B
                                                                                                                                                                                                                                SHA1:EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
                                                                                                                                                                                                                                SHA-256:602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
                                                                                                                                                                                                                                SHA-512:DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\cryptography\hazmat\bindings\_rust.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):7900672
                                                                                                                                                                                                                                Entropy (8bit):6.519460416205842
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:Hvisa2OcIo0UYN1YA2sBCT7I0XIU6iOGtlqNVwASO0AIjoI+b0vjemXSKSDhxlT3:Pi/2PTYDBCT7NY+gTNxY7GbdJ295x
                                                                                                                                                                                                                                MD5:81AD4F91BB10900E3E2E8EAF917F42C9
                                                                                                                                                                                                                                SHA1:840F7AEF02CDA6672F0E3FC7A8D57F213DDD1DC6
                                                                                                                                                                                                                                SHA-256:5F20D6CEC04685075781996A9F54A78DC44AB8E39EB5A2BCF3234E36BEF4B190
                                                                                                                                                                                                                                SHA-512:11CD299D6812CDF6F0A74BA86EB44E9904CE4106167EBD6E0B81F60A5FCD04236CEF5CFF81E51ED391F5156430663056393DC07353C4A70A88024194768FFE9D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..(...(...(...!...:...8...*...8...,...8... ...8...9...c..&...G...*...(...+...`...V...(.....`...)...`...)...Rich(...........................PE..d....j.f.........." ...).`Z..V........X.......................................x...........`.........................................p.r.......r...............t...............x......Cj.T....................Cj.(....Aj.@............pZ..............................text...._Z......`Z................. ..`.rdata..ZR...pZ..T...dZ.............@..@.data....+....r.......r.............@....pdata........t.......s.............@..@.reloc........x.......w.............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\libcrypto-3.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5191960
                                                                                                                                                                                                                                Entropy (8bit):5.962142634441191
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
                                                                                                                                                                                                                                MD5:E547CF6D296A88F5B1C352C116DF7C0C
                                                                                                                                                                                                                                SHA1:CAFA14E0367F7C13AD140FD556F10F320A039783
                                                                                                                                                                                                                                SHA-256:05FE080EAB7FC535C51E10C1BD76A2F3E6217F9C91A25034774588881C3F99DE
                                                                                                                                                                                                                                SHA-512:9F42EDF04C7AF350A00FA4FDF92B8E2E6F47AB9D2D41491985B20CD0ADDE4F694253399F6A88F4BDD765C4F49792F25FB01E84EC03FD5D0BE8BB61773D77D74D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l..l..l......l...m..l...i..l...h..l...o..l..m.y.l...m...l...o..l...h.l...l..l......l...n..l.Rich.l.........PE..d......e.........." ...%..7..4......v.........................................O.......P...`.........................................P.H.0....kN.@.....N.|.....K.d.....O../....N....P.C.8.............................C.@............`N..............................text.....7.......7................. ..`.rdata....... 7.......7.............@..@.data....n....K..<....J.............@....pdata..0.....K......4K.............@..@.idata...%...`N..&....N.............@..@.00cfg..u.....N.......N.............@..@.rsrc...|.....N......0N.............@..@.reloc........N......8N.............@..B................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\libffi-8.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):39696
                                                                                                                                                                                                                                Entropy (8bit):6.641880464695502
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
                                                                                                                                                                                                                                MD5:0F8E4992CA92BAAF54CC0B43AACCCE21
                                                                                                                                                                                                                                SHA1:C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
                                                                                                                                                                                                                                SHA-256:EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
                                                                                                                                                                                                                                SHA-512:6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\libssl-3.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):787224
                                                                                                                                                                                                                                Entropy (8bit):5.609561366841894
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
                                                                                                                                                                                                                                MD5:19A2ABA25456181D5FB572D88AC0E73E
                                                                                                                                                                                                                                SHA1:656CA8CDFC9C3A6379536E2027E93408851483DB
                                                                                                                                                                                                                                SHA-256:2E9FBCD8F7FDC13A5179533239811456554F2B3AA2FB10E1B17BE0DF81C79006
                                                                                                                                                                                                                                SHA-512:DF17DC8A882363A6C5A1B78BA3CF448437D1118CCC4A6275CC7681551B13C1A4E0F94E30FFB94C3530B688B62BFF1C03E57C2C185A7DF2BF3E5737A06E114337
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>:V.PiV.PiV.Pi_..iX.PiC.QhT.Pi..QhT.PiC.UhZ.PiC.Th^.PiC.ShR.PillQhU.PiV.QiH.PillThf.PillPhW.Pill.iW.PillRhW.PiRichV.Pi................PE..d......e.........." ...%.*..........K........................................ ............`..........................................g...Q..............s.......@M......./......`.......8...........................`...@............p...............................text...D).......*.................. ..`.rdata..Hy...@...z..................@..@.data....N.......H..................@....pdata...V.......X..................@..@.idata...c...p...d...H..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..4...........................@..B........................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\markupsafe\_speedups.cp311-win_amd64.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):15872
                                                                                                                                                                                                                                Entropy (8bit):5.2050934917752825
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:OtwEX3IfwEA1RwEaCjEUHsMV38w5Yk/pxggRSea1DvH5TCIcqgr:b27CsVB/pxkDvZTCMgr
                                                                                                                                                                                                                                MD5:F9A048E8B523E5BC3C240862815DACEC
                                                                                                                                                                                                                                SHA1:E33E530B9F6C2AC4E4982CC9FA91DDA10C5C4AF7
                                                                                                                                                                                                                                SHA-256:304AA793204E1E6B2DC10AF9D212A2B68BC78EB1E1309D20626C9AE05BB50CAD
                                                                                                                                                                                                                                SHA-512:1031BC1493CD43A9049E6D1AC3FE73D992FA9DE4C49E2982BE3BB61C2FBC57DD7B9A7669A95D16CEACEC149803A6D2271AAB3F2896F2B1DB14379A2EE0F560BE
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z.0...^...^...^.......^..._...^.U._...^...[...^...Z...^...]...^.$+_...^..._.-.^.$+V...^.$+^...^.$+....^.$+\...^.Rich..^.........................PE..d...3..e.........." ...%.....&......P.....................................................`.........................................@>..d....>..d....p.......`..................L....7...............................6..@............0..x............................text............................... ..`.rdata..d....0......................@..@.data...8....P.......4..............@....pdata.......`.......6..............@..@.rsrc........p.......:..............@..@.reloc..L............<..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\pyexpat.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):198424
                                                                                                                                                                                                                                Entropy (8bit):6.377860842507261
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:kbc8RnClmm52ApTkIS1uDH2dbjuBYI0XmQtVkPzlOzcURIbLhIz:wc85Qmm53TkDuD2devODtqP3U5
                                                                                                                                                                                                                                MD5:D7ECC2746314FEC5CA46B64C964EA93E
                                                                                                                                                                                                                                SHA1:39FC49D4058A65F0AA4FBDC3D3BCC8C7BEECAA01
                                                                                                                                                                                                                                SHA-256:58B95F03A2D7EC49F5260E3E874D2B9FB76E95ECC80537E27ABEF0C74D03CB00
                                                                                                                                                                                                                                SHA-512:D5A595AAF3C7603804DEAE4D4CC34130876A4C38CCD9F9F29D8B8B11906FA1A03DD9A1F8F5DBDE9DC2C62B89FE52DFE5B4EE409A8D336EDF7B5B8141D12E82D2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W,.6B..6B..6B..N..6B..IC..6B..IG..6B..IF..6B..IA..6B...C..6B..NC..6B..6C..6B...O..6B...B..6B......6B...@..6B.Rich.6B.........PE..d......e.........." ...%..................................................... ............`.............................................P.............................../..........p3..T...........................02..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...@!..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\pyreadline3-3.5.4.dist-info\INSTALLER

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4
                                                                                                                                                                                                                                Entropy (8bit):1.5
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:Mn:M
                                                                                                                                                                                                                                MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:pip.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\pyreadline3-3.5.4.dist-info\LICENSE.md

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2250
                                                                                                                                                                                                                                Entropy (8bit):5.228085994344051
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:EXRPFWGe3XSTrOOJ73rYJcVkMPDH432sm632s39t313ZOBTgy:EXpFWGe3jOJ73rYJVKY3b3zV6Td
                                                                                                                                                                                                                                MD5:B39540D1870E7AB08118DC1D1FA7A9D1
                                                                                                                                                                                                                                SHA1:6096C1EE928F2B3EBBF932973E809AC548F64403
                                                                                                                                                                                                                                SHA-256:8FC4D8DE61B40533023B16E64528D13371A2E9C68677DF79ED5E93BA570471BD
                                                                                                                                                                                                                                SHA-512:862EE765E91CFC9E0EBAEAFC435397CBF277CD38DA5F1142DE122E4DAA795F19CC91A8351B895125F4BDEF948AF26B7D0E8AD27D2E7B2991DB45752BCA08E108
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:# LICENSE....## pyreadline3 copyright and licensing notes....Unless indicated otherwise, files in this project are covered by a BSD-type..license, included below.....Individual authors are the holders of the copyright for their code and are..listed in each file.....Some files may be licensed under different conditions. Ultimately each file..indicates clearly the conditions under which its author/authors have..decided to publish the code.....## pyreadline3 license....pyreadline3 is released under a BSD-type license.....Copyright (c) 2020 Bassem Girgis <brgirgis@gmail.com>.....Copyright (c) 2006-2020 J.rgen Stenarson <jorgen.stenarson@bostream.nu>.....Copyright (c) 2003-2006 Gary Bishop....Copyright (c) 2003-2006 Jack Trainor....All rights reserved.....Redistribution and use in source and binary forms, with or without..modification, are permitted provided that the following conditions are met:....a. Redistributions of source code must retain the above copyright notice,.. this list

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\pyreadline3-3.5.4.dist-info\METADATA

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4653
                                                                                                                                                                                                                                Entropy (8bit):5.093770800896551
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:D9zg0GjrQIRq9lGovhSW5UrPIZZZXqZx+pbEOT9PMX2dyD+l:p3tbSW5UEZZZXqZxW5GeI+l
                                                                                                                                                                                                                                MD5:45EE20BA2BBD8759CA1C58A4B3A912E2
                                                                                                                                                                                                                                SHA1:602A307F36527F40C7B6FCA2BABCC789547C5671
                                                                                                                                                                                                                                SHA-256:9D039725AFD4FAC0D0967156F19F42AEEFED982555402D477B255DECF209002B
                                                                                                                                                                                                                                SHA-512:D14C8AB5E985701A08AB0D1FE4C86871F239639F91CFF556307ED7DD93B8C8CF452D13975FBE34D1AE2FD4071F72B2933F5568EF9EB11A6741B3C3A5BD1D7B56
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:Metadata-Version: 2.1..Name: pyreadline3..Version: 3.5.4..Summary: A python implementation of GNU readline...Author-email: Bassem Girgis <brgirgis@gmail.com>, Jorgen Stenarson <jorgen.stenarson@kroywen.se>, Gary Bishop <unknwon@unknown.com>, Jack Trainor <unknwon@unknown.com>..Maintainer-email: Bassem Girgis <brgirgis@gmail.com>..License: BSD..Project-URL: Homepage, https://github.com/pyreadline3/pyreadline3..Project-URL: Documentation, https://github.com/pyreadline3/pyreadline3..Project-URL: Repository, https://github.com/pyreadline3/pyreadline3.git..Project-URL: Issues, https://github.com/pyreadline3/pyreadline3/issues..Project-URL: Changelog, https://github.com/pyreadline3/pyreadline3/blob/master/doc/ChangeLog..Keywords: readline,pyreadline,pyreadline3..Classifier: Development Status :: 5 - Production/Stable..Classifier: Environment :: Console..Classifier: Operating System :: Microsoft :: Windows..Classifier: License :: OSI Approved :: BSD License..Classifier: Programming Language :

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\pyreadline3-3.5.4.dist-info\RECORD

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:CSV text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):7044
                                                                                                                                                                                                                                Entropy (8bit):5.617800389134621
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:hXancv6L9muEVwuffbqnYnqOdbxEnT+9F7O5xEFABg/6GPNCNJOOmUOWita7V5mP:hXXvtNzp1+KKoLGGD2+P
                                                                                                                                                                                                                                MD5:45212A96D41552EC43705BBE4ACFDDCB
                                                                                                                                                                                                                                SHA1:EEF153DE06B82916211E177673D2CC1FCCB1B986
                                                                                                                                                                                                                                SHA-256:E12F9B98840D3B2C6B706CE611C0918154B9E061648810EEBB57B3595A3B6181
                                                                                                                                                                                                                                SHA-512:E105EE91A433102BB445D332825DB4AA1D798566656BB9FCC4F5DB8CE8B681031CA15C5FE773140E66774AF49FA922665FF08F724925F01DC98D4E72A08C0D52
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:__pycache__/readline.cpython-311.pyc,,..pyreadline3-3.5.4.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..pyreadline3-3.5.4.dist-info/LICENSE.md,sha256=j8TY3mG0BTMCOxbmRSjRM3Gi6caGd9957V6TulcEcb0,2250..pyreadline3-3.5.4.dist-info/METADATA,sha256=nQOXJa_U-sDQlnFW8Z9Cru_tmCVVQC1HeyVd7PIJACs,4653..pyreadline3-3.5.4.dist-info/RECORD,,..pyreadline3-3.5.4.dist-info/WHEEL,sha256=GV9aMThwP_4oNCtvEC2ec3qUYutgWeAzklro_0m4WJQ,91..pyreadline3-3.5.4.dist-info/top_level.txt,sha256=jFAZcAVg1WzdsUjogYZvyqSMaBAN38sqUZemcaDxF9E,21..pyreadline3/__init__.py,sha256=Pyu6nWoyEUUQKG-mol6rpiC1LhaDWDr8Metw0QJ0ws0,1031..pyreadline3/__pycache__/__init__.cpython-311.pyc,,..pyreadline3/__pycache__/error.cpython-311.pyc,,..pyreadline3/__pycache__/get_doc.cpython-311.pyc,,..pyreadline3/__pycache__/py3k_compat.cpython-311.pyc,,..pyreadline3/__pycache__/rlmain.cpython-311.pyc,,..pyreadline3/__pycache__/unicode_helper.cpython-311.pyc,,..pyreadline3/clipboard/__init__.py,sha256=ONeTJdTckSx0utxQb

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\pyreadline3-3.5.4.dist-info\WHEEL

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):91
                                                                                                                                                                                                                                Entropy (8bit):4.718144065224423
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:RtEeXMRYFAQ6AP+tPCCfA5S:RtC1dAWBBf
                                                                                                                                                                                                                                MD5:7F6453A7381AA145E12AF40803936ACD
                                                                                                                                                                                                                                SHA1:2E5EF9544128D62528021C7DA99AD053ED68F563
                                                                                                                                                                                                                                SHA-256:195F5A3138703FFE28342B6F102D9E737A9462EB6059E033925AE8FF49B85894
                                                                                                                                                                                                                                SHA-512:DA4D79AB9C4A9DFD1C7F65A8F7D71C285C0E04B192075012530D60C367C17F554EDFA416941673F462DA52C380C0B58FD3795DB656DF6EC118B55933AB587238
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:Wheel-Version: 1.0.Generator: setuptools (75.1.0).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\pyreadline3-3.5.4.dist-info\top_level.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):21
                                                                                                                                                                                                                                Entropy (8bit):3.3446983751597124
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:uJM0WJ/bv:u0J/L
                                                                                                                                                                                                                                MD5:EF6BE090D4FDBF180965E16643DD8642
                                                                                                                                                                                                                                SHA1:4541545BCB7E01DADAEA92608C362A9323734D91
                                                                                                                                                                                                                                SHA-256:8C5019700560D56CDDB148E881866FCAA48C68100DDFCB2A5197A671A0F117D1
                                                                                                                                                                                                                                SHA-512:7661EE00D4096DE4A367E351C1632E78B35645AD376033A7659B5888FECDDBF16B373835087E96A8B3767E9CE0BD824A13BAC10564B055F5BD1EF4880DD20376
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:pyreadline3.readline.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\python3.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):67352
                                                                                                                                                                                                                                Entropy (8bit):6.146376482841349
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:iw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJSv:F/5k8cnzeJfRIbL0D7SyZxEL
                                                                                                                                                                                                                                MD5:35DA4143951C5354262A28DEE569B7B2
                                                                                                                                                                                                                                SHA1:B07CB6B28C08C012EECB9FD7D74040163CDF4E0E
                                                                                                                                                                                                                                SHA-256:920350A7C24C46339754E38D0DB34AB558E891DA0B3A389D5230A0D379BEE802
                                                                                                                                                                                                                                SHA-512:2976667732F9EE797B7049D86FD9BEEB05409ADB7B89E3F5B1C875C72A4076CF65C762632B7230D7F581C052FCE65BB91C1614C9E3A52A738051C3BC3D167A23
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T...5e..5e..5e..m..5e..e..5e.....5e..g..5e.Rich.5e.........PE..d......e.........." ...%..................................................................`.........................................`...P................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\python311.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5789464
                                                                                                                                                                                                                                Entropy (8bit):6.087003733819531
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:7KUvq5S8qfFIbGoSieBCZjze3eWVWhQNkGDiUWmtAoaOvi26g2je7wkUB3AO1Fp6:7KUvq1quUqjTPGzuvihAs2oH9M8I9URf
                                                                                                                                                                                                                                MD5:D06DA79BFD21BB355DC3E20E17D3776C
                                                                                                                                                                                                                                SHA1:610712E77F80D2507FFE85129BFEB1FF72FA38BF
                                                                                                                                                                                                                                SHA-256:2835E0F24FB13EF019608B13817F3ACF8735FBC5F786D00501C4A151226BDFF1
                                                                                                                                                                                                                                SHA-512:E4DD839C18C95B847B813FFD0CA81823048D9B427E5DCF05F4FBE0D77B8F7C8A4BD1C67C106402CD1975BC20A8EC1406A38AD4764AB466EF03CB7EB1F431C38A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............|...|...|.......|.......|.......|.......|.......|....c..|......|...|..}.......|.......|.......|.......|..Rich.|..........PE..d......e.........." ...%..%..P7.....\z.......................................@].......X...`...........................................@......A.......[.......W..2...(X../....[..D..@.*.T.............................*.@.............%.p............................text.....%.......%................. ..`.rdata........%.......%.............@..@.data...P&....A..X....A.............@....pdata...2....W..4....R.............@..@PyRuntim.....PY......LT.............@....rsrc.........[.......V.............@..@.reloc...D....[..F....V.............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\pywin32_system32\pythoncom311.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):669696
                                                                                                                                                                                                                                Entropy (8bit):6.035392172368621
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:mjN+cC8C0nALOrc5qcse64RV7n04pd+1xeo:AN+cnCqrcEbefFno
                                                                                                                                                                                                                                MD5:F98264F2DACFC8E299391ED1180AB493
                                                                                                                                                                                                                                SHA1:849551B6D9142BF983E816FEF4C05E639D2C1018
                                                                                                                                                                                                                                SHA-256:0FE49EC1143A0EFE168809C9D48FE3E857E2AC39B19DB3FD8718C56A4056696B
                                                                                                                                                                                                                                SHA-512:6BB3DBD9F4D3E6B7BD294F3CB8B2EF4C29B9EFF85C0CFD5E2D2465BE909014A7B2ECD3DC06265B1B58196892BB04D3E6B0AA4B2CCBF3A716E0FF950EB28DB11C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`...3...3...3..\3...3...2...3...2...3...2...3...2...3...2...3U..2...3...2...3...3..3U..2..3U..2...3U..2...3Rich...3................PE..d...f..d.........." ......................................................................`..........................................U...c..............l....@...z............... ......T...........................0...8............................................text............................... ..`.rdata...#.......$..................@..@.data....I..........................@....pdata...z...@...|..................@..@.rsrc...l...........................@..@.reloc... ......."..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\pywin32_system32\pywintypes311.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):134656
                                                                                                                                                                                                                                Entropy (8bit):5.995319660651805
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:luJ2G0a2fYrFceQaVK756Y/r06trRjEKQze7KN9eJKVKG6j1J:luJ2faiYrFceQaVfY/rx1eze7KbewVrk
                                                                                                                                                                                                                                MD5:90B786DC6795D8AD0870E290349B5B52
                                                                                                                                                                                                                                SHA1:592C54E67CF5D2D884339E7A8D7A21E003E6482F
                                                                                                                                                                                                                                SHA-256:89F2A5C6BE1E70B3D895318FDD618506B8C0E9A63B6A1A4055DFF4ABDC89F18A
                                                                                                                                                                                                                                SHA-512:C6E1DBF25D260C723A26C88EC027D40D47F5E28FC9EB2DBC72A88813A1D05C7F75616B31836B68B87DF45C65EEF6F3EAED2A9F9767F9E2F12C45F672C2116E72
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.$g..wg..wg..wn.[wk..w5..vc..w..5wf..w5..vs..w5..vo..w5..vd..ws..vf..w...ve..ws..vl..wg..w...w...vj..w...vf..w...vf..wRichg..w........PE..d......d.........." ................L........................................P............`......................................... u..`B......,....0..l.......L............@..0...`Q..T............................Q..8............................................text............................... ..`.rdata..R...........................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...l....0......................@..@.reloc..0....@......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\select.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):30488
                                                                                                                                                                                                                                Entropy (8bit):6.583657920209147
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:jeUeWEHqTG+RIbQGC5YiSyvkki+AMxkEGu:jeUeWEKTG+RIbQGg7Sy/rxyu
                                                                                                                                                                                                                                MD5:E07AE2F7F28305B81ADFD256716AE8C6
                                                                                                                                                                                                                                SHA1:9222CD34C14A116E7B9B70A82F72FC523EF2B2F6
                                                                                                                                                                                                                                SHA-256:FB06AC13F8B444C3F7AE5D2AF15710A4E60A126C3C61A1F1E1683F05F685626C
                                                                                                                                                                                                                                SHA-512:ACB143194CA465936A48366265AE3E11A2256AEAE333C576C8C74F8ED9B60987DAFF81647AEF74E236B30687A28BC7E3AA21C6AEDBFA47B1501658A2BFD117B4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V..t.s.'.s.'.s.'..7'.s.'...&.s.'...&.s.'...&.s.'...&.s.'(.&.s.'.s.'Ps.'Y..&.s.'(.&.s.'(.&.s.'(.['.s.'(.&.s.'Rich.s.'........PE..d......e.........." ...%.....2.......................................................J....`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\setuptools-65.5.0.dist-info\INSTALLER

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4
                                                                                                                                                                                                                                Entropy (8bit):1.5
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:Mn:M
                                                                                                                                                                                                                                MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:pip.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\setuptools-65.5.0.dist-info\LICENSE

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1050
                                                                                                                                                                                                                                Entropy (8bit):5.072538194763298
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:1rmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:1aJ8YHvEH5QHOs5exm3oEFJ
                                                                                                                                                                                                                                MD5:7A7126E068206290F3FE9F8D6C713EA6
                                                                                                                                                                                                                                SHA1:8E6689D37F82D5617B7F7F7232C94024D41066D1
                                                                                                                                                                                                                                SHA-256:DB3F0246B1F9278F15845B99FEC478B8B506EB76487993722F8C6E254285FAF8
                                                                                                                                                                                                                                SHA-512:C9F0870BC5D5EFF8769D9919E6D8DDE1B773543634F7D03503A9E8F191BD4ACC00A97E0399E173785D1B65318BAC79F41D3974AE6855E5C432AC5DACF8D13E8A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:Copyright Jason R. Coombs..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTW

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\setuptools-65.5.0.dist-info\METADATA

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):6301
                                                                                                                                                                                                                                Entropy (8bit):5.107162422517841
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:W4rkAIG0wRg8wbNDdq6T9927uoU/GBpHFwTZ:Sq0wRg8wbNDdBh927uoU/GBRFi
                                                                                                                                                                                                                                MD5:9E59BD13BB75B38EB7962BF64AC30D6F
                                                                                                                                                                                                                                SHA1:70F6A68B42695D1BFA55ACB63D8D3351352B2AAC
                                                                                                                                                                                                                                SHA-256:80C7A3B78EA0DFF1F57855EE795E7D33842A0827AA1EF4EE17EC97172A80C892
                                                                                                                                                                                                                                SHA-512:67AC61739692ECC249EBDC8F5E1089F68874DCD65365DB1C389FDD0CECE381591A30B99A2774B8CAAA00E104F3E35FF3745AFF6F5F0781289368398008537AE7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:Metadata-Version: 2.1.Name: setuptools.Version: 65.5.0.Summary: Easily download, build, install, upgrade, and uninstall Python packages.Home-page: https://github.com/pypa/setuptools.Author: Python Packaging Authority.Author-email: distutils-sig@python.org.Project-URL: Documentation, https://setuptools.pypa.io/.Project-URL: Changelog, https://setuptools.pypa.io/en/stable/history.html.Keywords: CPAN PyPI distutils eggs package management.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: Topic :: System :: Systems Administration.Classifier: Topic :: Utilities.Requires-Python: >=3.7.License-File: LICENSE.Provides-Extra: certs.Provides-Extra: docs.Requi

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\setuptools-65.5.0.dist-info\RECORD

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:CSV text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):37694
                                                                                                                                                                                                                                Entropy (8bit):5.555787611309118
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:vSzcBlShgRUhbul9nXJkpIVh498WjXYH0+5+E/8mrnaDoaQP7IOQRJqxBPgof2yd:vc853yQXYAY8AKCT9r2/GsIVxE9Im
                                                                                                                                                                                                                                MD5:087F72A04BB085627494651E36C4C513
                                                                                                                                                                                                                                SHA1:1E39070E246F91D8926268A033C6F584E629E2DE
                                                                                                                                                                                                                                SHA-256:BFB77A968E06417BD37023BF1A2D7F1AAE9D8E74231665D6699D5BB82BDBD7B0
                                                                                                                                                                                                                                SHA-512:39CE042A20324C6B63A192D70E56B36318C45D04B810A6BD333D1D40B6DAAD947AFB9156C003BC86C700A59F0F25753416D754DA06C808814920F92582CB6058
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:_distutils_hack/__init__.py,sha256=TSekhUW1fdE3rjU3b88ybSBkJxCEpIeWBob4cEuU3ko,6128.._distutils_hack/__pycache__/__init__.cpython-311.pyc,,.._distutils_hack/__pycache__/override.cpython-311.pyc,,.._distutils_hack/override.py,sha256=Eu_s-NF6VIZ4Cqd0tbbA5wtWky2IZPNd8et6GLt1mzo,44..distutils-precedence.pth,sha256=JjjOniUA5XKl4N5_rtZmHrVp0baW_LoHsN0iPaX10iQ,151..pkg_resources/__init__.py,sha256=fT5Y3P1tcSX8sJomClUU10WHeFmvqyNZM4UZHzdpAvg,108568..pkg_resources/__pycache__/__init__.cpython-311.pyc,,..pkg_resources/_vendor/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..pkg_resources/_vendor/__pycache__/__init__.cpython-311.pyc,,..pkg_resources/_vendor/__pycache__/appdirs.cpython-311.pyc,,..pkg_resources/_vendor/__pycache__/zipp.cpython-311.pyc,,..pkg_resources/_vendor/appdirs.py,sha256=MievUEuv3l_mQISH5SF0shDk_BNhHHzYiAPrT3ITN4I,24701..pkg_resources/_vendor/importlib_resources/__init__.py,sha256=evPm12kLgYqTm-pbzm60bOuumumT8IpBNWFp0uMyrzE,506..pkg_resources/_vendor/importli

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\setuptools-65.5.0.dist-info\WHEEL

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):92
                                                                                                                                                                                                                                Entropy (8bit):4.820827594031884
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:RtEeX7MWcSlViZHKRRP+tPCCfA5S:RtBMwlViojWBBf
                                                                                                                                                                                                                                MD5:4D57030133E279CEB6A8236264823DFD
                                                                                                                                                                                                                                SHA1:0FDC3988857C560E55D6C36DCC56EE21A51C196D
                                                                                                                                                                                                                                SHA-256:1B5E87E00DC87A84269CEAD8578B9E6462928E18A95F1F3373C9EEF451A5BCC0
                                                                                                                                                                                                                                SHA-512:CD98F2A416AC1B13BA82AF073D0819C0EA7C095079143CAB83037D48E9A5450D410DC5CF6B6CFF3F719544EDF1C5F0C7E32E87B746F1C04FE56FAFD614B39826
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.37.1).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\setuptools-65.5.0.dist-info\entry_points.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2740
                                                                                                                                                                                                                                Entropy (8bit):4.540737240939103
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:lELcZDy3g6ySDsm90rZh2Phv4hhpTqTog:yLAP8arZoP94hTTqcg
                                                                                                                                                                                                                                MD5:D3262B65DB35BFFAAC248075345A266C
                                                                                                                                                                                                                                SHA1:93AD6FE5A696252B9DEF334D182432CDA2237D1D
                                                                                                                                                                                                                                SHA-256:DEC880BB89189B5C9B1491C9EE8A2AA57E53016EF41A2B69F5D71D1C2FBB0453
                                                                                                                                                                                                                                SHA-512:1726750B22A645F5537C20ADDF23E3D3BAD851CD4BDBA0F9666F9F6B0DC848F9919D7AF8AD8847BD4F18D0F8585DDE51AFBAE6A4CAD75008C3210D17241E0291
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:[distutils.commands].alias = setuptools.command.alias:alias.bdist_egg = setuptools.command.bdist_egg:bdist_egg.bdist_rpm = setuptools.command.bdist_rpm:bdist_rpm.build = setuptools.command.build:build.build_clib = setuptools.command.build_clib:build_clib.build_ext = setuptools.command.build_ext:build_ext.build_py = setuptools.command.build_py:build_py.develop = setuptools.command.develop:develop.dist_info = setuptools.command.dist_info:dist_info.easy_install = setuptools.command.easy_install:easy_install.editable_wheel = setuptools.command.editable_wheel:editable_wheel.egg_info = setuptools.command.egg_info:egg_info.install = setuptools.command.install:install.install_egg_info = setuptools.command.install_egg_info:install_egg_info.install_lib = setuptools.command.install_lib:install_lib.install_scripts = setuptools.command.install_scripts:install_scripts.rotate = setuptools.command.rotate:rotate.saveopts = setuptools.command.saveopts:saveopts.sdist = setuptools.command.sdist:sdist.seto

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\setuptools-65.5.0.dist-info\top_level.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):41
                                                                                                                                                                                                                                Entropy (8bit):3.9115956018096876
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:3Wd+Nt8AfQYv:3Wd+Nttv
                                                                                                                                                                                                                                MD5:789A691C859DEA4BB010D18728BAD148
                                                                                                                                                                                                                                SHA1:AEF2CBCCC6A9A8F43E4E150E7FCF1D7B03F0E249
                                                                                                                                                                                                                                SHA-256:77DC8BDFDBFF5BBAA62830D21FAB13E1B1348FF2ECD4CDCFD7AD4E1A076C9B88
                                                                                                                                                                                                                                SHA-512:BC2F7CAAD486EB056CB9F68E6C040D448788C3210FF028397CD9AF1277D0051746CAE58EB172F9E73EA731A65B2076C6091C10BCB54D911A7B09767AA6279EF6
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:_distutils_hack.pkg_resources.setuptools.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\sqlite3.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1500440
                                                                                                                                                                                                                                Entropy (8bit):6.5886899298928325
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:zTqtyGkxOc+wv05tP5kf82Hr/74YPF5o/P/gnAracr7/24UcypY7w0vpZUFJ++E:Sk0jwv4tP5kf8ar/74EF2/An4acrVUcl
                                                                                                                                                                                                                                MD5:346F6150977371CDC424EC9275A9B47C
                                                                                                                                                                                                                                SHA1:986096738808EB6ED364C4AC5B3500B5B35BEC10
                                                                                                                                                                                                                                SHA-256:FF950AF2DAD140377A55DA6F3C242327CED0CF498DB50E028ABE1ED023F19B90
                                                                                                                                                                                                                                SHA-512:03CB04E356A8A2D9B871D3365CAB01DA4220DF7687BE38572AE37FA833B924F8C7C5A4606B33AD717D50E5D3D8929F885F38EF5AD582A579C4EE7093F302EE9F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......SJ...+...+...+...S...+...T...+...T...+...T...+...T...+..\S...+...+...+..-....+..-....+..-.n..+..-....+..Rich.+..................PE..d...@..e.........." ...%..................................................................`..........................................d...".............................../..........P...T...............................@...............@............................text...x........................... ..`.rdata..f...........................@..@.data....G.......>..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\tinyaes.cp311-win_amd64.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):55296
                                                                                                                                                                                                                                Entropy (8bit):5.856174037987334
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:MbEbpbAn7Ap8gifALrYpHmC35Z9LZ0e3lrl1lBp6Os:FVA7Kli4wpGC35X90ePT6Os
                                                                                                                                                                                                                                MD5:12BE3EDC4E8C405FD5DB87A150CD7E3D
                                                                                                                                                                                                                                SHA1:378760744CE573A2F6CD0E99339F95FA78253415
                                                                                                                                                                                                                                SHA-256:ABD791A5881DA30E74EBDF0D4F7215AE12DC5D844C1A8FD14F3557D3862BEF7A
                                                                                                                                                                                                                                SHA-512:61B3825ADC50D769AF535767CBDF1DFD14411091CC541C568FE65BA03BE81CDAE03B833699E1132452DF50A5BBF5EAA78012AA91531549A4FC3EFBB8823641EA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Z.............................................................................................B.............Rich....................PE..d...!..f.........." ...).....V...... ........................................0............`.........................................p...`.......d...............H............ ......@...................................@............................................text...x........................... ..`.rdata..x7.......8..................@..@.data...............................@....pdata..H...........................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\ucrtbase.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1044880
                                                                                                                                                                                                                                Entropy (8bit):6.646904878375534
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:ZsKxVJ/pRRK0Y/9f5rl4NbpjONcncvE4mxvSZX0yp49H:OKxDPHQ5rlQBvhV
                                                                                                                                                                                                                                MD5:5CE1730D8C2B332C2285902BC53AC5C4
                                                                                                                                                                                                                                SHA1:28DA42431AC9F358FCDDE9C81B9554E773B1A3F4
                                                                                                                                                                                                                                SHA-256:7A446ABE717BE7AEC33FA31F5864C293E408D4B48CD5DEFA13212A207A9E5E87
                                                                                                                                                                                                                                SHA-512:33327E4751D5A1B496CD88A4F8C76B79D63BAAF15E3E3843E09E9DC32B8ACD86FEF8E09FABC4498D64354A79D63E0364D3909FDD6933F75E548A07489B9CA4F6
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........of...5...5...5..5...5...5&..5...5...5...4...5...4...5...4...5...4...5...4..5...5...5...4...5Rich...5........PE..d......C.........." .....:..........0Z....................................................`A................................................................. ...........E.............p........................... f..............................................text...09.......:.................. ..`.rdata..^....P.......>..............@..@.data....&..........................@....pdata....... ......................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\unicodedata.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1141016
                                                                                                                                                                                                                                Entropy (8bit):5.435118418691938
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:iYPYbfjwR6nb8onRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eDq97:iaYbM90IDJcjEwPgPOG6Xyd46q97
                                                                                                                                                                                                                                MD5:5CC36A5DE45A2C16035ADE016B4348EB
                                                                                                                                                                                                                                SHA1:35B159110E284B83B7065D2CFF0B5EF4CCFA7BF1
                                                                                                                                                                                                                                SHA-256:F28AC3E3AD02F9E1D8B22DF15FA30B2190B080261A9ADC6855248548CD870D20
                                                                                                                                                                                                                                SHA-512:9CCCBF81E80C32976B7B2E0E3978E8F7350CCE542356131B24EBAB34B256EFD44643D41EE4B2994B9152C2E5AF302AA182A1889C99605140F47494A501EF46C1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........L..L..L..E.q.J..Y..N..Y..A..Y..D..Y..O..vE.O.....N..L.....vE.M..vE.M..vE..M..vE..M..RichL..........................PE..d......e.........." ...%.@..........P*..............................................o.....`.............................................X............`.......P..0....:.../...p.......]..T............................[..@............P..x............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data...H....0......................@....pdata..0....P.......&..............@..@.rsrc........`......................@..@.reloc.......p.......8..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\win32\_win32sysloader.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):14848
                                                                                                                                                                                                                                Entropy (8bit):5.115373165177945
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:yuCm72PEO1jIUs0YqEcPbF55UgCWV4rofnbPutEvbqDLWn7ycLmrN/:LardA0Bzx14r6nbF0W+/
                                                                                                                                                                                                                                MD5:6B3D025362F13D2E112D7FEC4B58BF0C
                                                                                                                                                                                                                                SHA1:4A26921FCD1E9EE19C2D8BF67FB8ACF9C48AE359
                                                                                                                                                                                                                                SHA-256:48D2D1F61383DCAF65F5F4F08CAE96F4A915EB89C3EA23D0EF9AE7B0A8173399
                                                                                                                                                                                                                                SHA-512:3023901EDFF779DBD1FF37BA9FB950ECD6D9AC8117EA7A0585A004DA453B98AE5EAB8C2B15C85DCD6E0E9C24EF6734D4AE322B9E5C5E6C9553148B01A14BE808
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d.f. ... ... ...).."...r..."...4..."...r...+...r...(...r...#.......#... ...........!.......!.......!...Rich ...........PE..d......d.........." ......................................................................`..........................................;..`...`;..d....p..t....`..................@...|2..T............................2..8............0..p............................text............................... ..`.rdata..$....0......................@..@.data........P......................@....pdata.......`.......0..............@..@.rsrc...t....p.......4..............@..@.reloc..@............8..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\win32\win32api.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):133632
                                                                                                                                                                                                                                Entropy (8bit):5.851354810898845
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:HPwB2zC1vwC3XetCf5RlRVFhLaNKPAyymhNYm9b9e:HIB2zkvwGXetCfDlRVlPAyLYm9
                                                                                                                                                                                                                                MD5:1D6762B494DC9E60CA95F7238AE1FB14
                                                                                                                                                                                                                                SHA1:AA0397D96A0ED41B2F03352049DAFE040D59AD5D
                                                                                                                                                                                                                                SHA-256:FAE5323E2119A8F678055F4244177B5806C7B6B171B1945168F685631B913664
                                                                                                                                                                                                                                SHA-512:0B561F651161A34C37FF8D115F154C52202F573D049681F8CDD7BBA2E966BB8203780C19BA824B4A693EF12EF1EEEF6AEEEF96EB369E4B6129F1DEB6B26AAA00
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I^.f'..f'..f'......f'...&..f'...#..f'...$..f'.o.&..f'..."..f'...&..f'..f&..g'.o....f'.o.'..f'.o.%..f'.Rich.f'.................PE..d......d.........." .........................................................P............`..........................................................0..\....................@..$....v..T............................<..8............0..........@....................text...$........................... ..`.rdata......0......................@..@.data...x(......."..................@....pdata..............................@..@.rsrc...\....0......................@..@.reloc..$....@......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\win32\win32crypt.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):123904
                                                                                                                                                                                                                                Entropy (8bit):5.966536263597539
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:qcoj2WDPYNSPEkIrFCkAShRD/bv0SShzljLraBqf9308qxJ83zEBoPTEdLQEF8/d:q7jbPA0SD9S3vrCqf93xM4TEdLZn1xa
                                                                                                                                                                                                                                MD5:5390ADE0ED5428024F3D854B5B9BFE9F
                                                                                                                                                                                                                                SHA1:DADA7B44887DCB7B77DCADB9690BAECF3EE2B937
                                                                                                                                                                                                                                SHA-256:9771F09BE29BD7A69ABE774E28472A392382883C18A3CC524F8141E84B1BE22C
                                                                                                                                                                                                                                SHA-512:92E82EFF79F45D4DE1CF27946A357F122C5337A85315D7C139458A1A6A51DFFBF3CBFCF832851FBDCD0EC1BD0F82E7089125FFBBE3275675433089BDDBFF865B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U...U...U...\.v.S.......Q.......E.......].......V.....Q...A...R...U........\.....T.....T...RichU...........PE..d......d.........." ................(........................................ ............`..........................................o..................d.......................H....G..T............................H..8............................................text...~........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata..............................@..@.rsrc...d...........................@..@.reloc..H...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\win32\win32evtlog.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):73216
                                                                                                                                                                                                                                Entropy (8bit):5.760657769680508
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:0pFAM7885hqM5cE9GVV+YTFx5VgGYLxifpfz:YFJ78+NeVV+YBHVgGYLYfpfz
                                                                                                                                                                                                                                MD5:F95639980A358B2B157AF19D8837B3AB
                                                                                                                                                                                                                                SHA1:7B6CC1B4916B546D64E9B772F64669CA7EA0C31C
                                                                                                                                                                                                                                SHA-256:9EDC507023126FE4BB61E301E06897956CE789FD4D985A42210B9B93D4F966CC
                                                                                                                                                                                                                                SHA-512:97EEB0F7706ECDBC7B351F1D95F29491BB96B1BDBA2E24A16D713977F0F3FC538D55469E1873EAF3551B1707D42C3BBABD6B180971F096D6199A505725E59A16
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A..............V....W.....W......W..........W.............................:.........Rich...........................PE..d......d.........." ................p........................................`............`.............................................X...8........@.. ....0..|............P..l.......T...........................`...8...............`.......@....................text............................... ..`.rdata..&\.......^..................@..@.data...............................@....pdata..|....0......................@..@.rsrc... ....@......................@..@.reloc..l....P......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\win32\win32trace.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):23552
                                                                                                                                                                                                                                Entropy (8bit):5.2797447560366155
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:JPeeH8ZmV+zknwMsADuVLw0T8DmDRl2jYI7AHCQnpC9QJX1B5:JL+zi/uVbSYI4d6CB
                                                                                                                                                                                                                                MD5:2705D0AC399B949261F4D9AF473DBA7C
                                                                                                                                                                                                                                SHA1:2B84CEDFCB90F8278E698AC2319C860F373060F2
                                                                                                                                                                                                                                SHA-256:961D93DBD18F33685C5384F4346D8AF2A452E51F7171E6CB053B9BB260EDA5A3
                                                                                                                                                                                                                                SHA-512:F546670352D5934F11EFBE53AE382EE96E9D88DB7A8709EE1CEC36474E61E3C3DD9EDC01A8557152A0F3F0CF808410E31AE37F178BB2F34EC00156808103C72D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>].OP..OP..OP..7...OP..:Q..OP..:U..OP..:T..OP..:S..OP..:Q..OP..$Q..OP..OQ..OP..:Y..OP..:P..OP..:R..OP.Rich.OP.................PE..d......d.........." .....,...,.......(....................................................`..........................................Q..T...dQ..........d....p.......................G..T...........................0H..8............@...............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data...(....`.......L..............@....pdata.......p.......R..............@..@.rsrc...d............V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\win32com\shell\shell.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):528384
                                                                                                                                                                                                                                Entropy (8bit):6.160492941773028
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:x1uoSNIiaRGfvtQqmJeRAsgUW9yKj6pWa1P5ziI7RRWf:x1uoSNIH8HtQbems66pWab37R4f
                                                                                                                                                                                                                                MD5:8A0C2F96414475498D6E9BADA00DE986
                                                                                                                                                                                                                                SHA1:BB8E66F3DF9F25B12777E3F48BA7069940F0C920
                                                                                                                                                                                                                                SHA-256:3F45C59F75E61FA93B5C2B1F65995B621C3FD301FB500A17599BEFA54538D1D0
                                                                                                                                                                                                                                SHA-512:75D718F30209D81819CEA7B148D3A8DD7FCB9FC94E87A8DD5D7C795B334DEACD6A598F583475B7005D0E81929C9E70F19BABFE92BE1E1E39F62296078FDEEAEA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.C.............bh.....Wo......Wo......Wo......Wo.......q.......o.......q.......q...............o..C....o.......o......Rich....................PE..d...#..d.........." .....$................................................................`.............................................L...............L.......xx...............!......T..............................8............@...............................text...n#.......$.................. ..`.rdata.......@.......(..............@..@.data...@....0...^..................@....pdata..xx.......z...p..............@..@.rsrc...L...........................@..@.reloc...!......."..................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\zstandard\_cffi.cp311-win_amd64.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):650752
                                                                                                                                                                                                                                Entropy (8bit):6.4073215909095005
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:rbTutDqcmbgSZZ/jZMaBHXD/OHHSAU1gIkpWCuMshv9K1HFV1jBjgG4LFxJY/1n:rfrcmsSHBHXiSArRENMivwF1jdgs/1n
                                                                                                                                                                                                                                MD5:A19B5E6324D1A6A9FD99C98FE7B83FE2
                                                                                                                                                                                                                                SHA1:4E3E56754A3C46C661EF591A4B5A5985BD4F6B85
                                                                                                                                                                                                                                SHA-256:3ED00BB5876EAFA617BEBB213D2BC887B5637C53C4A849FCC2366084BF056787
                                                                                                                                                                                                                                SHA-512:5975F90036CB7D3013FC6815F2C372EB9B89AF6C8153D1770EBBD70BF5B61E3B12DEFA3D7A4CCD364BD6A978B2879A15801D2AEC8BAD9221CA15DFFC9B7BA929
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................1....!X............!X.....!X.....!X......Z............_......_......_]....._.....Rich...........................PE..d...B'.f.........." ...(.....\...... ........................................0............`.........................................0...\........................3........... .......d..............................Pc..@...............@............................text...H........................... ..`.rdata..b...........................@..@.data...............................@....pdata...3.......4..................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI67562\zstandard\backend_c.cp311-win_amd64.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):519680
                                                                                                                                                                                                                                Entropy (8bit):6.407145343537454
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:n5vDYEvt0Fwyow0k1rErp645rtxvi1gRNg5sXgz0:npBvt0Fw9fk1rErQ45rt5RNZ
                                                                                                                                                                                                                                MD5:56DB4A861AEC914A860461DEDCDCA0A0
                                                                                                                                                                                                                                SHA1:8535A8C9EAC371A54308795A8BBE89414933E035
                                                                                                                                                                                                                                SHA-256:6AB611C4A24406D9D97F09D49D50142AB2734B69A2B0D9EA6489E4AF90C4A2A4
                                                                                                                                                                                                                                SHA-512:600A21666E9ED334DE5B4B17F60136434EE485C80F9740E6085E24EF95CA5376E6223A54C6B1C8F12987EDAB5D89AF9676CC12E2A335F4C4E9AB79DFEF8E4B90
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................P.............P......P......P......R........4...W......W......Wn.....W.....Rich...........PE..d...<'.f.........." ...(............ ........................................0............`.............................................d...D....................)........... ..d...0\...............................Z..@...............(............................text...H........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata...).......*..................@..@.rsrc...............................@..@.reloc..d.... ......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nhj_etj2

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4
                                                                                                                                                                                                                                Entropy (8bit):2.0
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:qn:qn
                                                                                                                                                                                                                                MD5:3F1D1D8D87177D3D8D897D7E421F84D6
                                                                                                                                                                                                                                SHA1:DD082D742A5CB751290F1DB2BD519C286AA86D95
                                                                                                                                                                                                                                SHA-256:F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
                                                                                                                                                                                                                                SHA-512:2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:blat

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\tmp5fxsnor_\Local State

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):66646
                                                                                                                                                                                                                                Entropy (8bit):6.044576597568136
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:k8Tc32bwS8Oa6nviYQkiEZQiaWh9emCgfXJ9Uu:k8bJznvi61e8fIu
                                                                                                                                                                                                                                MD5:BEEB299F37F7FB5E83199C87E7D12EDA
                                                                                                                                                                                                                                SHA1:D77E47377D802C79BD8C0B87B1E9F0520A6A9864
                                                                                                                                                                                                                                SHA-256:06FEBBBE692878AD3433329A9155B08A1E0A5EC68152AD6B03A552FB39DACD46
                                                                                                                                                                                                                                SHA-512:911E4E566B7663D7EF504B77A60B60C4F060C01CF451D6EF40F4D370F20194354B31FF3FFB8223DE22166DC522DDFE5912523EBF5A474F7A6621A3EB95EDF56F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"browser":{"first_run_finished":true,"first_run_study_group":"EnabledE-5","shortcut_migration_version":"117.0.5938.132"},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"os_crypt":{"app_bound_fixed_data":"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAG7I4XamucEiJgTIvWNrX8QAAAAACAAAAAAAQZgAAAAEAACAAAACz9LIY/Sft4sF7BR0/+RlMXu9lhIRI5BaZTSQpyRPpLAAAAAAOgAAAAAIAACAAAADpL4/Y0/1c7GfAyejoQlHrWIfhufkrSTaxhr33kLRaiGABAABCz7EyQ+8ml1FxjRqtgyeWwLLZ2IHAzJeD0JnWN0wZz313G7DGWg+UAsBKIMQy5yoFT6uS18pLOAyaJXxUDloUrKvqu51HeVrnYHoVb8WT7jb6PiSZemofWqeToVsJHvtWDZt5T3cRsPTFluK+ErdhV/M4aslTfHhHU5oOdEFpJOJjtEggjyvy+1z4MfOSzFQSR/yUPtVqL11Kienypq7Pfce/sgXQVyQx5HJtARkiij5S80SSAzlX7odXphhcK8KFY7RZq5/8tF3h6DjBHxi9tJQHjyUkWUars8S2pxC2nfARqxQF3hsXBSGhzpXzBeEyndaMlhVfFQG+uOvLDxv6WWNzrjY/N23xyPWDnjICFAZ1Phbd/J/YvjpTb6AiXnSITx3SZj6TKb6dLBr9boJsB8rSYGXCaHgO5j6IZBvlJWu9yNA8rR4b0hxpmRkM7XxuKP

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\tmp5fxsnor_\Login Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                                                Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\tmpfcfae2eh\Local State

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):6648
                                                                                                                                                                                                                                Entropy (8bit):5.799886528185702
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:iaYufr62qpTM5ih/cI9URXl8RotowZFVvluhte4dUONIeTC6XQS0qGqk+Z4uj+rW:Io+The2RUUhH6qRAq1k8SPxVLZ7VTi1
                                                                                                                                                                                                                                MD5:90A2F19EEFA47D85E430FE6C5168119E
                                                                                                                                                                                                                                SHA1:37891580B150A8ACE11FFD627FBB31A27F23613D
                                                                                                                                                                                                                                SHA-256:EB2BD55079C7F57F370274A590904D6816B2888B19EAD691FC316E2E34E6097B
                                                                                                                                                                                                                                SHA-512:CA73C269544837779C04CD438FE07171FAF8FC88689D9AD9F3CBAEC3CC92A803F17FE9BB0CEEFC950B10930F079D9ABBB259BE32C8A6BBE7CEE331C2DCCE7E0A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADscBs/HS2TTJocp6NtpoyLEAAAAAoAAABFAGQAZwBlAAAAEGYAAAABAAAgAAAAsW8ultSdDwTk/AwAAbf7bEI2/b0XfFbP3jjJ+raY3fcAAAAADoAAAAACAAAgAAAAsg3hXdbXl6JIj8KFvhbWlaqVSpM3ag+0g0nExYB2Z1kwAAAAXs7yCB0jG0dlOoc3vEVs9i7od11B2WMH/KUhpHcou9G

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\tmpfcfae2eh\Login Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):49152
                                                                                                                                                                                                                                Entropy (8bit):0.8180424350137764
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                                                                                                                MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                                                                                                                SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                                                                                                                SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                                                                                                                SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                Static File Info

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                File type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Entropy (8bit):7.997262994889526
                                                                                                                                                                                                                                TrID:
                                                                                                                                                                                                                                • Win64 Executable Console (202006/5) 92.65%
                                                                                                                                                                                                                                • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                                                • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                                                • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                File name:54Oa5PcvK1.exe
                                                                                                                                                                                                                                File size:23'470'644 bytes
                                                                                                                                                                                                                                MD5:7779f97c3a704491e0b217ef536d225a
                                                                                                                                                                                                                                SHA1:9f5943b644c8e694b3cb6296a450de5be369dcb9
                                                                                                                                                                                                                                SHA256:150bd33eb83e01bd26e6ea50fb7e1058e57855f8c50753f8a3b7401d712b8351
                                                                                                                                                                                                                                SHA512:f2a7a0d3e3295d40d4d28617d178aee2e230663b868526a8b467fedd836deee14d52396239e9a14679712685542963b01cef42fd399007af77d76fdc1aeaa26d
                                                                                                                                                                                                                                SSDEEP:393216:oEkZQtsMVehZ2YsHFUK2Jn1+TtIiFC/IjcBhpyi9mPDnrmvUaudE6vjK6GIva4lu:ohQtsQ6Z2YwUlJn1QtI1/I2pyZDCv0di
                                                                                                                                                                                                                                TLSH:A3373322A22218D8D9D95439A11AD279CBB1FC83ABF0D00F73B457174FDB1519EBAF21
                                                                                                                                                                                                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................1.............-.............................................H.......H.......Rich...................

                                                                                                                                                                                                                                File Icon

                                                                                                                                                                                                                                Icon Hash:2e1e7c4c4c61e979

                                                                                                                                                                                                                                Static PE Info

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Entrypoint:0x14000a6a0
                                                                                                                                                                                                                                Entrypoint Section:.text
                                                                                                                                                                                                                                Digitally signed:false
                                                                                                                                                                                                                                Imagebase:0x140000000
                                                                                                                                                                                                                                Subsystem:windows cui
                                                                                                                                                                                                                                Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                                                DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                Time Stamp:0x671D4D9B [Sat Oct 26 20:14:19 2024 UTC]
                                                                                                                                                                                                                                TLS Callbacks:
                                                                                                                                                                                                                                CLR (.Net) Version:
                                                                                                                                                                                                                                OS Version Major:5
                                                                                                                                                                                                                                OS Version Minor:2
                                                                                                                                                                                                                                File Version Major:5
                                                                                                                                                                                                                                File Version Minor:2
                                                                                                                                                                                                                                Subsystem Version Major:5
                                                                                                                                                                                                                                Subsystem Version Minor:2
                                                                                                                                                                                                                                Import Hash:ba5546933531fafa869b1f86a4e2a959

                                                                                                                                                                                                                                Entrypoint Preview

                                                                                                                                                                                                                                Instruction
                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                sub esp, 28h
                                                                                                                                                                                                                                call 00007FA5B070091Ch
                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                add esp, 28h
                                                                                                                                                                                                                                jmp 00007FA5B070051Fh
                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                sub esp, 28h
                                                                                                                                                                                                                                call 00007FA5B0700E64h
                                                                                                                                                                                                                                test eax, eax
                                                                                                                                                                                                                                je 00007FA5B07006D3h
                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                mov eax, dword ptr [00000030h]
                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                                                                jmp 00007FA5B07006B7h
                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                cmp ecx, eax
                                                                                                                                                                                                                                je 00007FA5B07006C6h
                                                                                                                                                                                                                                xor eax, eax
                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                cmpxchg dword ptr [00041E8Ch], ecx
                                                                                                                                                                                                                                jne 00007FA5B07006A0h
                                                                                                                                                                                                                                xor al, al
                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                add esp, 28h
                                                                                                                                                                                                                                ret
                                                                                                                                                                                                                                mov al, 01h
                                                                                                                                                                                                                                jmp 00007FA5B07006A9h
                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                inc eax
                                                                                                                                                                                                                                push ebx
                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                sub esp, 20h
                                                                                                                                                                                                                                movzx eax, byte ptr [00041E77h]
                                                                                                                                                                                                                                test ecx, ecx
                                                                                                                                                                                                                                mov ebx, 00000001h
                                                                                                                                                                                                                                cmove eax, ebx
                                                                                                                                                                                                                                mov byte ptr [00041E67h], al
                                                                                                                                                                                                                                call 00007FA5B0700C63h
                                                                                                                                                                                                                                call 00007FA5B0701D92h
                                                                                                                                                                                                                                test al, al
                                                                                                                                                                                                                                jne 00007FA5B07006B6h
                                                                                                                                                                                                                                xor al, al
                                                                                                                                                                                                                                jmp 00007FA5B07006C6h
                                                                                                                                                                                                                                call 00007FA5B070F171h
                                                                                                                                                                                                                                test al, al
                                                                                                                                                                                                                                jne 00007FA5B07006BBh
                                                                                                                                                                                                                                xor ecx, ecx
                                                                                                                                                                                                                                call 00007FA5B0701DA2h
                                                                                                                                                                                                                                jmp 00007FA5B070069Ch
                                                                                                                                                                                                                                mov al, bl
                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                add esp, 20h
                                                                                                                                                                                                                                pop ebx
                                                                                                                                                                                                                                ret
                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                inc eax
                                                                                                                                                                                                                                push ebx
                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                sub esp, 20h
                                                                                                                                                                                                                                cmp byte ptr [00041E2Ch], 00000000h
                                                                                                                                                                                                                                mov ebx, ecx
                                                                                                                                                                                                                                jne 00007FA5B0700719h
                                                                                                                                                                                                                                cmp ecx, 01h
                                                                                                                                                                                                                                jnbe 00007FA5B070071Ch
                                                                                                                                                                                                                                call 00007FA5B0700DCAh
                                                                                                                                                                                                                                test eax, eax
                                                                                                                                                                                                                                je 00007FA5B07006DAh

                                                                                                                                                                                                                                Data Directories

                                                                                                                                                                                                                                NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x3bb940x3c.rdata
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x520000xf004.rsrc
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x4e0000x20e8.pdata
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x620000x75c.reloc
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x393500x1c.rdata
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x392100x140.rdata
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IAT0x2a0000x350.rdata
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                Sections

                                                                                                                                                                                                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                .text0x10000x288900x28a007c71956ea75242f33df45f4d2c19a4d8False0.5562019230769231zlib compressed data6.489977853279916IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                .rdata0x2a0000x1271a0x1280013f7508ea94b13668034138e91881a5aFalse0.515941722972973data5.846273787790564IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                .data0x3d0000x103f80xe009bd2cebaa3285e8e266c4c373a15119dFalse0.13337053571428573DOS executable (block device driver \377\3)1.808915577448681IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                .pdata0x4e0000x20e80x2200f2a57235499cb8c84daf2de6f18a85ebFalse0.4756433823529412data5.330974160786823IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                _RDATA0x510000x15c0x20032c20bb907888de565d4d8836d097016False0.392578125data2.795351059303424IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                .rsrc0x520000xf0040xf2001ab3512333bf10a0c6fc66b2cb2093a4False0.7950025826446281data7.356246179782812IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                .reloc0x620000x75c0x800b7279c82d58eeae8dc663879402c6f2eFalse0.54296875data5.238892234772638IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                Resources

                                                                                                                                                                                                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                RT_ICON0x522080xea8Device independent bitmap graphic, 48 x 96 x 8, image size 00.56636460554371
                                                                                                                                                                                                                                RT_ICON0x530b00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.7287906137184116
                                                                                                                                                                                                                                RT_ICON0x539580x568Device independent bitmap graphic, 16 x 32 x 8, image size 00.7471098265895953
                                                                                                                                                                                                                                RT_ICON0x53ec00x909bPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9971636186822983
                                                                                                                                                                                                                                RT_ICON0x5cf5c0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.38309128630705397
                                                                                                                                                                                                                                RT_ICON0x5f5040x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.4826454033771107
                                                                                                                                                                                                                                RT_ICON0x605ac0x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.699468085106383
                                                                                                                                                                                                                                RT_GROUP_ICON0x60a140x68data0.7019230769230769
                                                                                                                                                                                                                                RT_MANIFEST0x60a7c0x587XML 1.0 document, ASCII text, with CRLF line terminators0.44593639575971733

                                                                                                                                                                                                                                Imports

                                                                                                                                                                                                                                DLLImport
                                                                                                                                                                                                                                KERNEL32.dllGetCommandLineW, GetEnvironmentVariableW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, WriteConsoleW, GetProcAddress, GetModuleFileNameW, SetDllDirectoryW, FreeLibrary, GetLastError, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetModuleHandleW, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetCurrentDirectoryW, FlushFileBuffers, HeapReAlloc, GetFileAttributesExW, GetStringTypeW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, SetEndOfFile
                                                                                                                                                                                                                                ADVAPI32.dllConvertSidToStringSidW, GetTokenInformation, OpenProcessToken, ConvertStringSecurityDescriptorToSecurityDescriptorW

                                                                                                                                                                                                                                Network Behavior

                                                                                                                                                                                                                                Network Port Distribution

                                                                                                                                                                                                                                UDP Packets

                                                                                                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                Dec 18, 2024 13:17:54.690433979 CET4955153192.168.2.41.1.1.1
                                                                                                                                                                                                                                Dec 18, 2024 13:17:55.363480091 CET53495511.1.1.1192.168.2.4

                                                                                                                                                                                                                                DNS Queries

                                                                                                                                                                                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                Dec 18, 2024 13:17:54.690433979 CET192.168.2.41.1.1.10xcd88Standard query (0)ssh.0523qyfw.comA (IP address)IN (0x0001)false

                                                                                                                                                                                                                                DNS Answers

                                                                                                                                                                                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                Dec 18, 2024 13:17:55.363480091 CET1.1.1.1192.168.2.40xcd88Name error (3)ssh.0523qyfw.comnonenoneA (IP address)IN (0x0001)false

                                                                                                                                                                                                                                Statistics

                                                                                                                                                                                                                                CPU Usage

                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                Memory Usage

                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                High Level Behavior Distribution

                                                                                                                                                                                                                                Click to dive into process behavior distribution

                                                                                                                                                                                                                                Behavior

                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                System Behavior

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:0
                                                                                                                                                                                                                                Start time:07:17:44
                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Users\user\Desktop\54Oa5PcvK1.exe"
                                                                                                                                                                                                                                Imagebase:0x7ff788770000
                                                                                                                                                                                                                                File size:23'470'644 bytes
                                                                                                                                                                                                                                MD5 hash:7779F97C3A704491E0B217EF536D225A
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:1
                                                                                                                                                                                                                                Start time:07:17:44
                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:2
                                                                                                                                                                                                                                Start time:07:17:48
                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Users\user\Desktop\54Oa5PcvK1.exe"
                                                                                                                                                                                                                                Imagebase:0x7ff788770000
                                                                                                                                                                                                                                File size:23'470'644 bytes
                                                                                                                                                                                                                                MD5 hash:7779F97C3A704491E0B217EF536D225A
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:3
                                                                                                                                                                                                                                Start time:07:17:50
                                                                                                                                                                                                                                Start date:18/12/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                Imagebase:0x7ff683750000
                                                                                                                                                                                                                                File size:289'792 bytes
                                                                                                                                                                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                Disassembly

                                                                                                                                                                                                                                Reset < >

                                                                                                                                                                                                                                  Execution Graph

                                                                                                                                                                                                                                  Execution Coverage:11.4%
                                                                                                                                                                                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                  Signature Coverage:13.8%
                                                                                                                                                                                                                                  Total number of Nodes:2000
                                                                                                                                                                                                                                  Total number of Limit Nodes:53
                                                                                                                                                                                                                                  execution_graph 18699 7ff788790620 18717 7ff78878f808 EnterCriticalSection 18699->18717 18719 7ff788797020 18722 7ff7887917b0 18719->18722 18723 7ff788791802 18722->18723 18724 7ff7887917bd 18722->18724 18728 7ff78878a854 18724->18728 18729 7ff78878a880 FlsSetValue 18728->18729 18730 7ff78878a865 FlsGetValue 18728->18730 18731 7ff78878a872 18729->18731 18733 7ff78878a88d 18729->18733 18730->18731 18732 7ff78878a87a 18730->18732 18734 7ff78878a878 18731->18734 18735 7ff78878936c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18731->18735 18732->18729 18736 7ff78878deb8 _set_fmode 11 API calls 18733->18736 18748 7ff788791484 18734->18748 18737 7ff78878a8f5 18735->18737 18738 7ff78878a89c 18736->18738 18739 7ff78878a8ba FlsSetValue 18738->18739 18740 7ff78878a8aa FlsSetValue 18738->18740 18742 7ff78878a8c6 FlsSetValue 18739->18742 18743 7ff78878a8d8 18739->18743 18741 7ff78878a8b3 18740->18741 18745 7ff788789f78 __free_lconv_num 11 API calls 18741->18745 18742->18741 18744 7ff78878a524 _set_fmode 11 API calls 18743->18744 18746 7ff78878a8e0 18744->18746 18745->18731 18747 7ff788789f78 __free_lconv_num 11 API calls 18746->18747 18747->18734 18771 7ff7887916f4 18748->18771 18750 7ff7887914b9 18786 7ff788791184 18750->18786 18753 7ff78878cc2c _fread_nolock 12 API calls 18754 7ff7887914e7 18753->18754 18755 7ff7887914ef 18754->18755 18756 7ff7887914fe 18754->18756 18757 7ff788789f78 __free_lconv_num 11 API calls 18755->18757 18793 7ff78879182c 18756->18793 18770 7ff7887914d6 18757->18770 18760 7ff7887915fa 18761 7ff788786088 _set_fmode 11 API calls 18760->18761 18762 7ff7887915ff 18761->18762 18766 7ff788789f78 __free_lconv_num 11 API calls 18762->18766 18763 7ff788791655 18765 7ff7887916bc 18763->18765 18804 7ff788790fb4 18763->18804 18764 7ff788791614 18764->18763 18767 7ff788789f78 __free_lconv_num 11 API calls 18764->18767 18769 7ff788789f78 __free_lconv_num 11 API calls 18765->18769 18766->18770 18767->18763 18769->18770 18770->18723 18772 7ff788791717 18771->18772 18773 7ff788791721 18772->18773 18819 7ff78878f808 EnterCriticalSection 18772->18819 18776 7ff788791793 18773->18776 18779 7ff78878936c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18773->18779 18776->18750 18780 7ff7887917ab 18779->18780 18782 7ff788791802 18780->18782 18783 7ff78878a854 50 API calls 18780->18783 18782->18750 18784 7ff7887917ec 18783->18784 18785 7ff788791484 65 API calls 18784->18785 18785->18782 18787 7ff788784a84 45 API calls 18786->18787 18788 7ff788791198 18787->18788 18789 7ff7887911a4 GetOEMCP 18788->18789 18790 7ff7887911b6 18788->18790 18791 7ff7887911cb 18789->18791 18790->18791 18792 7ff7887911bb GetACP 18790->18792 18791->18753 18791->18770 18792->18791 18794 7ff788791184 47 API calls 18793->18794 18795 7ff788791859 18794->18795 18796 7ff788791896 IsValidCodePage 18795->18796 18801 7ff7887919af 18795->18801 18803 7ff7887918b0 memcpy_s 18795->18803 18798 7ff7887918a7 18796->18798 18796->18801 18797 7ff78877a100 _wfindfirst32i64 8 API calls 18799 7ff7887915f1 18797->18799 18800 7ff7887918d6 GetCPInfo 18798->18800 18798->18803 18799->18760 18799->18764 18800->18801 18800->18803 18801->18797 18820 7ff78879129c 18803->18820 18891 7ff78878f808 EnterCriticalSection 18804->18891 18821 7ff7887912d9 GetCPInfo 18820->18821 18830 7ff7887913cf 18820->18830 18827 7ff7887912ec 18821->18827 18821->18830 18822 7ff78877a100 _wfindfirst32i64 8 API calls 18824 7ff78879146e 18822->18824 18824->18801 18831 7ff788791fe0 18827->18831 18829 7ff788796f84 54 API calls 18829->18830 18830->18822 18832 7ff788784a84 45 API calls 18831->18832 18833 7ff788792022 18832->18833 18834 7ff78878e870 _fread_nolock MultiByteToWideChar 18833->18834 18836 7ff788792058 18834->18836 18835 7ff78879205f 18838 7ff78877a100 _wfindfirst32i64 8 API calls 18835->18838 18836->18835 18837 7ff78878cc2c _fread_nolock 12 API calls 18836->18837 18839 7ff78879211c 18836->18839 18842 7ff788792088 memcpy_s 18836->18842 18837->18842 18840 7ff788791363 18838->18840 18839->18835 18841 7ff788789f78 __free_lconv_num 11 API calls 18839->18841 18846 7ff788796f84 18840->18846 18841->18835 18842->18839 18843 7ff78878e870 _fread_nolock MultiByteToWideChar 18842->18843 18844 7ff7887920fe 18843->18844 18844->18839 18845 7ff788792102 GetStringTypeW 18844->18845 18845->18839 18847 7ff788784a84 45 API calls 18846->18847 18848 7ff788796fa9 18847->18848 18851 7ff788796c50 18848->18851 18852 7ff788796c91 18851->18852 18853 7ff78878e870 _fread_nolock MultiByteToWideChar 18852->18853 18857 7ff788796cdb 18853->18857 18854 7ff788796f59 18856 7ff78877a100 _wfindfirst32i64 8 API calls 18854->18856 18855 7ff788796e11 18855->18854 18860 7ff788789f78 __free_lconv_num 11 API calls 18855->18860 18858 7ff788791396 18856->18858 18857->18854 18857->18855 18859 7ff78878cc2c _fread_nolock 12 API calls 18857->18859 18861 7ff788796d13 18857->18861 18858->18829 18859->18861 18860->18854 18861->18855 18862 7ff78878e870 _fread_nolock MultiByteToWideChar 18861->18862 18863 7ff788796d86 18862->18863 18863->18855 18882 7ff78878e304 18863->18882 18866 7ff788796dd1 18866->18855 18869 7ff78878e304 __crtLCMapStringW 6 API calls 18866->18869 18867 7ff788796e22 18868 7ff78878cc2c _fread_nolock 12 API calls 18867->18868 18870 7ff788796ef4 18867->18870 18871 7ff788796e40 18867->18871 18868->18871 18869->18855 18870->18855 18872 7ff788789f78 __free_lconv_num 11 API calls 18870->18872 18871->18855 18873 7ff78878e304 __crtLCMapStringW 6 API calls 18871->18873 18872->18855 18874 7ff788796ec0 18873->18874 18874->18870 18875 7ff788796ee0 18874->18875 18876 7ff788796ef6 18874->18876 18877 7ff78878f138 WideCharToMultiByte 18875->18877 18878 7ff78878f138 WideCharToMultiByte 18876->18878 18879 7ff788796eee 18877->18879 18878->18879 18879->18870 18880 7ff788796f0e 18879->18880 18880->18855 18881 7ff788789f78 __free_lconv_num 11 API calls 18880->18881 18881->18855 18883 7ff78878df30 __crtLCMapStringW 5 API calls 18882->18883 18884 7ff78878e342 18883->18884 18886 7ff78878e34a 18884->18886 18888 7ff78878e3f0 18884->18888 18886->18855 18886->18866 18886->18867 18887 7ff78878e3b3 LCMapStringW 18887->18886 18889 7ff78878df30 __crtLCMapStringW 5 API calls 18888->18889 18890 7ff78878e41e __crtLCMapStringW 18889->18890 18890->18887 15018 7ff78877a51c 15039 7ff78877a6fc 15018->15039 15021 7ff78877a53d __scrt_acquire_startup_lock 15024 7ff78877a67d 15021->15024 15029 7ff78877a55b __scrt_release_startup_lock 15021->15029 15022 7ff78877a673 15146 7ff78877aa2c IsProcessorFeaturePresent 15022->15146 15025 7ff78877aa2c 7 API calls 15024->15025 15027 7ff78877a688 __FrameHandler3::FrameUnwindToEmptyState 15025->15027 15026 7ff78877a580 15028 7ff78877a606 15047 7ff788788738 15028->15047 15029->15026 15029->15028 15135 7ff788788ae4 15029->15135 15032 7ff78877a60b 15053 7ff788771000 15032->15053 15036 7ff78877a62f 15036->15027 15142 7ff78877a890 15036->15142 15153 7ff78877accc 15039->15153 15042 7ff78877a72b 15155 7ff7887891ec 15042->15155 15043 7ff78877a535 15043->15021 15043->15022 15048 7ff788788748 15047->15048 15052 7ff78878875d 15047->15052 15048->15052 15198 7ff7887881c8 15048->15198 15052->15032 15054 7ff788771011 15053->15054 15394 7ff7887767c0 15054->15394 15056 7ff788771023 15401 7ff788784f7c 15056->15401 15058 7ff7887727ab 15408 7ff788771af0 15058->15408 15062 7ff78877a100 _wfindfirst32i64 8 API calls 15063 7ff7887728de 15062->15063 15140 7ff78877ab80 GetModuleHandleW 15063->15140 15064 7ff7887727c9 15127 7ff7887728ca 15064->15127 15424 7ff788772c50 15064->15424 15066 7ff7887727fb 15066->15127 15427 7ff788775af0 15066->15427 15068 7ff788772817 15069 7ff788772863 15068->15069 15071 7ff788775af0 92 API calls 15068->15071 15442 7ff7887760f0 15069->15442 15075 7ff788772838 __std_exception_copy 15071->15075 15072 7ff788772878 15446 7ff7887719d0 15072->15446 15075->15069 15079 7ff7887760f0 89 API calls 15075->15079 15076 7ff78877296d 15077 7ff788772998 15076->15077 15564 7ff7887724a0 15076->15564 15087 7ff7887729db 15077->15087 15457 7ff788776db0 15077->15457 15078 7ff7887719d0 121 API calls 15082 7ff7887728ae 15078->15082 15079->15069 15083 7ff7887728b2 15082->15083 15084 7ff7887728f0 15082->15084 15535 7ff788771c50 15083->15535 15084->15076 15541 7ff788772de0 15084->15541 15085 7ff7887729b8 15088 7ff7887729bd 15085->15088 15089 7ff7887729ce SetDllDirectoryW 15085->15089 15471 7ff788774fa0 15087->15471 15092 7ff788771c50 86 API calls 15088->15092 15089->15087 15092->15127 15095 7ff788772a36 15102 7ff788772af6 15095->15102 15109 7ff788772a49 15095->15109 15096 7ff788772912 15099 7ff788771c50 86 API calls 15096->15099 15099->15127 15100 7ff7887729f8 15100->15095 15578 7ff7887747a0 15100->15578 15101 7ff788772940 15101->15076 15103 7ff788772945 15101->15103 15475 7ff788772330 15102->15475 15560 7ff78877e60c 15103->15560 15116 7ff788772a95 15109->15116 15672 7ff788771b30 15109->15672 15110 7ff788772a0d 15598 7ff788774730 15110->15598 15111 7ff788772a2c 15112 7ff7887749f0 FreeLibrary 15111->15112 15112->15095 15116->15127 15676 7ff7887722d0 15116->15676 15117 7ff788772a17 15117->15111 15120 7ff788772a1b 15117->15120 15118 7ff788772b2b 15121 7ff788775af0 92 API calls 15118->15121 15666 7ff788774df0 15120->15666 15125 7ff788772b37 15121->15125 15122 7ff788772ad1 15126 7ff7887749f0 FreeLibrary 15122->15126 15125->15127 15492 7ff788776130 15125->15492 15126->15127 15127->15062 15136 7ff788788afb 15135->15136 15137 7ff788788b1c 15135->15137 15136->15028 17920 7ff788789238 15137->17920 15141 7ff78877ab91 15140->15141 15141->15036 15143 7ff78877a8a1 15142->15143 15144 7ff78877a646 15143->15144 15145 7ff78877be28 __scrt_initialize_crt 7 API calls 15143->15145 15144->15026 15145->15144 15147 7ff78877aa52 _wfindfirst32i64 memcpy_s 15146->15147 15148 7ff78877aa71 RtlCaptureContext RtlLookupFunctionEntry 15147->15148 15149 7ff78877aa9a RtlVirtualUnwind 15148->15149 15150 7ff78877aad6 memcpy_s 15148->15150 15149->15150 15151 7ff78877ab08 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15150->15151 15152 7ff78877ab5a _wfindfirst32i64 15151->15152 15152->15024 15154 7ff78877a71e __scrt_dllmain_crt_thread_attach 15153->15154 15154->15042 15154->15043 15156 7ff78879264c 15155->15156 15157 7ff78877a730 15156->15157 15165 7ff78878bb50 15156->15165 15157->15043 15159 7ff78877be28 15157->15159 15160 7ff78877be3a 15159->15160 15161 7ff78877be30 15159->15161 15160->15043 15177 7ff78877c1a4 15161->15177 15176 7ff78878f808 EnterCriticalSection 15165->15176 15178 7ff78877c1b3 15177->15178 15179 7ff78877be35 15177->15179 15185 7ff78877c3e0 15178->15185 15181 7ff78877c210 15179->15181 15182 7ff78877c23b 15181->15182 15183 7ff78877c21e DeleteCriticalSection 15182->15183 15184 7ff78877c23f 15182->15184 15183->15182 15184->15160 15189 7ff78877c248 15185->15189 15195 7ff78877c362 TlsFree 15189->15195 15196 7ff78877c28c __vcrt_FlsAlloc 15189->15196 15190 7ff78877c2ba LoadLibraryExW 15192 7ff78877c2db GetLastError 15190->15192 15193 7ff78877c331 15190->15193 15191 7ff78877c351 GetProcAddress 15191->15195 15192->15196 15193->15191 15194 7ff78877c348 FreeLibrary 15193->15194 15194->15191 15196->15190 15196->15191 15196->15195 15197 7ff78877c2fd LoadLibraryExW 15196->15197 15197->15193 15197->15196 15199 7ff7887881e1 15198->15199 15206 7ff7887881dd 15198->15206 15219 7ff788791bfc GetEnvironmentStringsW 15199->15219 15202 7ff7887881fa 15232 7ff788788348 15202->15232 15203 7ff7887881ee 15226 7ff788789f78 15203->15226 15206->15052 15211 7ff788788588 15206->15211 15208 7ff788789f78 __free_lconv_num 11 API calls 15209 7ff788788221 15208->15209 15210 7ff788789f78 __free_lconv_num 11 API calls 15209->15210 15210->15206 15212 7ff7887885ab 15211->15212 15215 7ff7887885c2 15211->15215 15212->15052 15213 7ff78878e870 MultiByteToWideChar _fread_nolock 15213->15215 15214 7ff78878deb8 _set_fmode 11 API calls 15214->15215 15215->15212 15215->15213 15215->15214 15216 7ff788788636 15215->15216 15218 7ff788789f78 __free_lconv_num 11 API calls 15215->15218 15217 7ff788789f78 __free_lconv_num 11 API calls 15216->15217 15217->15212 15218->15215 15220 7ff788791c20 15219->15220 15221 7ff7887881e6 15219->15221 15251 7ff78878cc2c 15220->15251 15221->15202 15221->15203 15223 7ff788791c57 memcpy_s 15224 7ff788789f78 __free_lconv_num 11 API calls 15223->15224 15225 7ff788791c77 FreeEnvironmentStringsW 15224->15225 15225->15221 15227 7ff788789fac 15226->15227 15228 7ff788789f7d RtlFreeHeap 15226->15228 15227->15206 15228->15227 15229 7ff788789f98 GetLastError 15228->15229 15230 7ff788789fa5 __free_lconv_num 15229->15230 15231 7ff788786088 _set_fmode 9 API calls 15230->15231 15231->15227 15233 7ff788788370 15232->15233 15234 7ff78878deb8 _set_fmode 11 API calls 15233->15234 15247 7ff7887883ab 15234->15247 15235 7ff7887883b3 15236 7ff788789f78 __free_lconv_num 11 API calls 15235->15236 15238 7ff788788202 15236->15238 15237 7ff78878842d 15239 7ff788789f78 __free_lconv_num 11 API calls 15237->15239 15238->15208 15239->15238 15240 7ff78878deb8 _set_fmode 11 API calls 15240->15247 15241 7ff78878841c 15322 7ff788788464 15241->15322 15245 7ff788789f78 __free_lconv_num 11 API calls 15245->15235 15246 7ff788788450 15328 7ff788789f30 IsProcessorFeaturePresent 15246->15328 15247->15235 15247->15237 15247->15240 15247->15241 15247->15246 15249 7ff788789f78 __free_lconv_num 11 API calls 15247->15249 15313 7ff78878f9a4 15247->15313 15249->15247 15252 7ff78878cc77 15251->15252 15256 7ff78878cc3b _set_fmode 15251->15256 15261 7ff788786088 15252->15261 15254 7ff78878cc5e HeapAlloc 15255 7ff78878cc75 15254->15255 15254->15256 15255->15223 15256->15252 15256->15254 15258 7ff788792730 15256->15258 15264 7ff788792770 15258->15264 15270 7ff78878a8f8 GetLastError 15261->15270 15263 7ff788786091 15263->15255 15269 7ff78878f808 EnterCriticalSection 15264->15269 15271 7ff78878a939 FlsSetValue 15270->15271 15275 7ff78878a91c 15270->15275 15272 7ff78878a94b 15271->15272 15284 7ff78878a929 SetLastError 15271->15284 15287 7ff78878deb8 15272->15287 15275->15271 15275->15284 15277 7ff78878a978 FlsSetValue 15280 7ff78878a984 FlsSetValue 15277->15280 15281 7ff78878a996 15277->15281 15278 7ff78878a968 FlsSetValue 15279 7ff78878a971 15278->15279 15282 7ff788789f78 __free_lconv_num 5 API calls 15279->15282 15280->15279 15294 7ff78878a524 15281->15294 15282->15284 15284->15263 15292 7ff78878dec9 _set_fmode 15287->15292 15288 7ff78878df1a 15291 7ff788786088 _set_fmode 10 API calls 15288->15291 15289 7ff78878defe HeapAlloc 15290 7ff78878a95a 15289->15290 15289->15292 15290->15277 15290->15278 15291->15290 15292->15288 15292->15289 15293 7ff788792730 _set_fmode 2 API calls 15292->15293 15293->15292 15299 7ff78878a3fc 15294->15299 15311 7ff78878f808 EnterCriticalSection 15299->15311 15314 7ff78878f9b1 15313->15314 15315 7ff78878f9bb 15313->15315 15314->15315 15320 7ff78878f9d7 15314->15320 15316 7ff788786088 _set_fmode 11 API calls 15315->15316 15317 7ff78878f9c3 15316->15317 15332 7ff788789f10 15317->15332 15319 7ff78878f9cf 15319->15247 15320->15319 15321 7ff788786088 _set_fmode 11 API calls 15320->15321 15321->15317 15323 7ff788788424 15322->15323 15324 7ff788788469 15322->15324 15323->15245 15325 7ff788788492 15324->15325 15326 7ff788789f78 __free_lconv_num 11 API calls 15324->15326 15327 7ff788789f78 __free_lconv_num 11 API calls 15325->15327 15326->15324 15327->15323 15329 7ff788789f43 15328->15329 15372 7ff788789c44 15329->15372 15334 7ff788789da8 15332->15334 15335 7ff788789dd3 15334->15335 15338 7ff788789e44 15335->15338 15337 7ff788789dfa 15346 7ff788789b8c 15338->15346 15341 7ff788789e7f 15341->15337 15344 7ff788789f30 _wfindfirst32i64 17 API calls 15345 7ff788789f0f 15344->15345 15347 7ff788789be3 15346->15347 15348 7ff788789ba8 GetLastError 15346->15348 15347->15341 15352 7ff788789bf8 15347->15352 15349 7ff788789bb8 15348->15349 15355 7ff78878a9c0 15349->15355 15353 7ff788789c14 GetLastError SetLastError 15352->15353 15354 7ff788789c2c 15352->15354 15353->15354 15354->15341 15354->15344 15356 7ff78878a9df FlsGetValue 15355->15356 15357 7ff78878a9fa FlsSetValue 15355->15357 15358 7ff78878a9f4 15356->15358 15361 7ff788789bd3 SetLastError 15356->15361 15359 7ff78878aa07 15357->15359 15357->15361 15358->15357 15360 7ff78878deb8 _set_fmode 11 API calls 15359->15360 15362 7ff78878aa16 15360->15362 15361->15347 15363 7ff78878aa34 FlsSetValue 15362->15363 15364 7ff78878aa24 FlsSetValue 15362->15364 15366 7ff78878aa40 FlsSetValue 15363->15366 15367 7ff78878aa52 15363->15367 15365 7ff78878aa2d 15364->15365 15368 7ff788789f78 __free_lconv_num 11 API calls 15365->15368 15366->15365 15369 7ff78878a524 _set_fmode 11 API calls 15367->15369 15368->15361 15370 7ff78878aa5a 15369->15370 15371 7ff788789f78 __free_lconv_num 11 API calls 15370->15371 15371->15361 15373 7ff788789c7e _wfindfirst32i64 memcpy_s 15372->15373 15374 7ff788789ca6 RtlCaptureContext RtlLookupFunctionEntry 15373->15374 15375 7ff788789ce0 RtlVirtualUnwind 15374->15375 15376 7ff788789d16 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15374->15376 15375->15376 15377 7ff788789d68 _wfindfirst32i64 15376->15377 15380 7ff78877a100 15377->15380 15381 7ff78877a109 15380->15381 15382 7ff78877a114 GetCurrentProcess TerminateProcess 15381->15382 15383 7ff78877a1c0 IsProcessorFeaturePresent 15381->15383 15384 7ff78877a1d8 15383->15384 15389 7ff78877a3b4 RtlCaptureContext 15384->15389 15390 7ff78877a3ce RtlLookupFunctionEntry 15389->15390 15391 7ff78877a1eb 15390->15391 15392 7ff78877a3e4 RtlVirtualUnwind 15390->15392 15393 7ff78877a180 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 15391->15393 15392->15390 15392->15391 15396 7ff7887767df 15394->15396 15395 7ff788776830 WideCharToMultiByte 15395->15396 15398 7ff7887768d8 15395->15398 15396->15395 15397 7ff788776886 WideCharToMultiByte 15396->15397 15396->15398 15400 7ff7887767e7 __std_exception_copy 15396->15400 15397->15396 15397->15398 15708 7ff788771cb0 15398->15708 15400->15056 15403 7ff78878ecc0 15401->15403 15402 7ff78878ed13 15404 7ff788789e44 _invalid_parameter_noinfo 37 API calls 15402->15404 15403->15402 15405 7ff78878ed66 15403->15405 15407 7ff78878ed3c 15404->15407 16058 7ff78878eb98 15405->16058 15407->15058 15409 7ff788771b05 15408->15409 15410 7ff788771b20 15409->15410 16066 7ff788771c10 15409->16066 15410->15127 15412 7ff788772cd0 15410->15412 16089 7ff78877a130 15412->16089 15415 7ff788772d0b 15417 7ff788771cb0 86 API calls 15415->15417 15416 7ff788772d22 16091 7ff788776ec0 15416->16091 15423 7ff788772d1e 15417->15423 15420 7ff788771c50 86 API calls 15420->15423 15421 7ff78877a100 _wfindfirst32i64 8 API calls 15422 7ff788772d5f 15421->15422 15422->15064 15423->15421 15425 7ff788771b30 49 API calls 15424->15425 15426 7ff788772c6d 15425->15426 15426->15066 15428 7ff788775afa 15427->15428 15429 7ff788776db0 88 API calls 15428->15429 15430 7ff788775b1c GetEnvironmentVariableW 15429->15430 15431 7ff788775b86 15430->15431 15432 7ff788775b34 ExpandEnvironmentStringsW 15430->15432 15433 7ff78877a100 _wfindfirst32i64 8 API calls 15431->15433 15434 7ff788776ec0 88 API calls 15432->15434 15435 7ff788775b98 15433->15435 15436 7ff788775b5c 15434->15436 15435->15068 15436->15431 15437 7ff788775b66 15436->15437 16102 7ff78878926c 15437->16102 15440 7ff78877a100 _wfindfirst32i64 8 API calls 15441 7ff788775b7e 15440->15441 15441->15068 15443 7ff788776db0 88 API calls 15442->15443 15444 7ff788776107 SetEnvironmentVariableW 15443->15444 15445 7ff78877611f __std_exception_copy 15444->15445 15445->15072 15447 7ff788771b30 49 API calls 15446->15447 15448 7ff788771a00 15447->15448 15449 7ff788771b30 49 API calls 15448->15449 15455 7ff788771a7a 15448->15455 15450 7ff788771a22 15449->15450 15451 7ff788772c50 49 API calls 15450->15451 15450->15455 15452 7ff788771a3b 15451->15452 16109 7ff7887717b0 15452->16109 15455->15076 15455->15078 15456 7ff78877e60c 74 API calls 15456->15455 15458 7ff788776e57 MultiByteToWideChar 15457->15458 15459 7ff788776dd1 MultiByteToWideChar 15457->15459 15461 7ff788776e7a 15458->15461 15462 7ff788776e9f 15458->15462 15460 7ff788776df7 15459->15460 15464 7ff788776e1c 15459->15464 15463 7ff788771cb0 86 API calls 15460->15463 15465 7ff788771cb0 86 API calls 15461->15465 15462->15085 15466 7ff788776e0a 15463->15466 15464->15458 15468 7ff788776e32 15464->15468 15467 7ff788776e8d 15465->15467 15466->15085 15467->15085 15469 7ff788771cb0 86 API calls 15468->15469 15470 7ff788776e45 15469->15470 15470->15085 15472 7ff788774fb5 15471->15472 15473 7ff7887729e0 15472->15473 15474 7ff788771c10 86 API calls 15472->15474 15473->15095 15568 7ff788774c40 15473->15568 15474->15473 15477 7ff7887723e4 15475->15477 15484 7ff7887723a3 15475->15484 15476 7ff788772423 15479 7ff78877a100 _wfindfirst32i64 8 API calls 15476->15479 15477->15476 15478 7ff788771ab0 74 API calls 15477->15478 15478->15477 15480 7ff788772435 15479->15480 15480->15127 15485 7ff788776080 15480->15485 15484->15477 16182 7ff788771440 15484->16182 16216 7ff788771dc0 15484->16216 16271 7ff788771780 15484->16271 15486 7ff788776db0 88 API calls 15485->15486 15487 7ff78877609f 15486->15487 15488 7ff788776db0 88 API calls 15487->15488 15489 7ff7887760af 15488->15489 15490 7ff788786818 38 API calls 15489->15490 15491 7ff7887760bd __std_exception_copy 15490->15491 15491->15118 15493 7ff788776140 15492->15493 15494 7ff788776db0 88 API calls 15493->15494 15495 7ff788776171 SetConsoleCtrlHandler GetStartupInfoW 15494->15495 15496 7ff7887761d2 15495->15496 17125 7ff7887892e4 15496->17125 15500 7ff7887761e1 15501 7ff7887892e4 _fread_nolock 37 API calls 15500->15501 15502 7ff788776200 15501->15502 15503 7ff78878705c _fread_nolock 37 API calls 15502->15503 15504 7ff788776207 15503->15504 15505 7ff7887892e4 _fread_nolock 37 API calls 15504->15505 15536 7ff788771c6e 15535->15536 15537 7ff788771b90 78 API calls 15536->15537 15538 7ff788771c8c 15537->15538 15539 7ff788771d00 86 API calls 15538->15539 15540 7ff788771c9b 15539->15540 15540->15127 15542 7ff788772dec 15541->15542 15543 7ff788776db0 88 API calls 15542->15543 15544 7ff788772e17 15543->15544 15545 7ff788776db0 88 API calls 15544->15545 15546 7ff788772e2a 15545->15546 17181 7ff788785538 15546->17181 15549 7ff78877a100 _wfindfirst32i64 8 API calls 15550 7ff78877290a 15549->15550 15550->15096 15551 7ff788776360 15550->15551 15552 7ff788776384 15551->15552 15553 7ff78877ec94 73 API calls 15552->15553 15554 7ff78877645b __std_exception_copy 15552->15554 15555 7ff78877639e 15553->15555 15554->15101 15555->15554 17560 7ff788787a9c 15555->17560 15557 7ff78877ec94 73 API calls 15559 7ff7887763b3 15557->15559 15558 7ff78877e95c _fread_nolock 53 API calls 15558->15559 15559->15554 15559->15557 15559->15558 15561 7ff78877e63c 15560->15561 17575 7ff78877e3e8 15561->17575 15563 7ff78877e655 15563->15096 15565 7ff7887724b7 15564->15565 15566 7ff7887724e0 15564->15566 15565->15566 15567 7ff788771780 86 API calls 15565->15567 15566->15077 15567->15565 15569 7ff788774c64 15568->15569 15573 7ff788774c91 15568->15573 15570 7ff788774c8c 15569->15570 15571 7ff788771780 86 API calls 15569->15571 15569->15573 15577 7ff788774c87 __std_exception_copy memcpy_s 15569->15577 17586 7ff7887712b0 15570->17586 15571->15569 15573->15577 17612 7ff788772e60 15573->17612 15575 7ff788774cf7 15576 7ff788771c50 86 API calls 15575->15576 15575->15577 15576->15577 15577->15100 15592 7ff7887747ba memcpy_s 15578->15592 15580 7ff7887748df 15582 7ff788772e60 49 API calls 15580->15582 15581 7ff7887748fb 15584 7ff788771c50 86 API calls 15581->15584 15583 7ff788774958 15582->15583 15587 7ff788772e60 49 API calls 15583->15587 15590 7ff7887748f1 __std_exception_copy 15584->15590 15585 7ff788772e60 49 API calls 15585->15592 15586 7ff7887748c0 15586->15580 15588 7ff788772e60 49 API calls 15586->15588 15589 7ff788774988 15587->15589 15588->15580 15594 7ff788772e60 49 API calls 15589->15594 15591 7ff78877a100 _wfindfirst32i64 8 API calls 15590->15591 15593 7ff788772a09 15591->15593 15592->15580 15592->15581 15592->15585 15592->15586 15595 7ff788771440 158 API calls 15592->15595 15596 7ff7887748e1 15592->15596 17615 7ff788771650 15592->17615 15593->15110 15593->15111 15594->15590 15595->15592 15597 7ff788771c50 86 API calls 15596->15597 15597->15590 17620 7ff788776310 15598->17620 15600 7ff788774742 15601 7ff788776310 89 API calls 15600->15601 15602 7ff788774755 15601->15602 15603 7ff78877477a 15602->15603 15604 7ff78877476d GetProcAddress 15602->15604 15605 7ff788771c50 86 API calls 15603->15605 15608 7ff7887750fc GetProcAddress 15604->15608 15609 7ff7887750d9 15604->15609 15607 7ff788774786 15605->15607 15607->15117 15608->15609 15610 7ff788775121 GetProcAddress 15608->15610 15612 7ff788771cb0 86 API calls 15609->15612 15610->15609 15611 7ff788775146 GetProcAddress 15610->15611 15611->15609 15613 7ff78877516e GetProcAddress 15611->15613 15614 7ff7887750ec 15612->15614 15613->15609 15615 7ff788775196 GetProcAddress 15613->15615 15614->15117 15615->15609 15616 7ff7887751be GetProcAddress 15615->15616 15617 7ff7887751da 15616->15617 15618 7ff7887751e6 GetProcAddress 15616->15618 15617->15618 15619 7ff78877520e GetProcAddress 15618->15619 15620 7ff788775202 15618->15620 15621 7ff78877522a 15619->15621 15622 7ff788775236 GetProcAddress 15619->15622 15620->15619 15621->15622 15623 7ff78877525e GetProcAddress 15622->15623 15624 7ff788775252 15622->15624 15625 7ff78877527a 15623->15625 15626 7ff788775286 GetProcAddress 15623->15626 15624->15623 15625->15626 15627 7ff7887752ae GetProcAddress 15626->15627 15628 7ff7887752a2 15626->15628 15628->15627 15667 7ff788774e14 15666->15667 15668 7ff788771c50 86 API calls 15667->15668 15671 7ff788772a2a 15667->15671 15669 7ff788774e6e 15668->15669 15670 7ff7887749f0 FreeLibrary 15669->15670 15670->15671 15671->15095 15673 7ff788771b55 15672->15673 15674 7ff788783c80 49 API calls 15673->15674 15675 7ff788771b78 15674->15675 15675->15116 17624 7ff788773ac0 15676->17624 15679 7ff78877231d 15679->15122 15681 7ff7887722f4 15681->15679 17680 7ff788773840 15681->17680 15683 7ff788772300 15683->15679 17690 7ff7887739a0 15683->17690 15685 7ff78877230c 15685->15679 15686 7ff78877255c 15685->15686 15687 7ff788772547 15685->15687 15689 7ff78877257c 15686->15689 15701 7ff788772592 __std_exception_copy 15686->15701 15688 7ff788771c50 86 API calls 15687->15688 15715 7ff788771d00 15708->15715 15716 7ff788771d10 15715->15716 15740 7ff788783c80 15716->15740 15720 7ff788771d70 15773 7ff788771b90 15720->15773 15723 7ff78877a100 _wfindfirst32i64 8 API calls 15724 7ff788771cd7 GetLastError 15723->15724 15725 7ff788776670 15724->15725 15726 7ff78877667c 15725->15726 15727 7ff78877669d FormatMessageW 15726->15727 15728 7ff788776697 GetLastError 15726->15728 15729 7ff7887766ec WideCharToMultiByte 15727->15729 15730 7ff7887766d0 15727->15730 15728->15727 15732 7ff788776726 15729->15732 15733 7ff7887766e3 15729->15733 15731 7ff788771cb0 83 API calls 15730->15731 15731->15733 15734 7ff788771cb0 83 API calls 15732->15734 15735 7ff78877a100 _wfindfirst32i64 8 API calls 15733->15735 15734->15733 15736 7ff788771ce4 15735->15736 15737 7ff788771be0 15736->15737 15738 7ff788771d00 86 API calls 15737->15738 15739 7ff788771c02 15738->15739 15739->15400 15741 7ff788783cda 15740->15741 15742 7ff788783cff 15741->15742 15744 7ff788783d3b 15741->15744 15743 7ff788789e44 _invalid_parameter_noinfo 37 API calls 15742->15743 15746 7ff788783d29 15743->15746 15777 7ff7887816c4 15744->15777 15749 7ff78877a100 _wfindfirst32i64 8 API calls 15746->15749 15748 7ff788783e18 15750 7ff788789f78 __free_lconv_num 11 API calls 15748->15750 15751 7ff788771d58 15749->15751 15750->15746 15758 7ff788776bf0 MultiByteToWideChar 15751->15758 15752 7ff788783ded 15754 7ff788789f78 __free_lconv_num 11 API calls 15752->15754 15753 7ff788783e3c 15753->15748 15756 7ff788783e46 15753->15756 15754->15746 15755 7ff788783de4 15755->15748 15755->15752 15757 7ff788789f78 __free_lconv_num 11 API calls 15756->15757 15757->15746 15759 7ff788776c39 15758->15759 15760 7ff788776c53 15758->15760 15761 7ff788771cb0 82 API calls 15759->15761 15762 7ff788776c69 15760->15762 15763 7ff788776c83 MultiByteToWideChar 15760->15763 15772 7ff788776c4c __std_exception_copy 15761->15772 15764 7ff788771cb0 82 API calls 15762->15764 15765 7ff788776ca6 15763->15765 15766 7ff788776cc0 WideCharToMultiByte 15763->15766 15764->15772 15767 7ff788771cb0 82 API calls 15765->15767 15768 7ff788776cf6 15766->15768 15769 7ff788776ced 15766->15769 15767->15772 15768->15769 15771 7ff788776d1b WideCharToMultiByte 15768->15771 15770 7ff788771cb0 82 API calls 15769->15770 15770->15772 15771->15769 15771->15772 15772->15720 15774 7ff788771bb6 15773->15774 16043 7ff788783b5c 15774->16043 15776 7ff788771bcc 15776->15723 15778 7ff788781702 15777->15778 15779 7ff7887816f2 15777->15779 15780 7ff78878170b 15778->15780 15785 7ff788781739 15778->15785 15781 7ff788789e44 _invalid_parameter_noinfo 37 API calls 15779->15781 15782 7ff788789e44 _invalid_parameter_noinfo 37 API calls 15780->15782 15783 7ff788781731 15781->15783 15782->15783 15783->15748 15783->15752 15783->15753 15783->15755 15785->15779 15785->15783 15787 7ff7887819e8 15785->15787 15791 7ff788782614 15785->15791 15817 7ff788781ea4 15785->15817 15847 7ff78878120c 15785->15847 15850 7ff788783830 15785->15850 15789 7ff788789e44 _invalid_parameter_noinfo 37 API calls 15787->15789 15789->15779 15792 7ff7887826c9 15791->15792 15793 7ff788782656 15791->15793 15796 7ff7887826ce 15792->15796 15797 7ff788782723 15792->15797 15794 7ff78878265c 15793->15794 15795 7ff7887826f3 15793->15795 15803 7ff788782661 15794->15803 15806 7ff788782732 15794->15806 15874 7ff788780150 15795->15874 15798 7ff788782703 15796->15798 15799 7ff7887826d0 15796->15799 15797->15795 15797->15806 15815 7ff78878268c 15797->15815 15881 7ff78877fd40 15798->15881 15800 7ff788782671 15799->15800 15805 7ff7887826df 15799->15805 15816 7ff788782761 15800->15816 15856 7ff788782f78 15800->15856 15803->15800 15807 7ff7887826a4 15803->15807 15803->15815 15805->15795 15809 7ff7887826e4 15805->15809 15806->15816 15888 7ff788780560 15806->15888 15807->15816 15866 7ff788783434 15807->15866 15809->15816 15870 7ff7887835cc 15809->15870 15811 7ff78877a100 _wfindfirst32i64 8 API calls 15813 7ff7887829f7 15811->15813 15813->15785 15815->15816 15895 7ff78878db60 15815->15895 15816->15811 15818 7ff788781ec5 15817->15818 15819 7ff788781eaf 15817->15819 15822 7ff788789e44 _invalid_parameter_noinfo 37 API calls 15818->15822 15823 7ff788781f03 15818->15823 15820 7ff7887826c9 15819->15820 15821 7ff788782656 15819->15821 15819->15823 15826 7ff7887826ce 15820->15826 15827 7ff788782723 15820->15827 15824 7ff78878265c 15821->15824 15825 7ff7887826f3 15821->15825 15822->15823 15823->15785 15833 7ff788782661 15824->15833 15835 7ff788782732 15824->15835 15831 7ff788780150 38 API calls 15825->15831 15828 7ff788782703 15826->15828 15829 7ff7887826d0 15826->15829 15827->15825 15827->15835 15845 7ff78878268c 15827->15845 15834 7ff78877fd40 38 API calls 15828->15834 15830 7ff788782671 15829->15830 15838 7ff7887826df 15829->15838 15832 7ff788782f78 47 API calls 15830->15832 15846 7ff788782761 15830->15846 15831->15845 15832->15845 15833->15830 15836 7ff7887826a4 15833->15836 15833->15845 15834->15845 15837 7ff788780560 38 API calls 15835->15837 15835->15846 15839 7ff788783434 47 API calls 15836->15839 15836->15846 15837->15845 15838->15825 15840 7ff7887826e4 15838->15840 15839->15845 15842 7ff7887835cc 37 API calls 15840->15842 15840->15846 15841 7ff78877a100 _wfindfirst32i64 8 API calls 15843 7ff7887829f7 15841->15843 15842->15845 15843->15785 15844 7ff78878db60 47 API calls 15844->15845 15845->15844 15845->15846 15846->15841 15980 7ff78877f314 15847->15980 15851 7ff788783847 15850->15851 15997 7ff78878ccc0 15851->15997 15857 7ff788782f9a 15856->15857 15905 7ff78877f180 15857->15905 15862 7ff788783830 45 API calls 15863 7ff7887830d7 15862->15863 15864 7ff788783830 45 API calls 15863->15864 15865 7ff788783160 15863->15865 15864->15865 15865->15815 15867 7ff78878344c 15866->15867 15869 7ff7887834b4 15866->15869 15868 7ff78878db60 47 API calls 15867->15868 15867->15869 15868->15869 15869->15815 15871 7ff7887835ed 15870->15871 15872 7ff788789e44 _invalid_parameter_noinfo 37 API calls 15871->15872 15873 7ff78878361e 15871->15873 15872->15873 15873->15815 15875 7ff788780183 15874->15875 15876 7ff7887801b2 15875->15876 15878 7ff78878026f 15875->15878 15877 7ff78877f180 12 API calls 15876->15877 15880 7ff7887801ef 15876->15880 15877->15880 15879 7ff788789e44 _invalid_parameter_noinfo 37 API calls 15878->15879 15879->15880 15880->15815 15882 7ff78877fd73 15881->15882 15883 7ff78877fda2 15882->15883 15885 7ff78877fe5f 15882->15885 15884 7ff78877f180 12 API calls 15883->15884 15887 7ff78877fddf 15883->15887 15884->15887 15886 7ff788789e44 _invalid_parameter_noinfo 37 API calls 15885->15886 15886->15887 15887->15815 15889 7ff788780593 15888->15889 15890 7ff7887805c2 15889->15890 15892 7ff78878067f 15889->15892 15891 7ff78877f180 12 API calls 15890->15891 15894 7ff7887805ff 15890->15894 15891->15894 15893 7ff788789e44 _invalid_parameter_noinfo 37 API calls 15892->15893 15893->15894 15894->15815 15896 7ff78878db88 15895->15896 15897 7ff78878dbb6 memcpy_s 15896->15897 15898 7ff78878dbcd 15896->15898 15900 7ff788783830 45 API calls 15896->15900 15903 7ff78878db8d memcpy_s 15896->15903 15899 7ff788789e44 _invalid_parameter_noinfo 37 API calls 15897->15899 15897->15903 15898->15897 15898->15903 15977 7ff78878f138 15898->15977 15899->15903 15900->15898 15903->15815 15906 7ff78877f1a6 15905->15906 15907 7ff78877f1b7 15905->15907 15913 7ff78878d878 15906->15913 15907->15906 15908 7ff78878cc2c _fread_nolock 12 API calls 15907->15908 15909 7ff78877f1e4 15908->15909 15910 7ff78877f1f8 15909->15910 15911 7ff788789f78 __free_lconv_num 11 API calls 15909->15911 15912 7ff788789f78 __free_lconv_num 11 API calls 15910->15912 15911->15910 15912->15906 15914 7ff78878d895 15913->15914 15915 7ff78878d8c8 15913->15915 15916 7ff788789e44 _invalid_parameter_noinfo 37 API calls 15914->15916 15915->15914 15917 7ff78878d8fa 15915->15917 15932 7ff7887830b5 15916->15932 15922 7ff78878da0d 15917->15922 15925 7ff78878d942 15917->15925 15918 7ff78878daff 15968 7ff78878cd64 15918->15968 15920 7ff78878dac5 15961 7ff78878d0fc 15920->15961 15922->15918 15922->15920 15923 7ff78878da94 15922->15923 15926 7ff78878da57 15922->15926 15928 7ff78878da4d 15922->15928 15954 7ff78878d3dc 15923->15954 15925->15932 15935 7ff78878930c 15925->15935 15944 7ff78878d60c 15926->15944 15928->15920 15929 7ff78878da52 15928->15929 15929->15923 15929->15926 15932->15862 15932->15863 15933 7ff788789f30 _wfindfirst32i64 17 API calls 15934 7ff78878db5c 15933->15934 15936 7ff788789323 15935->15936 15937 7ff788789319 15935->15937 15938 7ff788786088 _set_fmode 11 API calls 15936->15938 15937->15936 15942 7ff78878933e 15937->15942 15939 7ff78878932a 15938->15939 15940 7ff788789f10 _invalid_parameter_noinfo 37 API calls 15939->15940 15941 7ff788789336 15940->15941 15941->15932 15941->15933 15942->15941 15943 7ff788786088 _set_fmode 11 API calls 15942->15943 15943->15939 15945 7ff78879324c 38 API calls 15944->15945 15946 7ff78878d659 15945->15946 15947 7ff788792c94 37 API calls 15946->15947 15948 7ff78878d6b4 15947->15948 15949 7ff78878d709 15948->15949 15951 7ff78878d6d4 15948->15951 15953 7ff78878d6b8 15948->15953 15950 7ff78878d1f8 45 API calls 15949->15950 15950->15953 15952 7ff78878d4b4 45 API calls 15951->15952 15952->15953 15953->15932 15955 7ff78879324c 38 API calls 15954->15955 15956 7ff78878d426 15955->15956 15957 7ff788792c94 37 API calls 15956->15957 15958 7ff78878d476 15957->15958 15959 7ff78878d47a 15958->15959 15960 7ff78878d4b4 45 API calls 15958->15960 15959->15932 15960->15959 15962 7ff78879324c 38 API calls 15961->15962 15963 7ff78878d147 15962->15963 15964 7ff788792c94 37 API calls 15963->15964 15965 7ff78878d19f 15964->15965 15966 7ff78878d1a3 15965->15966 15967 7ff78878d1f8 45 API calls 15965->15967 15966->15932 15967->15966 15969 7ff78878cda9 15968->15969 15970 7ff78878cddc 15968->15970 15971 7ff788789e44 _invalid_parameter_noinfo 37 API calls 15969->15971 15972 7ff78878cdf4 15970->15972 15974 7ff78878ce75 15970->15974 15976 7ff78878cdd5 memcpy_s 15971->15976 15973 7ff78878d0fc 46 API calls 15972->15973 15973->15976 15975 7ff788783830 45 API calls 15974->15975 15974->15976 15975->15976 15976->15932 15978 7ff78878f15c WideCharToMultiByte 15977->15978 15981 7ff78877f353 15980->15981 15982 7ff78877f341 15980->15982 15985 7ff78877f360 15981->15985 15989 7ff78877f39d 15981->15989 15983 7ff788786088 _set_fmode 11 API calls 15982->15983 15984 7ff78877f346 15983->15984 15986 7ff788789f10 _invalid_parameter_noinfo 37 API calls 15984->15986 15987 7ff788789e44 _invalid_parameter_noinfo 37 API calls 15985->15987 15988 7ff78877f351 15986->15988 15987->15988 15988->15785 15990 7ff78877f446 15989->15990 15991 7ff788786088 _set_fmode 11 API calls 15989->15991 15990->15988 15992 7ff788786088 _set_fmode 11 API calls 15990->15992 15994 7ff78877f43b 15991->15994 15993 7ff78877f4f0 15992->15993 15995 7ff788789f10 _invalid_parameter_noinfo 37 API calls 15993->15995 15996 7ff788789f10 _invalid_parameter_noinfo 37 API calls 15994->15996 15995->15988 15996->15990 15998 7ff78878ccd9 15997->15998 16000 7ff78878386f 15997->16000 15998->16000 16005 7ff7887924a4 15998->16005 16001 7ff78878cd2c 16000->16001 16002 7ff78878cd45 16001->16002 16004 7ff78878387f 16001->16004 16002->16004 16040 7ff788791810 16002->16040 16004->15785 16017 7ff78878a780 GetLastError 16005->16017 16008 7ff7887924fe 16008->16000 16018 7ff78878a7c1 FlsSetValue 16017->16018 16019 7ff78878a7a4 FlsGetValue 16017->16019 16021 7ff78878a7d3 16018->16021 16037 7ff78878a7b1 16018->16037 16020 7ff78878a7bb 16019->16020 16019->16037 16020->16018 16023 7ff78878deb8 _set_fmode 11 API calls 16021->16023 16022 7ff78878a82d SetLastError 16024 7ff78878a83a 16022->16024 16025 7ff78878a84d 16022->16025 16026 7ff78878a7e2 16023->16026 16024->16008 16039 7ff78878f808 EnterCriticalSection 16024->16039 16027 7ff78878936c __FrameHandler3::FrameUnwindToEmptyState 38 API calls 16025->16027 16028 7ff78878a800 FlsSetValue 16026->16028 16029 7ff78878a7f0 FlsSetValue 16026->16029 16030 7ff78878a852 16027->16030 16032 7ff78878a80c FlsSetValue 16028->16032 16033 7ff78878a81e 16028->16033 16031 7ff78878a7f9 16029->16031 16035 7ff788789f78 __free_lconv_num 11 API calls 16031->16035 16032->16031 16034 7ff78878a524 _set_fmode 11 API calls 16033->16034 16036 7ff78878a826 16034->16036 16035->16037 16038 7ff788789f78 __free_lconv_num 11 API calls 16036->16038 16037->16022 16038->16022 16041 7ff78878a780 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 16040->16041 16042 7ff788791819 16041->16042 16045 7ff788783b86 16043->16045 16044 7ff788783bbe 16046 7ff788789e44 _invalid_parameter_noinfo 37 API calls 16044->16046 16045->16044 16047 7ff788783bf1 16045->16047 16049 7ff788783be7 16046->16049 16050 7ff78877f140 16047->16050 16049->15776 16057 7ff78878438c EnterCriticalSection 16050->16057 16065 7ff78878438c EnterCriticalSection 16058->16065 16067 7ff788771d00 86 API calls 16066->16067 16068 7ff788771c37 16067->16068 16071 7ff7887844e0 16068->16071 16072 7ff78878450b 16071->16072 16075 7ff7887843a4 16072->16075 16088 7ff788786d50 EnterCriticalSection 16075->16088 16090 7ff788772cdc GetModuleFileNameW 16089->16090 16090->15415 16090->15416 16092 7ff788776ee4 WideCharToMultiByte 16091->16092 16093 7ff788776f52 WideCharToMultiByte 16091->16093 16094 7ff788776f0e 16092->16094 16097 7ff788776f25 16092->16097 16095 7ff788776f7f 16093->16095 16099 7ff788772d35 16093->16099 16096 7ff788771cb0 86 API calls 16094->16096 16098 7ff788771cb0 86 API calls 16095->16098 16096->16099 16097->16093 16100 7ff788776f3b 16097->16100 16098->16099 16099->15420 16099->15423 16101 7ff788771cb0 86 API calls 16100->16101 16101->16099 16103 7ff788775b6e 16102->16103 16104 7ff788789283 16102->16104 16103->15440 16104->16103 16105 7ff78878930c __std_exception_copy 37 API calls 16104->16105 16106 7ff7887892b0 16105->16106 16106->16103 16107 7ff788789f30 _wfindfirst32i64 17 API calls 16106->16107 16108 7ff7887892e0 16107->16108 16110 7ff7887717d4 16109->16110 16111 7ff7887717e4 16109->16111 16112 7ff788772de0 120 API calls 16110->16112 16113 7ff788776360 83 API calls 16111->16113 16142 7ff788771842 16111->16142 16112->16111 16114 7ff788771815 16113->16114 16114->16142 16143 7ff78877ec94 16114->16143 16116 7ff78877a100 _wfindfirst32i64 8 API calls 16118 7ff7887719c0 16116->16118 16117 7ff78877182b 16119 7ff78877184c 16117->16119 16120 7ff78877182f 16117->16120 16118->15455 16118->15456 16147 7ff78877e95c 16119->16147 16121 7ff788771c10 86 API calls 16120->16121 16121->16142 16124 7ff788771867 16126 7ff788771c10 86 API calls 16124->16126 16125 7ff78877ec94 73 API calls 16127 7ff7887718d1 16125->16127 16126->16142 16128 7ff7887718fe 16127->16128 16129 7ff7887718e3 16127->16129 16131 7ff78877e95c _fread_nolock 53 API calls 16128->16131 16130 7ff788771c10 86 API calls 16129->16130 16130->16142 16132 7ff788771913 16131->16132 16132->16124 16133 7ff788771925 16132->16133 16150 7ff78877e6d0 16133->16150 16136 7ff78877193d 16137 7ff788771c50 86 API calls 16136->16137 16137->16142 16138 7ff788771993 16140 7ff78877e60c 74 API calls 16138->16140 16138->16142 16139 7ff788771950 16139->16138 16141 7ff788771c50 86 API calls 16139->16141 16140->16142 16141->16138 16142->16116 16144 7ff78877ecc4 16143->16144 16156 7ff78877ea24 16144->16156 16146 7ff78877ecdd 16146->16117 16168 7ff78877e97c 16147->16168 16151 7ff788771939 16150->16151 16152 7ff78877e6d9 16150->16152 16151->16136 16151->16139 16153 7ff788786088 _set_fmode 11 API calls 16152->16153 16154 7ff78877e6de 16153->16154 16155 7ff788789f10 _invalid_parameter_noinfo 37 API calls 16154->16155 16155->16151 16157 7ff78877ea8e 16156->16157 16158 7ff78877ea4e 16156->16158 16157->16158 16160 7ff78877ea9a 16157->16160 16159 7ff788789e44 _invalid_parameter_noinfo 37 API calls 16158->16159 16166 7ff78877ea75 16159->16166 16167 7ff78878438c EnterCriticalSection 16160->16167 16166->16146 16169 7ff78877e9a6 16168->16169 16170 7ff788771861 16168->16170 16169->16170 16171 7ff78877e9b5 memcpy_s 16169->16171 16172 7ff78877e9f2 16169->16172 16170->16124 16170->16125 16174 7ff788786088 _set_fmode 11 API calls 16171->16174 16181 7ff78878438c EnterCriticalSection 16172->16181 16176 7ff78877e9ca 16174->16176 16178 7ff788789f10 _invalid_parameter_noinfo 37 API calls 16176->16178 16178->16170 16275 7ff788775880 16182->16275 16184 7ff788771454 16185 7ff788771459 16184->16185 16284 7ff788775ba0 16184->16284 16185->15484 16188 7ff7887714a7 16191 7ff7887714e0 16188->16191 16193 7ff788772de0 120 API calls 16188->16193 16189 7ff788771487 16190 7ff788771c10 86 API calls 16189->16190 16192 7ff78877149d 16190->16192 16194 7ff78877ec94 73 API calls 16191->16194 16192->15484 16195 7ff7887714bf 16193->16195 16196 7ff7887714f2 16194->16196 16195->16191 16199 7ff7887714c7 16195->16199 16197 7ff788771516 16196->16197 16198 7ff7887714f6 16196->16198 16201 7ff78877151c 16197->16201 16202 7ff788771534 16197->16202 16200 7ff788771c10 86 API calls 16198->16200 16203 7ff788771c50 86 API calls 16199->16203 16210 7ff7887714d6 __std_exception_copy 16200->16210 16309 7ff788771050 16201->16309 16206 7ff788771556 16202->16206 16214 7ff788771575 16202->16214 16203->16210 16205 7ff788771624 16208 7ff78877e60c 74 API calls 16205->16208 16209 7ff788771c10 86 API calls 16206->16209 16207 7ff78877e60c 74 API calls 16207->16205 16208->16192 16209->16210 16210->16205 16210->16207 16211 7ff78877e95c _fread_nolock 53 API calls 16211->16214 16212 7ff7887715d5 16215 7ff788771c10 86 API calls 16212->16215 16214->16210 16214->16211 16214->16212 16327 7ff78877f09c 16214->16327 16215->16210 16217 7ff788771dd6 16216->16217 16218 7ff788771b30 49 API calls 16217->16218 16220 7ff788771e0b 16218->16220 16219 7ff788772211 16220->16219 16221 7ff788772c50 49 API calls 16220->16221 16222 7ff788771e7f 16221->16222 16883 7ff788772230 16222->16883 16225 7ff788771efa 16227 7ff788772230 75 API calls 16225->16227 16226 7ff788771ec1 16228 7ff788775880 127 API calls 16226->16228 16229 7ff788771f4c 16227->16229 16230 7ff788771ec9 16228->16230 16231 7ff788771fb6 16229->16231 16232 7ff788771f50 16229->16232 16233 7ff788771eea 16230->16233 16891 7ff788775760 16230->16891 16237 7ff788772230 75 API calls 16231->16237 16234 7ff788775880 127 API calls 16232->16234 16235 7ff788771c50 86 API calls 16233->16235 16240 7ff788771ef3 16233->16240 16239 7ff788771f58 16234->16239 16235->16240 16238 7ff788771fe2 16237->16238 16241 7ff788772042 16238->16241 16242 7ff788772230 75 API calls 16238->16242 16239->16233 16243 7ff788775760 138 API calls 16239->16243 16245 7ff78877a100 _wfindfirst32i64 8 API calls 16240->16245 16241->16219 16244 7ff788775880 127 API calls 16241->16244 16246 7ff788772012 16242->16246 16247 7ff788771f75 16243->16247 16252 7ff788772052 16244->16252 16248 7ff788771fab 16245->16248 16246->16241 16250 7ff788772230 75 API calls 16246->16250 16247->16233 16249 7ff7887721f6 16247->16249 16248->15484 16254 7ff788771c50 86 API calls 16249->16254 16250->16241 16251 7ff788771af0 86 API calls 16253 7ff7887720af 16251->16253 16252->16219 16252->16251 16262 7ff78877216f 16252->16262 16253->16219 16255 7ff788771b30 49 API calls 16253->16255 16270 7ff78877216a 16254->16270 16257 7ff7887720d7 16255->16257 16256 7ff788771ab0 74 API calls 16256->16219 16257->16249 16258 7ff788771b30 49 API calls 16257->16258 16260 7ff788772104 16258->16260 16259 7ff7887721db 16259->16249 16261 7ff788771440 158 API calls 16259->16261 16260->16249 16263 7ff788771b30 49 API calls 16260->16263 16261->16259 16262->16259 16265 7ff788771780 86 API calls 16262->16265 16265->16262 16270->16256 16272 7ff7887717a1 16271->16272 16273 7ff788771795 16271->16273 16272->15484 16274 7ff788771c50 86 API calls 16273->16274 16274->16272 16276 7ff788775892 16275->16276 16281 7ff7887758c8 16275->16281 16331 7ff7887716d0 16276->16331 16281->16184 16282 7ff788771c50 86 API calls 16283 7ff7887758bd 16282->16283 16283->16184 16285 7ff788775bb0 16284->16285 16286 7ff788771b30 49 API calls 16285->16286 16287 7ff788775be1 16286->16287 16288 7ff788775dab 16287->16288 16289 7ff788771b30 49 API calls 16287->16289 16290 7ff78877a100 _wfindfirst32i64 8 API calls 16288->16290 16292 7ff788775c08 16289->16292 16291 7ff78877147f 16290->16291 16291->16188 16291->16189 16292->16288 16846 7ff788785158 16292->16846 16294 7ff788775d19 16295 7ff788776db0 88 API calls 16294->16295 16296 7ff788775d31 16295->16296 16297 7ff788775dda 16296->16297 16300 7ff788775af0 92 API calls 16296->16300 16304 7ff788775d62 __std_exception_copy 16296->16304 16299 7ff788772de0 120 API calls 16297->16299 16298 7ff788775c3d 16298->16288 16298->16294 16298->16298 16306 7ff788785158 49 API calls 16298->16306 16307 7ff788776db0 88 API calls 16298->16307 16308 7ff788776a60 58 API calls 16298->16308 16299->16288 16300->16304 16301 7ff788775dce 16303 7ff788771c50 86 API calls 16301->16303 16302 7ff788775d9f 16305 7ff788771c50 86 API calls 16302->16305 16303->16297 16304->16301 16304->16302 16305->16288 16306->16298 16307->16298 16308->16298 16310 7ff7887710a6 16309->16310 16311 7ff7887710ad 16310->16311 16312 7ff7887710d3 16310->16312 16313 7ff788771c50 86 API calls 16311->16313 16315 7ff7887710ed 16312->16315 16316 7ff788771109 16312->16316 16314 7ff7887710c0 16313->16314 16314->16210 16317 7ff788771c10 86 API calls 16315->16317 16318 7ff78877111b 16316->16318 16326 7ff788771137 memcpy_s 16316->16326 16321 7ff788771104 __std_exception_copy 16317->16321 16319 7ff788771c10 86 API calls 16318->16319 16319->16321 16320 7ff78877e95c _fread_nolock 53 API calls 16320->16326 16321->16210 16322 7ff78877e6d0 37 API calls 16322->16326 16323 7ff7887711fe 16324 7ff788771c50 86 API calls 16323->16324 16324->16321 16325 7ff78877f09c 76 API calls 16325->16326 16326->16320 16326->16321 16326->16322 16326->16323 16326->16325 16328 7ff78877f0cc 16327->16328 16868 7ff78877edec 16328->16868 16330 7ff78877f0ea 16330->16214 16333 7ff7887716f5 16331->16333 16332 7ff788771738 16335 7ff7887758e0 16332->16335 16333->16332 16334 7ff788771c50 86 API calls 16333->16334 16334->16332 16336 7ff7887758f8 16335->16336 16337 7ff78877596b 16336->16337 16338 7ff788775918 16336->16338 16340 7ff788775970 GetTempPathW GetCurrentProcessId 16337->16340 16339 7ff788775af0 92 API calls 16338->16339 16341 7ff788775924 16339->16341 16374 7ff788776610 16340->16374 16398 7ff7887755e0 16341->16398 16347 7ff78877a100 _wfindfirst32i64 8 API calls 16350 7ff7887758ad 16347->16350 16349 7ff78877594a __std_exception_copy 16349->16340 16353 7ff788775958 16349->16353 16350->16281 16350->16282 16351 7ff788775a46 16354 7ff788776ec0 88 API calls 16351->16354 16352 7ff78877599e __std_exception_copy 16352->16351 16356 7ff7887759d1 16352->16356 16378 7ff7887874d0 16352->16378 16381 7ff788776a60 16352->16381 16355 7ff788771c50 86 API calls 16353->16355 16358 7ff788775a57 __std_exception_copy 16354->16358 16359 7ff788776db0 88 API calls 16356->16359 16369 7ff788775a0a __std_exception_copy 16356->16369 16360 7ff788776db0 88 API calls 16358->16360 16358->16369 16361 7ff7887759e7 16359->16361 16362 7ff788775a75 16360->16362 16363 7ff7887759ec 16361->16363 16364 7ff788775a29 SetEnvironmentVariableW 16361->16364 16365 7ff788775aad SetEnvironmentVariableW 16362->16365 16366 7ff788775a7a 16362->16366 16367 7ff788776db0 88 API calls 16363->16367 16364->16369 16365->16369 16368 7ff788776db0 88 API calls 16366->16368 16370 7ff7887759fc 16367->16370 16372 7ff788775a8a 16368->16372 16369->16347 16371 7ff788786818 38 API calls 16370->16371 16371->16369 16373 7ff788786818 38 API calls 16372->16373 16373->16369 16375 7ff788776635 16374->16375 16432 7ff788783ed4 16375->16432 16604 7ff7887870fc 16378->16604 16382 7ff78877a130 16381->16382 16383 7ff788776a70 GetCurrentProcess OpenProcessToken 16382->16383 16384 7ff788776abb GetTokenInformation 16383->16384 16387 7ff788776b31 __std_exception_copy 16383->16387 16385 7ff788776add GetLastError 16384->16385 16386 7ff788776ae8 16384->16386 16385->16386 16385->16387 16386->16387 16391 7ff788776afe GetTokenInformation 16386->16391 16388 7ff788776b4a 16387->16388 16389 7ff788776b44 CloseHandle 16387->16389 16735 7ff788776760 16388->16735 16389->16388 16391->16387 16393 7ff788776b24 ConvertSidToStringSidW 16391->16393 16393->16387 16399 7ff7887755ec 16398->16399 16400 7ff788776db0 88 API calls 16399->16400 16401 7ff78877560e 16400->16401 16402 7ff788775629 ExpandEnvironmentStringsW 16401->16402 16403 7ff788775616 16401->16403 16405 7ff78877564f __std_exception_copy 16402->16405 16404 7ff788771c50 86 API calls 16403->16404 16406 7ff788775622 16404->16406 16407 7ff788775653 16405->16407 16411 7ff788775666 16405->16411 16408 7ff78877a100 _wfindfirst32i64 8 API calls 16406->16408 16409 7ff788771c50 86 API calls 16407->16409 16410 7ff788775748 16408->16410 16409->16406 16410->16369 16422 7ff788786818 16410->16422 16412 7ff788775674 16411->16412 16413 7ff788775680 16411->16413 16739 7ff7887860a8 16412->16739 16746 7ff7887853b8 16413->16746 16416 7ff78877567e 16417 7ff78877569a 16416->16417 16420 7ff7887756ad memcpy_s 16416->16420 16418 7ff788771c50 86 API calls 16417->16418 16418->16406 16419 7ff788775722 CreateDirectoryW 16419->16406 16420->16419 16421 7ff7887756fc CreateDirectoryW 16420->16421 16421->16420 16423 7ff788786838 16422->16423 16424 7ff788786825 16422->16424 16838 7ff78878649c 16423->16838 16426 7ff788786088 _set_fmode 11 API calls 16424->16426 16427 7ff78878682a 16426->16427 16428 7ff788789f10 _invalid_parameter_noinfo 37 API calls 16427->16428 16429 7ff788786836 16428->16429 16429->16349 16433 7ff788783f2e 16432->16433 16434 7ff788783f53 16433->16434 16436 7ff788783f8f 16433->16436 16435 7ff788789e44 _invalid_parameter_noinfo 37 API calls 16434->16435 16449 7ff788783f7d 16435->16449 16450 7ff788781a44 16436->16450 16438 7ff788784070 16441 7ff788789f78 __free_lconv_num 11 API calls 16438->16441 16440 7ff78877a100 _wfindfirst32i64 8 API calls 16442 7ff788776654 16440->16442 16441->16449 16442->16352 16443 7ff788784096 16443->16438 16445 7ff7887840a0 16443->16445 16444 7ff788784045 16446 7ff788789f78 __free_lconv_num 11 API calls 16444->16446 16448 7ff788789f78 __free_lconv_num 11 API calls 16445->16448 16446->16449 16447 7ff78878403c 16447->16438 16447->16444 16448->16449 16449->16440 16451 7ff788781a82 16450->16451 16452 7ff788781a72 16450->16452 16453 7ff788781a8b 16451->16453 16458 7ff788781ab9 16451->16458 16455 7ff788789e44 _invalid_parameter_noinfo 37 API calls 16452->16455 16456 7ff788789e44 _invalid_parameter_noinfo 37 API calls 16453->16456 16454 7ff788781ab1 16454->16438 16454->16443 16454->16444 16454->16447 16455->16454 16456->16454 16458->16452 16458->16454 16461 7ff788782a18 16458->16461 16494 7ff78878202c 16458->16494 16531 7ff78878129c 16458->16531 16462 7ff788782acb 16461->16462 16463 7ff788782a5a 16461->16463 16464 7ff788782b24 16462->16464 16465 7ff788782ad0 16462->16465 16466 7ff788782af5 16463->16466 16467 7ff788782a60 16463->16467 16473 7ff788782b2e 16464->16473 16474 7ff788782b3b 16464->16474 16479 7ff788782b33 16464->16479 16468 7ff788782b05 16465->16468 16469 7ff788782ad2 16465->16469 16550 7ff788780354 16466->16550 16470 7ff788782a65 16467->16470 16471 7ff788782a94 16467->16471 16557 7ff78877ff44 16468->16557 16472 7ff788782a74 16469->16472 16482 7ff788782ae1 16469->16482 16470->16474 16476 7ff788782a6b 16470->16476 16471->16476 16471->16479 16492 7ff788782b64 16472->16492 16534 7ff7887831cc 16472->16534 16473->16466 16473->16479 16564 7ff788783720 16474->16564 16476->16472 16481 7ff788782aa6 16476->16481 16489 7ff788782a8f 16476->16489 16479->16492 16568 7ff788780764 16479->16568 16481->16492 16544 7ff788783508 16481->16544 16482->16466 16484 7ff788782ae6 16482->16484 16488 7ff7887835cc 37 API calls 16484->16488 16484->16492 16486 7ff78877a100 _wfindfirst32i64 8 API calls 16487 7ff788782e5e 16486->16487 16487->16458 16488->16489 16490 7ff788783830 45 API calls 16489->16490 16489->16492 16493 7ff788782d50 16489->16493 16490->16493 16492->16486 16493->16492 16575 7ff78878dd10 16493->16575 16495 7ff78878203a 16494->16495 16496 7ff788782050 16494->16496 16498 7ff788782acb 16495->16498 16499 7ff788782a5a 16495->16499 16502 7ff788782090 16495->16502 16497 7ff788789e44 _invalid_parameter_noinfo 37 API calls 16496->16497 16496->16502 16497->16502 16500 7ff788782b24 16498->16500 16501 7ff788782ad0 16498->16501 16503 7ff788782af5 16499->16503 16504 7ff788782a60 16499->16504 16507 7ff788782b33 16500->16507 16510 7ff788782b2e 16500->16510 16511 7ff788782b3b 16500->16511 16505 7ff788782b05 16501->16505 16506 7ff788782ad2 16501->16506 16502->16458 16512 7ff788780354 38 API calls 16503->16512 16508 7ff788782a65 16504->16508 16509 7ff788782a94 16504->16509 16514 7ff78877ff44 38 API calls 16505->16514 16517 7ff788782ae1 16506->16517 16518 7ff788782a74 16506->16518 16520 7ff788780764 38 API calls 16507->16520 16529 7ff788782b64 16507->16529 16508->16511 16513 7ff788782a6b 16508->16513 16509->16507 16509->16513 16510->16503 16510->16507 16516 7ff788783720 45 API calls 16511->16516 16526 7ff788782a8f 16512->16526 16513->16518 16519 7ff788782aa6 16513->16519 16513->16526 16514->16526 16515 7ff7887831cc 47 API calls 16515->16526 16516->16526 16517->16503 16521 7ff788782ae6 16517->16521 16518->16515 16518->16529 16522 7ff788783508 46 API calls 16519->16522 16519->16529 16520->16526 16524 7ff7887835cc 37 API calls 16521->16524 16521->16529 16522->16526 16523 7ff78877a100 _wfindfirst32i64 8 API calls 16525 7ff788782e5e 16523->16525 16524->16526 16525->16458 16527 7ff788783830 45 API calls 16526->16527 16526->16529 16530 7ff788782d50 16526->16530 16527->16530 16528 7ff78878dd10 46 API calls 16528->16530 16529->16523 16530->16528 16530->16529 16587 7ff78877f5c8 16531->16587 16535 7ff7887831f2 16534->16535 16536 7ff78877f180 12 API calls 16535->16536 16537 7ff788783242 16536->16537 16538 7ff78878d878 46 API calls 16537->16538 16539 7ff788783315 16538->16539 16545 7ff78878353d 16544->16545 16546 7ff78878355b 16545->16546 16547 7ff788783830 45 API calls 16545->16547 16549 7ff788783582 16545->16549 16548 7ff78878dd10 46 API calls 16546->16548 16547->16546 16548->16549 16549->16489 16551 7ff788780387 16550->16551 16552 7ff7887803b6 16551->16552 16554 7ff788780473 16551->16554 16553 7ff78877f228 12 API calls 16552->16553 16556 7ff7887803f3 16552->16556 16553->16556 16555 7ff788789e44 _invalid_parameter_noinfo 37 API calls 16554->16555 16555->16556 16556->16489 16558 7ff78877ff77 16557->16558 16559 7ff78877ffa6 16558->16559 16561 7ff788780063 16558->16561 16560 7ff78877f228 12 API calls 16559->16560 16563 7ff78877ffe3 16559->16563 16560->16563 16562 7ff788789e44 _invalid_parameter_noinfo 37 API calls 16561->16562 16562->16563 16563->16489 16565 7ff788783763 16564->16565 16566 7ff7887837bc 45 API calls 16565->16566 16567 7ff788783767 __crtLCMapStringW 16565->16567 16566->16567 16567->16489 16570 7ff788780797 16568->16570 16569 7ff7887807c6 16571 7ff78877f228 12 API calls 16569->16571 16574 7ff788780803 16569->16574 16570->16569 16572 7ff788780883 16570->16572 16571->16574 16573 7ff788789e44 _invalid_parameter_noinfo 37 API calls 16572->16573 16573->16574 16574->16489 16576 7ff78878dd4f 16575->16576 16578 7ff78878dd41 16575->16578 16576->16493 16577 7ff78878dd6f 16580 7ff78878dd80 16577->16580 16581 7ff78878dda7 16577->16581 16578->16576 16578->16577 16579 7ff788783830 45 API calls 16578->16579 16579->16577 16582 7ff78878f5b8 8 API calls 16580->16582 16581->16576 16583 7ff78878de32 16581->16583 16585 7ff78878ddd1 16581->16585 16582->16576 16585->16576 16588 7ff78877f5fd 16587->16588 16589 7ff78877f60f 16587->16589 16590 7ff788786088 _set_fmode 11 API calls 16588->16590 16592 7ff78877f61d 16589->16592 16596 7ff78877f659 16589->16596 16591 7ff78877f602 16590->16591 16593 7ff788789f10 _invalid_parameter_noinfo 37 API calls 16591->16593 16594 7ff788789e44 _invalid_parameter_noinfo 37 API calls 16592->16594 16601 7ff78877f60d 16593->16601 16594->16601 16595 7ff78877f9d5 16597 7ff788786088 _set_fmode 11 API calls 16595->16597 16595->16601 16596->16595 16598 7ff788786088 _set_fmode 11 API calls 16596->16598 16599 7ff78877fc69 16597->16599 16600 7ff78877f9ca 16598->16600 16602 7ff788789f10 _invalid_parameter_noinfo 37 API calls 16599->16602 16603 7ff788789f10 _invalid_parameter_noinfo 37 API calls 16600->16603 16601->16458 16602->16601 16603->16595 16645 7ff788790718 16604->16645 16704 7ff788790490 16645->16704 16725 7ff78878f808 EnterCriticalSection 16704->16725 16736 7ff788776785 16735->16736 16737 7ff788783ed4 48 API calls 16736->16737 16738 7ff7887767a8 LocalFree ConvertStringSecurityDescriptorToSecurityDescriptorW 16737->16738 16740 7ff7887860f9 16739->16740 16741 7ff7887860c6 16739->16741 16740->16416 16741->16740 16742 7ff78878f9a4 _wfindfirst32i64 37 API calls 16741->16742 16743 7ff7887860f5 16742->16743 16743->16740 16744 7ff788789f30 _wfindfirst32i64 17 API calls 16743->16744 16745 7ff788786129 16744->16745 16747 7ff7887853d4 16746->16747 16748 7ff788785442 16746->16748 16747->16748 16750 7ff7887853d9 16747->16750 16783 7ff78878f110 16748->16783 16751 7ff78878540e 16750->16751 16752 7ff7887853f1 16750->16752 16766 7ff7887851fc GetFullPathNameW 16751->16766 16758 7ff788785188 GetFullPathNameW 16752->16758 16757 7ff788785406 __std_exception_copy 16757->16416 16759 7ff7887851ae GetLastError 16758->16759 16760 7ff7887851c4 16758->16760 16761 7ff788785ffc _fread_nolock 11 API calls 16759->16761 16763 7ff788786088 _set_fmode 11 API calls 16760->16763 16765 7ff7887851c0 16760->16765 16762 7ff7887851bb 16761->16762 16764 7ff788786088 _set_fmode 11 API calls 16762->16764 16763->16765 16764->16765 16765->16757 16767 7ff788785245 __std_exception_copy 16766->16767 16768 7ff78878522f GetLastError 16766->16768 16772 7ff78878529f GetFullPathNameW 16767->16772 16773 7ff788785241 16767->16773 16769 7ff788785ffc _fread_nolock 11 API calls 16768->16769 16770 7ff78878523c 16769->16770 16771 7ff788786088 _set_fmode 11 API calls 16770->16771 16771->16773 16772->16768 16772->16773 16774 7ff7887852d4 16773->16774 16778 7ff788785348 memcpy_s 16774->16778 16779 7ff7887852fd memcpy_s 16774->16779 16775 7ff788785331 16778->16757 16779->16775 16779->16778 16781 7ff78878536a 16779->16781 16781->16778 16786 7ff78878ef20 16783->16786 16787 7ff78878ef62 16786->16787 16788 7ff78878ef4b 16786->16788 16790 7ff78878ef66 16787->16790 16791 7ff78878ef87 16787->16791 16789 7ff788786088 _set_fmode 11 API calls 16788->16789 16793 7ff78878ef50 16789->16793 16812 7ff78878f08c 16790->16812 16824 7ff78878e588 16791->16824 16797 7ff788789f10 _invalid_parameter_noinfo 37 API calls 16793->16797 16808 7ff78878ef5b __std_exception_copy 16797->16808 16802 7ff78877a100 _wfindfirst32i64 8 API calls 16808->16802 16813 7ff78878f0d6 16812->16813 16814 7ff78878f0a6 16812->16814 16815 7ff78878f0e1 GetDriveTypeW 16813->16815 16816 7ff78878f0c1 16813->16816 16817 7ff788786068 _fread_nolock 11 API calls 16814->16817 16815->16816 16819 7ff78877a100 _wfindfirst32i64 8 API calls 16816->16819 16818 7ff78878f0ab 16817->16818 16825 7ff78877b880 memcpy_s 16824->16825 16826 7ff78878e5be GetCurrentDirectoryW 16825->16826 16827 7ff78878e5d5 16826->16827 16828 7ff78878e5fc 16826->16828 16845 7ff78878f808 EnterCriticalSection 16838->16845 16847 7ff78878a780 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 16846->16847 16848 7ff78878516d 16847->16848 16849 7ff78878ef17 16848->16849 16854 7ff78878ee36 16848->16854 16855 7ff78877a294 16849->16855 16852 7ff78877a100 _wfindfirst32i64 8 API calls 16853 7ff78878ef0f 16852->16853 16853->16298 16854->16852 16858 7ff78877a2a8 IsProcessorFeaturePresent 16855->16858 16859 7ff78877a2bf 16858->16859 16864 7ff78877a344 RtlCaptureContext RtlLookupFunctionEntry 16859->16864 16865 7ff78877a2d3 16864->16865 16866 7ff78877a374 RtlVirtualUnwind 16864->16866 16867 7ff78877a180 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 16865->16867 16866->16865 16869 7ff78877ee0c 16868->16869 16874 7ff78877ee39 16868->16874 16870 7ff78877ee16 16869->16870 16871 7ff78877ee41 16869->16871 16869->16874 16872 7ff788789e44 _invalid_parameter_noinfo 37 API calls 16870->16872 16875 7ff78877ed2c 16871->16875 16872->16874 16874->16330 16882 7ff78878438c EnterCriticalSection 16875->16882 16884 7ff788772264 16883->16884 16885 7ff788783c80 49 API calls 16884->16885 16886 7ff78877228a 16885->16886 16887 7ff78877229b 16886->16887 16915 7ff788784e70 16886->16915 16889 7ff78877a100 _wfindfirst32i64 8 API calls 16887->16889 16890 7ff788771ebd 16889->16890 16890->16225 16890->16226 16892 7ff78877576e 16891->16892 16893 7ff788772de0 120 API calls 16892->16893 16894 7ff788775795 16893->16894 16895 7ff788775ba0 138 API calls 16894->16895 16896 7ff7887757a3 16895->16896 16897 7ff788775853 16896->16897 16899 7ff7887757bd 16896->16899 16898 7ff78877584f 16897->16898 16901 7ff78877e60c 74 API calls 16897->16901 16902 7ff78877a100 _wfindfirst32i64 8 API calls 16898->16902 17099 7ff78877e6a4 16899->17099 16901->16898 16904 7ff788775875 16902->16904 16903 7ff788775830 16905 7ff78877e60c 74 API calls 16903->16905 16904->16233 16907 7ff788775847 16905->16907 16906 7ff78877e95c _fread_nolock 53 API calls 16913 7ff7887757c2 16906->16913 16909 7ff78877f09c 76 API calls 16909->16913 16910 7ff7887757f9 17105 7ff7887874ec 16910->17105 16911 7ff78877e6a4 37 API calls 16911->16913 16912 7ff78877e6d0 37 API calls 16912->16913 16913->16903 16913->16906 16913->16909 16913->16910 16913->16911 16913->16912 16916 7ff788784e8d 16915->16916 16917 7ff788784e99 16915->16917 16932 7ff7887846e8 16916->16932 16957 7ff788784a84 16917->16957 16921 7ff788784e92 16921->16887 16923 7ff788784ed1 16968 7ff78878456c 16923->16968 16926 7ff788784f2d 16926->16921 16930 7ff788789f78 __free_lconv_num 11 API calls 16926->16930 16927 7ff788784f41 16928 7ff7887846e8 69 API calls 16927->16928 16929 7ff788784f4d 16928->16929 16929->16921 16931 7ff788789f78 __free_lconv_num 11 API calls 16929->16931 16930->16921 16931->16921 16933 7ff788784702 16932->16933 16934 7ff78878471f 16932->16934 16936 7ff788786068 _fread_nolock 11 API calls 16933->16936 16934->16933 16935 7ff788784732 CreateFileW 16934->16935 16937 7ff78878479c 16935->16937 16938 7ff788784766 16935->16938 16939 7ff788784707 16936->16939 17016 7ff788784d60 16937->17016 16990 7ff78878483c GetFileType 16938->16990 16942 7ff788786088 _set_fmode 11 API calls 16939->16942 16945 7ff78878470f 16942->16945 16950 7ff788789f10 _invalid_parameter_noinfo 37 API calls 16945->16950 16946 7ff78878477b CloseHandle 16952 7ff78878471a 16946->16952 16947 7ff788784791 CloseHandle 16947->16952 16948 7ff7887847a5 16953 7ff788785ffc _fread_nolock 11 API calls 16948->16953 16949 7ff7887847d0 17037 7ff788784b20 16949->17037 16950->16952 16952->16921 16956 7ff7887847af 16953->16956 16956->16952 16958 7ff788784aa8 16957->16958 16959 7ff788784aa3 16957->16959 16958->16959 16960 7ff78878a780 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 16958->16960 16959->16923 16965 7ff78878e144 16959->16965 16961 7ff788784ac3 16960->16961 17078 7ff78878cc8c 16961->17078 17086 7ff78878df30 16965->17086 16969 7ff7887845ba 16968->16969 16970 7ff788784596 16968->16970 16971 7ff788784614 16969->16971 16972 7ff7887845bf 16969->16972 16974 7ff788789f78 __free_lconv_num 11 API calls 16970->16974 16976 7ff7887845a5 16970->16976 17096 7ff78878e870 16971->17096 16975 7ff7887845d4 16972->16975 16972->16976 16977 7ff788789f78 __free_lconv_num 11 API calls 16972->16977 16974->16976 16978 7ff78878cc2c _fread_nolock 12 API calls 16975->16978 16976->16926 16976->16927 16977->16975 16978->16976 16991 7ff78878488a 16990->16991 16992 7ff788784947 16990->16992 16993 7ff7887848b6 GetFileInformationByHandle 16991->16993 16997 7ff788784c5c 21 API calls 16991->16997 16994 7ff788784971 16992->16994 16995 7ff78878494f 16992->16995 16998 7ff788784962 GetLastError 16993->16998 16999 7ff7887848df 16993->16999 16996 7ff788784994 PeekNamedPipe 16994->16996 17014 7ff788784932 16994->17014 16995->16998 17000 7ff788784953 16995->17000 16996->17014 17006 7ff7887848a4 16997->17006 17001 7ff788785ffc _fread_nolock 11 API calls 16998->17001 17002 7ff788784b20 51 API calls 16999->17002 17003 7ff788786088 _set_fmode 11 API calls 17000->17003 17001->17014 17004 7ff7887848ea 17002->17004 17003->17014 17054 7ff7887849e4 17004->17054 17005 7ff78877a100 _wfindfirst32i64 8 API calls 17008 7ff788784774 17005->17008 17006->16993 17006->17014 17008->16946 17008->16947 17010 7ff7887849e4 10 API calls 17011 7ff788784909 17010->17011 17014->17005 17017 7ff788784d96 17016->17017 17018 7ff788786088 _set_fmode 11 API calls 17017->17018 17036 7ff788784e2e __std_exception_copy 17017->17036 17020 7ff788784da8 17018->17020 17019 7ff78877a100 _wfindfirst32i64 8 API calls 17021 7ff7887847a1 17019->17021 17022 7ff788786088 _set_fmode 11 API calls 17020->17022 17021->16948 17021->16949 17023 7ff788784db0 17022->17023 17024 7ff7887853b8 45 API calls 17023->17024 17025 7ff788784dc5 17024->17025 17026 7ff788784dcd 17025->17026 17027 7ff788784dd7 17025->17027 17028 7ff788786088 _set_fmode 11 API calls 17026->17028 17029 7ff788786088 _set_fmode 11 API calls 17027->17029 17032 7ff788784dd2 17028->17032 17030 7ff788784ddc 17029->17030 17031 7ff788786088 _set_fmode 11 API calls 17030->17031 17030->17036 17033 7ff788784de6 17031->17033 17034 7ff788784e20 GetDriveTypeW 17032->17034 17032->17036 17034->17036 17036->17019 17039 7ff788784b48 17037->17039 17038 7ff7887847dd 17047 7ff788784c5c 17038->17047 17039->17038 17061 7ff78878e6f4 17039->17061 17048 7ff788784c76 17047->17048 17049 7ff788784cad 17048->17049 17050 7ff788784c86 17048->17050 17051 7ff78878e588 21 API calls 17049->17051 17052 7ff788784c96 17050->17052 17053 7ff788785ffc _fread_nolock 11 API calls 17050->17053 17051->17052 17052->16956 17053->17052 17055 7ff788784a0d FileTimeToSystemTime 17054->17055 17056 7ff788784a00 17054->17056 17057 7ff788784a21 SystemTimeToTzSpecificLocalTime 17055->17057 17058 7ff788784a08 17055->17058 17056->17055 17056->17058 17057->17058 17059 7ff78877a100 _wfindfirst32i64 8 API calls 17058->17059 17060 7ff7887848f9 17059->17060 17060->17010 17062 7ff78878e701 17061->17062 17063 7ff78878e725 17061->17063 17062->17063 17064 7ff78878e706 17062->17064 17065 7ff78878e75f 17063->17065 17068 7ff78878e77e 17063->17068 17066 7ff788786088 _set_fmode 11 API calls 17064->17066 17067 7ff788786088 _set_fmode 11 API calls 17065->17067 17069 7ff78878e70b 17066->17069 17070 7ff78878e764 17067->17070 17071 7ff788784a84 45 API calls 17068->17071 17077 7ff78878e78b 17071->17077 17079 7ff78878cca1 17078->17079 17080 7ff788784ae6 17078->17080 17079->17080 17081 7ff7887924a4 45 API calls 17079->17081 17082 7ff78878ccf8 17080->17082 17081->17080 17083 7ff78878cd20 17082->17083 17084 7ff78878cd0d 17082->17084 17083->16959 17084->17083 17085 7ff788791810 45 API calls 17084->17085 17085->17083 17087 7ff78878df8d 17086->17087 17094 7ff78878df88 __vcrt_FlsAlloc 17086->17094 17087->16923 17088 7ff78878dfbd LoadLibraryExW 17090 7ff78878e092 17088->17090 17091 7ff78878dfe2 GetLastError 17088->17091 17089 7ff78878e0b2 GetProcAddress 17089->17087 17093 7ff78878e0c3 17089->17093 17090->17089 17092 7ff78878e0a9 FreeLibrary 17090->17092 17091->17094 17092->17089 17093->17087 17094->17087 17094->17088 17094->17089 17095 7ff78878e01c LoadLibraryExW 17094->17095 17095->17090 17095->17094 17098 7ff78878e879 MultiByteToWideChar 17096->17098 17100 7ff78877e6ad 17099->17100 17104 7ff78877e6bd 17099->17104 17101 7ff788786088 _set_fmode 11 API calls 17100->17101 17102 7ff78877e6b2 17101->17102 17103 7ff788789f10 _invalid_parameter_noinfo 37 API calls 17102->17103 17103->17104 17104->16913 17106 7ff7887874f4 17105->17106 17126 7ff7887761da 17125->17126 17127 7ff7887892ed 17125->17127 17131 7ff78878705c 17126->17131 17128 7ff788786088 _set_fmode 11 API calls 17127->17128 17129 7ff7887892f2 17128->17129 17130 7ff788789f10 _invalid_parameter_noinfo 37 API calls 17129->17130 17130->17126 17132 7ff78878707a 17131->17132 17133 7ff788787065 17131->17133 17136 7ff788786068 _fread_nolock 11 API calls 17132->17136 17139 7ff788787072 17132->17139 17134 7ff788786068 _fread_nolock 11 API calls 17133->17134 17135 7ff78878706a 17134->17135 17137 7ff788786088 _set_fmode 11 API calls 17135->17137 17138 7ff7887870b5 17136->17138 17137->17139 17140 7ff788786088 _set_fmode 11 API calls 17138->17140 17139->15500 17141 7ff7887870bd 17140->17141 17142 7ff788789f10 _invalid_parameter_noinfo 37 API calls 17141->17142 17142->17139 17182 7ff78878546c 17181->17182 17183 7ff788785492 17182->17183 17186 7ff7887854c5 17182->17186 17184 7ff788786088 _set_fmode 11 API calls 17183->17184 17185 7ff788785497 17184->17185 17187 7ff788789f10 _invalid_parameter_noinfo 37 API calls 17185->17187 17188 7ff7887854cb 17186->17188 17189 7ff7887854d8 17186->17189 17193 7ff788772e39 17187->17193 17191 7ff788786088 _set_fmode 11 API calls 17188->17191 17200 7ff78878a258 17189->17200 17191->17193 17193->15549 17213 7ff78878f808 EnterCriticalSection 17200->17213 17561 7ff788787acc 17560->17561 17564 7ff7887875a8 17561->17564 17563 7ff788787ae5 17563->15559 17565 7ff7887875c3 17564->17565 17566 7ff7887875f2 17564->17566 17567 7ff788789e44 _invalid_parameter_noinfo 37 API calls 17565->17567 17574 7ff78878438c EnterCriticalSection 17566->17574 17569 7ff7887875e3 17567->17569 17569->17563 17576 7ff78877e403 17575->17576 17578 7ff78877e431 17575->17578 17577 7ff788789e44 _invalid_parameter_noinfo 37 API calls 17576->17577 17580 7ff78877e423 17577->17580 17578->17580 17585 7ff78878438c EnterCriticalSection 17578->17585 17580->15563 17587 7ff7887712f8 17586->17587 17588 7ff7887712c6 17586->17588 17590 7ff78877ec94 73 API calls 17587->17590 17589 7ff788772de0 120 API calls 17588->17589 17591 7ff7887712d6 17589->17591 17592 7ff78877130a 17590->17592 17591->17587 17593 7ff7887712de 17591->17593 17594 7ff78877130e 17592->17594 17595 7ff78877132f 17592->17595 17597 7ff788771c50 86 API calls 17593->17597 17596 7ff788771c10 86 API calls 17594->17596 17600 7ff788771364 17595->17600 17601 7ff788771344 17595->17601 17598 7ff788771325 17596->17598 17599 7ff7887712ee 17597->17599 17598->15573 17599->15573 17603 7ff78877137e 17600->17603 17607 7ff788771395 17600->17607 17602 7ff788771c10 86 API calls 17601->17602 17610 7ff78877135f __std_exception_copy 17602->17610 17604 7ff788771050 94 API calls 17603->17604 17604->17610 17605 7ff78877e95c _fread_nolock 53 API calls 17605->17607 17606 7ff788771421 17606->15573 17607->17605 17609 7ff7887713de 17607->17609 17607->17610 17608 7ff78877e60c 74 API calls 17608->17606 17611 7ff788771c10 86 API calls 17609->17611 17610->17606 17610->17608 17611->17610 17613 7ff788771b30 49 API calls 17612->17613 17614 7ff788772e90 17613->17614 17614->15575 17616 7ff7887716aa 17615->17616 17617 7ff788771666 17615->17617 17616->15592 17617->17616 17618 7ff788771c50 86 API calls 17617->17618 17619 7ff7887716be 17618->17619 17619->15592 17621 7ff788776db0 88 API calls 17620->17621 17622 7ff788776327 LoadLibraryExW 17621->17622 17623 7ff788776344 __std_exception_copy 17622->17623 17623->15600 17625 7ff788773ad0 17624->17625 17626 7ff788771b30 49 API calls 17625->17626 17627 7ff788773b02 17626->17627 17628 7ff788773b2b 17627->17628 17629 7ff788773b0b 17627->17629 17631 7ff788773b82 17628->17631 17632 7ff788772e60 49 API calls 17628->17632 17630 7ff788771c50 86 API calls 17629->17630 17634 7ff788773b21 17630->17634 17633 7ff788772e60 49 API calls 17631->17633 17635 7ff788773b4c 17632->17635 17636 7ff788773b9b 17633->17636 17638 7ff78877a100 _wfindfirst32i64 8 API calls 17634->17638 17637 7ff788773b6a 17635->17637 17640 7ff788771c50 86 API calls 17635->17640 17639 7ff788773bb9 17636->17639 17643 7ff788771c50 86 API calls 17636->17643 17695 7ff788772d70 17637->17695 17642 7ff7887722de 17638->17642 17644 7ff788776310 89 API calls 17639->17644 17640->17637 17642->15679 17652 7ff788773e40 17642->17652 17643->17639 17645 7ff788773bc6 17644->17645 17647 7ff788773bed 17645->17647 17648 7ff788773bcb 17645->17648 17701 7ff788772f20 GetProcAddress 17647->17701 17649 7ff788771cb0 86 API calls 17648->17649 17649->17634 17651 7ff788776310 89 API calls 17651->17631 17653 7ff788775af0 92 API calls 17652->17653 17654 7ff788773e55 17653->17654 17656 7ff788771c50 86 API calls 17654->17656 17658 7ff788773e70 17654->17658 17655 7ff788776db0 88 API calls 17657 7ff788773eb4 17655->17657 17656->17658 17659 7ff788773eb9 17657->17659 17660 7ff788773ed0 17657->17660 17658->17655 17661 7ff788771c50 86 API calls 17659->17661 17663 7ff788776db0 88 API calls 17660->17663 17662 7ff788773ec5 17661->17662 17662->15681 17664 7ff788773f05 17663->17664 17666 7ff788771b30 49 API calls 17664->17666 17678 7ff788773f0a __std_exception_copy 17664->17678 17665 7ff788771c50 86 API calls 17667 7ff7887740b1 17665->17667 17668 7ff788773f87 17666->17668 17667->15681 17669 7ff788773f8e 17668->17669 17670 7ff788773fb3 17668->17670 17671 7ff788771c50 86 API calls 17669->17671 17672 7ff788776db0 88 API calls 17670->17672 17673 7ff788773fa3 17671->17673 17674 7ff788773fcc 17672->17674 17673->15681 17674->17678 17808 7ff788773c20 17674->17808 17678->17665 17679 7ff78877409a 17678->17679 17679->15681 17681 7ff788773857 17680->17681 17681->17681 17682 7ff788773880 17681->17682 17686 7ff788773897 __std_exception_copy 17681->17686 17683 7ff788771c50 86 API calls 17682->17683 17684 7ff78877388c 17683->17684 17684->15683 17685 7ff78877397b 17685->15683 17686->17685 17687 7ff7887712b0 120 API calls 17686->17687 17688 7ff788771780 86 API calls 17686->17688 17689 7ff788771c50 86 API calls 17686->17689 17687->17686 17688->17686 17689->17686 17692 7ff788773aa7 17690->17692 17694 7ff7887739bb 17690->17694 17691 7ff788771780 86 API calls 17691->17694 17692->15685 17693 7ff788771c50 86 API calls 17693->17694 17694->17691 17694->17692 17694->17693 17696 7ff788772d7a 17695->17696 17697 7ff788776db0 88 API calls 17696->17697 17698 7ff788772da2 17697->17698 17699 7ff78877a100 _wfindfirst32i64 8 API calls 17698->17699 17700 7ff788772dca 17699->17700 17700->17631 17700->17651 17702 7ff788772f6b GetProcAddress 17701->17702 17703 7ff788772f48 17701->17703 17702->17703 17704 7ff788772f90 GetProcAddress 17702->17704 17705 7ff788771cb0 86 API calls 17703->17705 17704->17703 17706 7ff788772fb5 GetProcAddress 17704->17706 17707 7ff788772f5b 17705->17707 17706->17703 17708 7ff788772fdd GetProcAddress 17706->17708 17707->17634 17708->17703 17709 7ff788773005 GetProcAddress 17708->17709 17709->17703 17710 7ff78877302d GetProcAddress 17709->17710 17711 7ff788773049 17710->17711 17712 7ff788773055 GetProcAddress 17710->17712 17711->17712 17713 7ff78877307d GetProcAddress 17712->17713 17714 7ff788773071 17712->17714 17715 7ff788773099 17713->17715 17714->17713 17716 7ff7887730ad GetProcAddress 17715->17716 17717 7ff7887730d5 GetProcAddress 17715->17717 17716->17717 17718 7ff7887730c9 17716->17718 17719 7ff7887730fd GetProcAddress 17717->17719 17720 7ff7887730f1 17717->17720 17718->17717 17721 7ff788773119 17719->17721 17722 7ff788773125 GetProcAddress 17719->17722 17720->17719 17721->17722 17723 7ff78877314d GetProcAddress 17722->17723 17724 7ff788773141 17722->17724 17725 7ff788773169 17723->17725 17726 7ff788773175 GetProcAddress 17723->17726 17724->17723 17725->17726 17727 7ff78877319d GetProcAddress 17726->17727 17728 7ff788773191 17726->17728 17729 7ff7887731b9 17727->17729 17730 7ff7887731c5 GetProcAddress 17727->17730 17728->17727 17729->17730 17731 7ff7887731ed GetProcAddress 17730->17731 17732 7ff7887731e1 17730->17732 17732->17731 17815 7ff788773c3a 17808->17815 17809 7ff78877a100 _wfindfirst32i64 8 API calls 17811 7ff788773e10 17809->17811 17810 7ff788771780 86 API calls 17810->17815 17835 7ff788776fb0 17811->17835 17812 7ff788773d53 17814 7ff7887892e4 _fread_nolock 37 API calls 17812->17814 17834 7ff788773df1 17812->17834 17816 7ff788773d6a 17814->17816 17815->17810 17815->17812 17817 7ff788773e29 17815->17817 17815->17834 17842 7ff788785740 17815->17842 17846 7ff78878584c 17816->17846 17819 7ff788771c50 86 API calls 17817->17819 17819->17834 17834->17809 17843 7ff788785770 17842->17843 17871 7ff788785544 17843->17871 17872 7ff788785577 17871->17872 17921 7ff78878a780 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 17920->17921 17922 7ff788789241 17921->17922 17925 7ff78878936c 17922->17925 17934 7ff7887927f0 17925->17934 17960 7ff7887927a8 17934->17960 17965 7ff78878f808 EnterCriticalSection 17960->17965 18036 7ff788788919 18037 7ff788789238 45 API calls 18036->18037 18038 7ff78878891e 18037->18038 18039 7ff78878898f 18038->18039 18040 7ff788788945 GetModuleHandleW 18038->18040 18048 7ff78878881c 18039->18048 18040->18039 18046 7ff788788952 18040->18046 18046->18039 18062 7ff788788a40 GetModuleHandleExW 18046->18062 18068 7ff78878f808 EnterCriticalSection 18048->18068 18063 7ff788788a74 GetProcAddress 18062->18063 18064 7ff788788a9d 18062->18064 18067 7ff788788a86 18063->18067 18065 7ff788788aa2 FreeLibrary 18064->18065 18066 7ff788788aa9 18064->18066 18065->18066 18066->18039 18067->18064 18140 7ff788788bb0 18143 7ff788788b30 18140->18143 18150 7ff78878f808 EnterCriticalSection 18143->18150 18967 7ff788784330 18968 7ff78878433b 18967->18968 18976 7ff78878e4c4 18968->18976 18989 7ff78878f808 EnterCriticalSection 18976->18989 18990 7ff78877a430 18991 7ff78877a440 18990->18991 19007 7ff78878580c 18991->19007 18993 7ff78877a44c 19013 7ff78877a748 18993->19013 18995 7ff78877a4b9 18996 7ff78877aa2c 7 API calls 18995->18996 19006 7ff78877a4d5 18995->19006 18998 7ff78877a4e5 18996->18998 18997 7ff78877a464 _RTC_Initialize 18997->18995 19018 7ff78877a8f8 18997->19018 19000 7ff78877a479 19021 7ff788787fd0 19000->19021 19008 7ff78878581d 19007->19008 19009 7ff788786088 _set_fmode 11 API calls 19008->19009 19010 7ff788785825 19008->19010 19011 7ff788785834 19009->19011 19010->18993 19012 7ff788789f10 _invalid_parameter_noinfo 37 API calls 19011->19012 19012->19010 19014 7ff78877a759 19013->19014 19017 7ff78877a75e __scrt_release_startup_lock 19013->19017 19015 7ff78877aa2c 7 API calls 19014->19015 19014->19017 19016 7ff78877a7d2 19015->19016 19017->18997 19046 7ff78877a8bc 19018->19046 19020 7ff78877a901 19020->19000 19022 7ff78877a485 19021->19022 19023 7ff788787ff0 19021->19023 19022->18995 19045 7ff78877a9cc InitializeSListHead 19022->19045 19024 7ff78878800e GetModuleFileNameW 19023->19024 19025 7ff788787ff8 19023->19025 19029 7ff788788039 19024->19029 19026 7ff788786088 _set_fmode 11 API calls 19025->19026 19027 7ff788787ffd 19026->19027 19028 7ff788789f10 _invalid_parameter_noinfo 37 API calls 19027->19028 19028->19022 19030 7ff788787f70 11 API calls 19029->19030 19031 7ff788788079 19030->19031 19032 7ff788788081 19031->19032 19037 7ff788788099 19031->19037 19033 7ff788786088 _set_fmode 11 API calls 19032->19033 19034 7ff788788086 19033->19034 19035 7ff788789f78 __free_lconv_num 11 API calls 19034->19035 19035->19022 19036 7ff7887880bb 19038 7ff788789f78 __free_lconv_num 11 API calls 19036->19038 19037->19036 19039 7ff7887880e7 19037->19039 19040 7ff788788100 19037->19040 19038->19022 19041 7ff788789f78 __free_lconv_num 11 API calls 19039->19041 19042 7ff788789f78 __free_lconv_num 11 API calls 19040->19042 19043 7ff7887880f0 19041->19043 19042->19036 19044 7ff788789f78 __free_lconv_num 11 API calls 19043->19044 19044->19022 19047 7ff78877a8d6 19046->19047 19049 7ff78877a8cf 19046->19049 19050 7ff78878904c 19047->19050 19049->19020 19053 7ff788788c88 19050->19053 19060 7ff78878f808 EnterCriticalSection 19053->19060 18079 7ff78878e95c 18080 7ff78878eb4e 18079->18080 18082 7ff78878e99e _isindst 18079->18082 18081 7ff788786088 _set_fmode 11 API calls 18080->18081 18099 7ff78878eb3e 18081->18099 18082->18080 18085 7ff78878ea1e _isindst 18082->18085 18083 7ff78877a100 _wfindfirst32i64 8 API calls 18084 7ff78878eb69 18083->18084 18100 7ff788795434 18085->18100 18090 7ff78878eb7a 18092 7ff788789f30 _wfindfirst32i64 17 API calls 18090->18092 18094 7ff78878eb8e 18092->18094 18097 7ff78878ea7b 18097->18099 18125 7ff788795478 18097->18125 18099->18083 18101 7ff78878ea3c 18100->18101 18102 7ff788795443 18100->18102 18107 7ff788794838 18101->18107 18132 7ff78878f808 EnterCriticalSection 18102->18132 18108 7ff788794841 18107->18108 18110 7ff78878ea51 18107->18110 18109 7ff788786088 _set_fmode 11 API calls 18108->18109 18111 7ff788794846 18109->18111 18110->18090 18113 7ff788794868 18110->18113 18112 7ff788789f10 _invalid_parameter_noinfo 37 API calls 18111->18112 18112->18110 18114 7ff788794871 18113->18114 18118 7ff78878ea62 18113->18118 18115 7ff788786088 _set_fmode 11 API calls 18114->18115 18116 7ff788794876 18115->18116 18117 7ff788789f10 _invalid_parameter_noinfo 37 API calls 18116->18117 18117->18118 18118->18090 18119 7ff788794898 18118->18119 18120 7ff7887948a1 18119->18120 18121 7ff78878ea73 18119->18121 18122 7ff788786088 _set_fmode 11 API calls 18120->18122 18121->18090 18121->18097 18123 7ff7887948a6 18122->18123 18124 7ff788789f10 _invalid_parameter_noinfo 37 API calls 18123->18124 18124->18121 18133 7ff78878f808 EnterCriticalSection 18125->18133 19090 7ff788790870 19101 7ff7887967e4 19090->19101 19102 7ff7887967f1 19101->19102 19103 7ff788789f78 __free_lconv_num 11 API calls 19102->19103 19105 7ff78879680d 19102->19105 19103->19102 19104 7ff788789f78 __free_lconv_num 11 API calls 19104->19105 19105->19104 19106 7ff788790879 19105->19106 19107 7ff78878f808 EnterCriticalSection 19106->19107 18546 7ff78878a600 18547 7ff78878a61a 18546->18547 18548 7ff78878a605 18546->18548 18552 7ff78878a620 18548->18552 18553 7ff78878a662 18552->18553 18554 7ff78878a66a 18552->18554 18556 7ff788789f78 __free_lconv_num 11 API calls 18553->18556 18555 7ff788789f78 __free_lconv_num 11 API calls 18554->18555 18557 7ff78878a677 18555->18557 18556->18554 18558 7ff788789f78 __free_lconv_num 11 API calls 18557->18558 18559 7ff78878a684 18558->18559 18560 7ff788789f78 __free_lconv_num 11 API calls 18559->18560 18561 7ff78878a691 18560->18561 18562 7ff788789f78 __free_lconv_num 11 API calls 18561->18562 18563 7ff78878a69e 18562->18563 18564 7ff788789f78 __free_lconv_num 11 API calls 18563->18564 18565 7ff78878a6ab 18564->18565 18566 7ff788789f78 __free_lconv_num 11 API calls 18565->18566 18567 7ff78878a6b8 18566->18567 18568 7ff788789f78 __free_lconv_num 11 API calls 18567->18568 18569 7ff78878a6c5 18568->18569 18570 7ff788789f78 __free_lconv_num 11 API calls 18569->18570 18571 7ff78878a6d5 18570->18571 18572 7ff788789f78 __free_lconv_num 11 API calls 18571->18572 18573 7ff78878a6e5 18572->18573 18578 7ff78878a4c4 18573->18578 18592 7ff78878f808 EnterCriticalSection 18578->18592 17969 7ff788786878 17970 7ff7887868a6 17969->17970 17971 7ff7887868df 17969->17971 17972 7ff788786088 _set_fmode 11 API calls 17970->17972 17971->17970 17973 7ff7887868e4 FindFirstFileExW 17971->17973 17974 7ff7887868ab 17972->17974 17975 7ff78878694d 17973->17975 17976 7ff788786906 GetLastError 17973->17976 17977 7ff788789f10 _invalid_parameter_noinfo 37 API calls 17974->17977 18029 7ff788786ae8 17975->18029 17979 7ff78878693d 17976->17979 17980 7ff788786911 17976->17980 17981 7ff7887868b6 17977->17981 17982 7ff788786088 _set_fmode 11 API calls 17979->17982 17980->17979 17985 7ff78878692d 17980->17985 17986 7ff78878691b 17980->17986 17988 7ff78877a100 _wfindfirst32i64 8 API calls 17981->17988 17982->17981 17984 7ff788786ae8 _wfindfirst32i64 10 API calls 17989 7ff788786973 17984->17989 17987 7ff788786088 _set_fmode 11 API calls 17985->17987 17986->17979 17990 7ff788786920 17986->17990 17987->17981 17991 7ff7887868ca 17988->17991 17992 7ff788786ae8 _wfindfirst32i64 10 API calls 17989->17992 17993 7ff788786088 _set_fmode 11 API calls 17990->17993 17994 7ff788786981 17992->17994 17993->17981 17995 7ff78878f9a4 _wfindfirst32i64 37 API calls 17994->17995 17996 7ff78878699f 17995->17996 17996->17981 17997 7ff7887869ab 17996->17997 17998 7ff788789f30 _wfindfirst32i64 17 API calls 17997->17998 17999 7ff7887869bf 17998->17999 18000 7ff7887869e9 17999->18000 18003 7ff788786a28 FindNextFileW 17999->18003 18001 7ff788786088 _set_fmode 11 API calls 18000->18001 18002 7ff7887869ee 18001->18002 18004 7ff788789f10 _invalid_parameter_noinfo 37 API calls 18002->18004 18005 7ff788786a78 18003->18005 18006 7ff788786a37 GetLastError 18003->18006 18015 7ff7887869f9 18004->18015 18007 7ff788786ae8 _wfindfirst32i64 10 API calls 18005->18007 18008 7ff788786a6b 18006->18008 18009 7ff788786a42 18006->18009 18011 7ff788786a90 18007->18011 18010 7ff788786088 _set_fmode 11 API calls 18008->18010 18009->18008 18012 7ff788786a5e 18009->18012 18013 7ff788786a4c 18009->18013 18010->18015 18016 7ff788786ae8 _wfindfirst32i64 10 API calls 18011->18016 18018 7ff788786088 _set_fmode 11 API calls 18012->18018 18013->18008 18017 7ff788786a51 18013->18017 18014 7ff78877a100 _wfindfirst32i64 8 API calls 18019 7ff788786a0c 18014->18019 18015->18014 18020 7ff788786a9e 18016->18020 18022 7ff788786088 _set_fmode 11 API calls 18017->18022 18018->18015 18021 7ff788786ae8 _wfindfirst32i64 10 API calls 18020->18021 18023 7ff788786aac 18021->18023 18022->18015 18024 7ff78878f9a4 _wfindfirst32i64 37 API calls 18023->18024 18025 7ff788786aca 18024->18025 18025->18015 18026 7ff788786ad2 18025->18026 18027 7ff788789f30 _wfindfirst32i64 17 API calls 18026->18027 18028 7ff788786ae6 18027->18028 18030 7ff788786b06 FileTimeToSystemTime 18029->18030 18031 7ff788786b00 18029->18031 18032 7ff788786b15 SystemTimeToTzSpecificLocalTime 18030->18032 18033 7ff788786b2b 18030->18033 18031->18030 18031->18033 18032->18033 18034 7ff78877a100 _wfindfirst32i64 8 API calls 18033->18034 18035 7ff788786965 18034->18035 18035->17984 19116 7ff788799577 19117 7ff788799587 19116->19117 19120 7ff788784398 LeaveCriticalSection 19117->19120 18695 7ff7887996fd 18698 7ff788784398 LeaveCriticalSection 18695->18698 19154 7ff788799792 19155 7ff7887997a1 19154->19155 19156 7ff7887997ab 19154->19156 19158 7ff78878f868 LeaveCriticalSection 19155->19158

                                                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                                                  Function 00007FF788794EA0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 135 7ff788794ea0-7ff788794edb call 7ff788794828 call 7ff788794830 call 7ff788794898 142 7ff788794ee1-7ff788794eec call 7ff788794838 135->142 143 7ff788795105-7ff788795151 call 7ff788789f30 call 7ff788794828 call 7ff788794830 call 7ff788794898 135->143 142->143 149 7ff788794ef2-7ff788794efc 142->149 169 7ff78879528f-7ff7887952fd call 7ff788789f30 call 7ff788790738 143->169 170 7ff788795157-7ff788795162 call 7ff788794838 143->170 151 7ff788794f1e-7ff788794f22 149->151 152 7ff788794efe-7ff788794f01 149->152 153 7ff788794f25-7ff788794f2d 151->153 155 7ff788794f04-7ff788794f0f 152->155 153->153 156 7ff788794f2f-7ff788794f42 call 7ff78878cc2c 153->156 158 7ff788794f11-7ff788794f18 155->158 159 7ff788794f1a-7ff788794f1c 155->159 165 7ff788794f44-7ff788794f46 call 7ff788789f78 156->165 166 7ff788794f5a-7ff788794f66 call 7ff788789f78 156->166 158->155 158->159 159->151 162 7ff788794f4b-7ff788794f59 159->162 165->162 177 7ff788794f6d-7ff788794f75 166->177 189 7ff7887952ff-7ff788795306 169->189 190 7ff78879530b-7ff78879530e 169->190 170->169 178 7ff788795168-7ff788795173 call 7ff788794868 170->178 177->177 180 7ff788794f77-7ff788794f88 call 7ff78878f9a4 177->180 178->169 188 7ff788795179-7ff78879519c call 7ff788789f78 GetTimeZoneInformation 178->188 180->143 187 7ff788794f8e-7ff788794fe4 call 7ff78877b880 * 4 call 7ff788794dbc 180->187 248 7ff788794fe6-7ff788794fea 187->248 206 7ff7887951a2-7ff7887951c3 188->206 207 7ff788795264-7ff78879528e call 7ff788794820 call 7ff788794810 call 7ff788794818 188->207 191 7ff78879539b-7ff78879539e 189->191 194 7ff788795310 190->194 195 7ff788795345-7ff788795358 call 7ff78878cc2c 190->195 197 7ff788795313 191->197 198 7ff7887953a4-7ff7887953ac call 7ff788794ea0 191->198 194->197 214 7ff788795363-7ff78879537e call 7ff788790738 195->214 215 7ff78879535a 195->215 201 7ff788795318-7ff788795344 call 7ff788789f78 call 7ff78877a100 197->201 202 7ff788795313 call 7ff78879511c 197->202 198->201 202->201 208 7ff7887951c5-7ff7887951cb 206->208 209 7ff7887951ce-7ff7887951d5 206->209 208->209 216 7ff7887951d7-7ff7887951df 209->216 217 7ff7887951e9 209->217 230 7ff788795380-7ff788795383 214->230 231 7ff788795385-7ff788795397 call 7ff788789f78 214->231 221 7ff78879535c-7ff788795361 call 7ff788789f78 215->221 216->217 223 7ff7887951e1-7ff7887951e7 216->223 227 7ff7887951eb-7ff78879525f call 7ff78877b880 * 4 call 7ff788791cfc call 7ff7887953b4 * 2 217->227 221->194 223->227 227->207 230->221 231->191 250 7ff788794ff0-7ff788794ff4 248->250 251 7ff788794fec 248->251 250->248 252 7ff788794ff6-7ff78879501b call 7ff788797ce4 250->252 251->250 258 7ff78879501e-7ff788795022 252->258 260 7ff788795031-7ff788795035 258->260 261 7ff788795024-7ff78879502f 258->261 260->258 261->260 264 7ff788795037-7ff78879503b 261->264 266 7ff7887950bc-7ff7887950c0 264->266 267 7ff78879503d-7ff788795065 call 7ff788797ce4 264->267 268 7ff7887950c2-7ff7887950c4 266->268 269 7ff7887950c7-7ff7887950d4 266->269 275 7ff788795083-7ff788795087 267->275 276 7ff788795067 267->276 268->269 271 7ff7887950ef-7ff7887950fe call 7ff788794820 call 7ff788794810 269->271 272 7ff7887950d6-7ff7887950ec call 7ff788794dbc 269->272 271->143 272->271 275->266 281 7ff788795089-7ff7887950a7 call 7ff788797ce4 275->281 279 7ff78879506a-7ff788795071 276->279 279->275 282 7ff788795073-7ff788795081 279->282 287 7ff7887950b3-7ff7887950ba 281->287 282->275 282->279 287->266 288 7ff7887950a9-7ff7887950ad 287->288 288->266 289 7ff7887950af 288->289 289->287
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF788794EE5
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788794838: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78879484C
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788789F78: RtlFreeHeap.NTDLL(?,?,?,00007FF788791EC2,?,?,?,00007FF788791EFF,?,?,00000000,00007FF7887923C5,?,?,00000000,00007FF7887922F7), ref: 00007FF788789F8E
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788789F78: GetLastError.KERNEL32(?,?,?,00007FF788791EC2,?,?,?,00007FF788791EFF,?,?,00000000,00007FF7887923C5,?,?,00000000,00007FF7887922F7), ref: 00007FF788789F98
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788789F30: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF788789F0F,?,?,?,?,?,00007FF788781A40), ref: 00007FF788789F39
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788789F30: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF788789F0F,?,?,?,?,?,00007FF788781A40), ref: 00007FF788789F5E
                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF788794ED4
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788794898: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7887948AC
                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF78879514A
                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF78879515B
                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF78879516C
                                                                                                                                                                                                                                  • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7887953AC), ref: 00007FF788795193
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                                  • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                  • API String ID: 4070488512-239921721
                                                                                                                                                                                                                                  • Opcode ID: aa85b069b6fb92bd10a5b6d5be9144cf64bbc0ff06c8fbb0fdd7caf4b6a87e0b
                                                                                                                                                                                                                                  • Instruction ID: 06864b94738b1f235a632702068a5f04d127175c8542b00ffb86ee308194361a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: aa85b069b6fb92bd10a5b6d5be9144cf64bbc0ff06c8fbb0fdd7caf4b6a87e0b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 27D1C122A9829286E724BFB5D8905B9E771FF4C784FE44136EA0D47686DF3CE441C368
                                                                                                                                                                                                                                  Function 00007FF7887758E0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 139COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetTempPathW.KERNEL32(?,00000000,?,00007FF7887758AD), ref: 00007FF78877597A
                                                                                                                                                                                                                                  • GetCurrentProcessId.KERNEL32(?,00007FF7887758AD), ref: 00007FF788775980
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788775AF0: GetEnvironmentVariableW.KERNEL32(00007FF788772817,?,?,?,?,?,?), ref: 00007FF788775B2A
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788775AF0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF788775B47
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788786818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF788786831
                                                                                                                                                                                                                                  • SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF788775A31
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Environment$Variable$CurrentExpandPathProcessStringsTemp_invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                                                                                                                                                                                  • API String ID: 1556224225-1116378104
                                                                                                                                                                                                                                  • Opcode ID: c5f54b7bf307984578858df7ed726c29ecf57d9a1ab1fdaee90f5f6cb8ec536b
                                                                                                                                                                                                                                  • Instruction ID: 4a444f0c98d4d48383542149edb824feb81c59e29dd1cda1aa9ee3f85523f489
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c5f54b7bf307984578858df7ed726c29ecf57d9a1ab1fdaee90f5f6cb8ec536b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5A517E10F9D68340FE54B7A2A9552BAD2A17F9DBC0FE54031EC0E4BB96ED6CE501C328
                                                                                                                                                                                                                                  Function 00007FF788795DEC Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 390 7ff788795dec-7ff788795e5f call 7ff788795b20 393 7ff788795e61-7ff788795e6a call 7ff788786068 390->393 394 7ff788795e79-7ff788795e83 call 7ff788786e60 390->394 399 7ff788795e6d-7ff788795e74 call 7ff788786088 393->399 400 7ff788795e85-7ff788795e9c call 7ff788786068 call 7ff788786088 394->400 401 7ff788795e9e-7ff788795f07 CreateFileW 394->401 413 7ff7887961ba-7ff7887961da 399->413 400->399 404 7ff788795f84-7ff788795f8f GetFileType 401->404 405 7ff788795f09-7ff788795f0f 401->405 407 7ff788795f91-7ff788795fcc GetLastError call 7ff788785ffc CloseHandle 404->407 408 7ff788795fe2-7ff788795fe9 404->408 410 7ff788795f51-7ff788795f7f GetLastError call 7ff788785ffc 405->410 411 7ff788795f11-7ff788795f15 405->411 407->399 424 7ff788795fd2-7ff788795fdd call 7ff788786088 407->424 416 7ff788795ff1-7ff788795ff4 408->416 417 7ff788795feb-7ff788795fef 408->417 410->399 411->410 418 7ff788795f17-7ff788795f4f CreateFileW 411->418 422 7ff788795ffa-7ff78879604f call 7ff788786d78 416->422 423 7ff788795ff6 416->423 417->422 418->404 418->410 428 7ff788796051-7ff78879605d call 7ff788795d28 422->428 429 7ff78879606e-7ff78879609f call 7ff7887958a0 422->429 423->422 424->399 428->429 435 7ff78879605f 428->435 436 7ff7887960a1-7ff7887960a3 429->436 437 7ff7887960a5-7ff7887960e7 429->437 438 7ff788796061-7ff788796069 call 7ff78878a0f0 435->438 436->438 439 7ff788796109-7ff788796114 437->439 440 7ff7887960e9-7ff7887960ed 437->440 438->413 443 7ff7887961b8 439->443 444 7ff78879611a-7ff78879611e 439->444 440->439 442 7ff7887960ef-7ff788796104 440->442 442->439 443->413 444->443 445 7ff788796124-7ff788796169 CloseHandle CreateFileW 444->445 447 7ff78879616b-7ff788796199 GetLastError call 7ff788785ffc call 7ff788786fa0 445->447 448 7ff78879619e-7ff7887961b3 445->448 447->448 448->443
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1617910340-0
                                                                                                                                                                                                                                  • Opcode ID: 52a4378cdb78c32285671ba8c66096e739a338fe2dbd84037285ee5c330aca07
                                                                                                                                                                                                                                  • Instruction ID: 0a02657588f10ec07e75d1fe71a8dd0d2c3d11126ca9e83330320f104238c341
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 52a4378cdb78c32285671ba8c66096e739a338fe2dbd84037285ee5c330aca07
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0DC1C232B68A4285EB10DFB8C8915ACB771FB48B98FA10325DA2E5B795DF3CE055C314
                                                                                                                                                                                                                                  Function 00007FF78879511C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 795 7ff78879511c-7ff788795151 call 7ff788794828 call 7ff788794830 call 7ff788794898 802 7ff78879528f-7ff7887952fd call 7ff788789f30 call 7ff788790738 795->802 803 7ff788795157-7ff788795162 call 7ff788794838 795->803 815 7ff7887952ff-7ff788795306 802->815 816 7ff78879530b-7ff78879530e 802->816 803->802 808 7ff788795168-7ff788795173 call 7ff788794868 803->808 808->802 814 7ff788795179-7ff78879519c call 7ff788789f78 GetTimeZoneInformation 808->814 829 7ff7887951a2-7ff7887951c3 814->829 830 7ff788795264-7ff78879528e call 7ff788794820 call 7ff788794810 call 7ff788794818 814->830 817 7ff78879539b-7ff78879539e 815->817 819 7ff788795310 816->819 820 7ff788795345-7ff788795358 call 7ff78878cc2c 816->820 821 7ff788795313 817->821 822 7ff7887953a4-7ff7887953ac call 7ff788794ea0 817->822 819->821 836 7ff788795363-7ff78879537e call 7ff788790738 820->836 837 7ff78879535a 820->837 825 7ff788795318-7ff788795344 call 7ff788789f78 call 7ff78877a100 821->825 826 7ff788795313 call 7ff78879511c 821->826 822->825 826->825 831 7ff7887951c5-7ff7887951cb 829->831 832 7ff7887951ce-7ff7887951d5 829->832 831->832 838 7ff7887951d7-7ff7887951df 832->838 839 7ff7887951e9 832->839 850 7ff788795380-7ff788795383 836->850 851 7ff788795385-7ff788795397 call 7ff788789f78 836->851 842 7ff78879535c-7ff788795361 call 7ff788789f78 837->842 838->839 844 7ff7887951e1-7ff7887951e7 838->844 847 7ff7887951eb-7ff78879525f call 7ff78877b880 * 4 call 7ff788791cfc call 7ff7887953b4 * 2 839->847 842->819 844->847 847->830 850->842 851->817
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF78879514A
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788794898: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7887948AC
                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF78879515B
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788794838: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78879484C
                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF78879516C
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788794868: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78879487C
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788789F78: RtlFreeHeap.NTDLL(?,?,?,00007FF788791EC2,?,?,?,00007FF788791EFF,?,?,00000000,00007FF7887923C5,?,?,00000000,00007FF7887922F7), ref: 00007FF788789F8E
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788789F78: GetLastError.KERNEL32(?,?,?,00007FF788791EC2,?,?,?,00007FF788791EFF,?,?,00000000,00007FF7887923C5,?,?,00000000,00007FF7887922F7), ref: 00007FF788789F98
                                                                                                                                                                                                                                  • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7887953AC), ref: 00007FF788795193
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                                  • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                  • API String ID: 3458911817-239921721
                                                                                                                                                                                                                                  • Opcode ID: 745ef94ea7204a2bfbd30c29007a49fe20bc82f24fe0203fc347e73c8b1ad169
                                                                                                                                                                                                                                  • Instruction ID: ce6f3861426675179223b125059aecda14246e08625bd5edf74d603a14e756fa
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 745ef94ea7204a2bfbd30c29007a49fe20bc82f24fe0203fc347e73c8b1ad169
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C0518B32A9868286E710FFB1E8805A9E771BB5C784FA04136EA4D43796DF3CE440C768
                                                                                                                                                                                                                                  Function 00007FF7887769E0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2295610775-0
                                                                                                                                                                                                                                  • Opcode ID: 0b7e5a9930ef76a70c4e782aa580d8521c3892be20b9910ca6b4e20049941746
                                                                                                                                                                                                                                  • Instruction ID: de72908166326834bffdca93d8ac1ea6c82f6b8b905099260828ee1d3eeed29f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0b7e5a9930ef76a70c4e782aa580d8521c3892be20b9910ca6b4e20049941746
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E0F0F432A5968286F760AFA4E494767F370BB88324F944335D66D026D4DF3CE008CA14
                                                                                                                                                                                                                                  Function 00007FF7887717B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _fread_nolock$_invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                                                                                                                                                                                                                  • API String ID: 3405171723-4158440160
                                                                                                                                                                                                                                  • Opcode ID: 3aa32319f753003def624376a898b4782dad60ffaa994bf44efa6d587232dc82
                                                                                                                                                                                                                                  • Instruction ID: eb7087569641941b5b3e19d6ed2dc5c073145162d75ce73e6e58eb6693eae9cc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3aa32319f753003def624376a898b4782dad60ffaa994bf44efa6d587232dc82
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 15517C72A4960286EB54FFA4D490278F3B0FB5CB58BA18135DA0D87399DF3CE441CB68
                                                                                                                                                                                                                                  Function 00007FF788771440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 53 7ff788771440-7ff788771457 call 7ff788775880 56 7ff788771459-7ff788771461 53->56 57 7ff788771462-7ff788771485 call 7ff788775ba0 53->57 60 7ff7887714a7-7ff7887714ad 57->60 61 7ff788771487-7ff7887714a2 call 7ff788771c10 57->61 63 7ff7887714af-7ff7887714ba call 7ff788772de0 60->63 64 7ff7887714e0-7ff7887714f4 call 7ff78877ec94 60->64 68 7ff788771635-7ff788771647 61->68 69 7ff7887714bf-7ff7887714c5 63->69 71 7ff788771516-7ff78877151a 64->71 72 7ff7887714f6-7ff788771511 call 7ff788771c10 64->72 69->64 73 7ff7887714c7-7ff7887714db call 7ff788771c50 69->73 75 7ff78877151c-7ff788771528 call 7ff788771050 71->75 76 7ff788771534-7ff788771554 call 7ff78878414c 71->76 82 7ff788771617-7ff78877161d 72->82 73->82 83 7ff78877152d-7ff78877152f 75->83 87 7ff788771575-7ff78877157b 76->87 88 7ff788771556-7ff788771570 call 7ff788771c10 76->88 85 7ff78877162b-7ff78877162e call 7ff78877e60c 82->85 86 7ff78877161f call 7ff78877e60c 82->86 83->82 95 7ff788771633 85->95 94 7ff788771624 86->94 92 7ff788771605-7ff788771608 call 7ff788784138 87->92 93 7ff788771581-7ff788771586 87->93 100 7ff78877160d-7ff788771612 88->100 92->100 98 7ff788771590-7ff7887715b2 call 7ff78877e95c 93->98 94->85 95->68 102 7ff7887715e5-7ff7887715ec 98->102 103 7ff7887715b4-7ff7887715cc call 7ff78877f09c 98->103 100->82 105 7ff7887715f3-7ff7887715fb call 7ff788771c10 102->105 108 7ff7887715ce-7ff7887715d1 103->108 109 7ff7887715d5-7ff7887715e3 103->109 112 7ff788771600 105->112 108->98 111 7ff7887715d3 108->111 109->105 111->112 112->92
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                                  • API String ID: 0-666925554
                                                                                                                                                                                                                                  • Opcode ID: acef7e076dfcd68a00e07062fece66cdd4ccfa26df71920dfac5e2982e43698f
                                                                                                                                                                                                                                  • Instruction ID: 1855476c67a55dd3937e9d22cd5a8be8b49de755e683e19bfd8f7f3a96632b78
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: acef7e076dfcd68a00e07062fece66cdd4ccfa26df71920dfac5e2982e43698f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6751A761B8864281EA10FBA1A9406B9E3B0BF4ABD4FE44431DE1D87795EF3CE545C338
                                                                                                                                                                                                                                  Function 00007FF788776A60 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
                                                                                                                                                                                                                                  • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                                                                                                  • API String ID: 4998090-2855260032
                                                                                                                                                                                                                                  • Opcode ID: c79bcb34d9950482b5642b7e8b58aabf54e811d274faf88abeec3ee0803c085a
                                                                                                                                                                                                                                  • Instruction ID: ee80df555ee3b25f34cffd7df380571d715919db5325a7bc084b8b6ff0cc9a40
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c79bcb34d9950482b5642b7e8b58aabf54e811d274faf88abeec3ee0803c085a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E941A63165C64282E710BFA5E8456AAF371FB89794FE00231EA5E476D8DF3CE408C714
                                                                                                                                                                                                                                  Function 00007FF788776130 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90processsynchronizationCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                                                                                                                                                                                  • String ID: CreateProcessW$Error creating child process!
                                                                                                                                                                                                                                  • API String ID: 2895956056-3524285272
                                                                                                                                                                                                                                  • Opcode ID: d5693698e4819ce5d510509d5cda6c943b390b1bcdb6e918232fd1435297541c
                                                                                                                                                                                                                                  • Instruction ID: f599b94f4519b6d03e401a2790c35ba37adc728b3685c66de57a10705988ca84
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d5693698e4819ce5d510509d5cda6c943b390b1bcdb6e918232fd1435297541c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C9411531A4878281DA20ABA4F9552AAF374FF99360FA00335E6AD47BD5DF7CD044CB54
                                                                                                                                                                                                                                  Function 00007FF788771000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 274COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 453 7ff788771000-7ff7887727b6 call 7ff78877e3e0 call 7ff78877e3d8 call 7ff7887767c0 call 7ff78877a130 call 7ff788784310 call 7ff788784f7c call 7ff788771af0 469 7ff7887727bc-7ff7887727cb call 7ff788772cd0 453->469 470 7ff7887728ca 453->470 469->470 475 7ff7887727d1-7ff7887727e4 call 7ff788772ba0 469->475 472 7ff7887728cf-7ff7887728ef call 7ff78877a100 470->472 475->470 479 7ff7887727ea-7ff7887727fd call 7ff788772c50 475->479 479->470 482 7ff788772803-7ff78877282a call 7ff788775af0 479->482 485 7ff78877286c-7ff788772894 call 7ff7887760f0 call 7ff7887719d0 482->485 486 7ff78877282c-7ff78877283b call 7ff788775af0 482->486 497 7ff78877297d-7ff78877298e 485->497 498 7ff78877289a-7ff7887728b0 call 7ff7887719d0 485->498 486->485 491 7ff78877283d-7ff788772843 486->491 493 7ff788772845-7ff78877284d 491->493 494 7ff78877284f-7ff788772869 call 7ff788784138 call 7ff7887760f0 491->494 493->494 494->485 500 7ff7887729a3-7ff7887729bb call 7ff788776db0 497->500 501 7ff788772990-7ff78877299a call 7ff7887724a0 497->501 507 7ff7887728b2-7ff7887728c5 call 7ff788771c50 498->507 508 7ff7887728f0-7ff7887728f3 498->508 516 7ff7887729bd-7ff7887729c9 call 7ff788771c50 500->516 517 7ff7887729ce-7ff7887729d5 SetDllDirectoryW 500->517 514 7ff7887729db-7ff7887729e8 call 7ff788774fa0 501->514 515 7ff78877299c 501->515 507->470 508->497 513 7ff7887728f9-7ff788772910 call 7ff788772de0 508->513 526 7ff788772917-7ff788772943 call 7ff788776360 513->526 527 7ff788772912-7ff788772915 513->527 524 7ff7887729ea-7ff7887729fa call 7ff788774c40 514->524 525 7ff788772a36-7ff788772a3b call 7ff788774f20 514->525 515->500 516->470 517->514 524->525 539 7ff7887729fc-7ff788772a0b call 7ff7887747a0 524->539 533 7ff788772a40-7ff788772a43 525->533 540 7ff78877296d-7ff78877297b 526->540 541 7ff788772945-7ff78877294d call 7ff78877e60c 526->541 530 7ff788772952-7ff788772968 call 7ff788771c50 527->530 530->470 537 7ff788772a49-7ff788772a56 533->537 538 7ff788772af6-7ff788772b05 call 7ff788772330 533->538 542 7ff788772a60-7ff788772a6a 537->542 538->470 555 7ff788772b0b-7ff788772b42 call 7ff788776080 call 7ff788775af0 call 7ff788774540 538->555 553 7ff788772a0d-7ff788772a19 call 7ff788774730 539->553 554 7ff788772a2c-7ff788772a31 call 7ff7887749f0 539->554 540->501 541->530 547 7ff788772a6c-7ff788772a71 542->547 548 7ff788772a73-7ff788772a75 542->548 547->542 547->548 551 7ff788772a77-7ff788772a9a call 7ff788771b30 548->551 552 7ff788772ac1-7ff788772af1 call 7ff788772490 call 7ff7887722d0 call 7ff788772480 call 7ff7887749f0 call 7ff788774f20 548->552 551->470 566 7ff788772aa0-7ff788772aab 551->566 552->472 553->554 567 7ff788772a1b-7ff788772a2a call 7ff788774df0 553->567 554->525 555->470 578 7ff788772b48-7ff788772b7d call 7ff788772490 call 7ff788776130 call 7ff7887749f0 call 7ff788774f20 555->578 571 7ff788772ab0-7ff788772abf 566->571 567->533 571->552 571->571 591 7ff788772b87-7ff788772b91 call 7ff788771ab0 578->591 592 7ff788772b7f-7ff788772b82 call 7ff788775df0 578->592 591->472 592->591
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788772CD0: GetModuleFileNameW.KERNEL32(?,00007FF7887727C9,?,?,?,?,?,?), ref: 00007FF788772D01
                                                                                                                                                                                                                                  • SetDllDirectoryW.KERNEL32 ref: 00007FF7887729D5
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788775AF0: GetEnvironmentVariableW.KERNEL32(00007FF788772817,?,?,?,?,?,?), ref: 00007FF788775B2A
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788775AF0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF788775B47
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
                                                                                                                                                                                                                                  • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                                                                                                                                                                                  • API String ID: 2344891160-3602715111
                                                                                                                                                                                                                                  • Opcode ID: d83bcef48ebb6a1968cbdadae4618be5d98dc17e925993e344ccd9eb13a7412d
                                                                                                                                                                                                                                  • Instruction ID: 3fbe6bd7377509fe40c208ccf1ed25806e4ac57aeab84a11bb45177a587d28da
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d83bcef48ebb6a1968cbdadae4618be5d98dc17e925993e344ccd9eb13a7412d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C9C19621AAC68341FA24BBA195502FDD3B1FF5C784FE44031EA5E4769AEF2CE505C728
                                                                                                                                                                                                                                  Function 00007FF788771050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 596 7ff788771050-7ff7887710ab call 7ff788779990 599 7ff7887710ad-7ff7887710d2 call 7ff788771c50 596->599 600 7ff7887710d3-7ff7887710eb call 7ff78878414c 596->600 605 7ff7887710ed-7ff788771104 call 7ff788771c10 600->605 606 7ff788771109-7ff788771119 call 7ff78878414c 600->606 611 7ff78877126c-7ff788771281 call 7ff788779670 call 7ff788784138 * 2 605->611 612 7ff78877111b-7ff788771132 call 7ff788771c10 606->612 613 7ff788771137-7ff788771147 606->613 628 7ff788771286-7ff7887712a0 611->628 612->611 615 7ff788771150-7ff788771175 call 7ff78877e95c 613->615 622 7ff78877125e 615->622 623 7ff78877117b-7ff788771185 call 7ff78877e6d0 615->623 626 7ff788771264 622->626 623->622 630 7ff78877118b-7ff788771197 623->630 626->611 631 7ff7887711a0-7ff7887711c8 call 7ff788777de0 630->631 634 7ff7887711ca-7ff7887711cd 631->634 635 7ff788771241-7ff78877125c call 7ff788771c50 631->635 636 7ff78877123c 634->636 637 7ff7887711cf-7ff7887711d9 634->637 635->626 636->635 639 7ff7887711db-7ff7887711e8 call 7ff78877f09c 637->639 640 7ff788771203-7ff788771206 637->640 646 7ff7887711ed-7ff7887711f0 639->646 643 7ff788771219-7ff78877121e 640->643 644 7ff788771208-7ff788771216 call 7ff78877aec0 640->644 643->631 645 7ff788771220-7ff788771223 643->645 644->643 648 7ff788771237-7ff78877123a 645->648 649 7ff788771225-7ff788771228 645->649 650 7ff7887711fe-7ff788771201 646->650 651 7ff7887711f2-7ff7887711fc call 7ff78877e6d0 646->651 648->626 649->635 653 7ff78877122a-7ff788771232 649->653 650->635 651->643 651->650 653->615
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                                  • API String ID: 0-1655038675
                                                                                                                                                                                                                                  • Opcode ID: 4fb0c1d5e84974c8ab8d407b7d1509341cb32bb3acb76aca408933e30b33f1ca
                                                                                                                                                                                                                                  • Instruction ID: 72f63e3cbf160c4b51c14696116fa26c1c6972fe8ef93c15f182e0a28c65607e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4fb0c1d5e84974c8ab8d407b7d1509341cb32bb3acb76aca408933e30b33f1ca
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2351C422B8964281EA60FB91D8403B9E2B1FB89794FE44131DD4DC7795EF3CE545C728
                                                                                                                                                                                                                                  Function 00007FF78878DF30 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(?,00000000,?,00007FF78878E2CA,?,?,-00000018,00007FF78878A383,?,?,?,00007FF78878A27A,?,?,?,00007FF7887854E2), ref: 00007FF78878E0AC
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00000000,?,00007FF78878E2CA,?,?,-00000018,00007FF78878A383,?,?,?,00007FF78878A27A,?,?,?,00007FF7887854E2), ref: 00007FF78878E0B8
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                                  • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                  • API String ID: 3013587201-537541572
                                                                                                                                                                                                                                  • Opcode ID: 5d4014bca18f9f9ee9ee76f308e7221266f6712ab36b1d3e30b229e2872ef72f
                                                                                                                                                                                                                                  • Instruction ID: def85f34f1569cf54f57e9704a062d9b221cb8462026d10972336e748f34f483
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5d4014bca18f9f9ee9ee76f308e7221266f6712ab36b1d3e30b229e2872ef72f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2A410622B5A60241FA11AB969900575E3B1BF0CB90FB84535DD2D87784EF3DE445C32C
                                                                                                                                                                                                                                  Function 00007FF78878B08C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 682 7ff78878b08c-7ff78878b0b2 683 7ff78878b0b4-7ff78878b0c8 call 7ff788786068 call 7ff788786088 682->683 684 7ff78878b0cd-7ff78878b0d1 682->684 698 7ff78878b4be 683->698 685 7ff78878b4a7-7ff78878b4b3 call 7ff788786068 call 7ff788786088 684->685 686 7ff78878b0d7-7ff78878b0de 684->686 705 7ff78878b4b9 call 7ff788789f10 685->705 686->685 688 7ff78878b0e4-7ff78878b112 686->688 688->685 691 7ff78878b118-7ff78878b11f 688->691 694 7ff78878b121-7ff78878b133 call 7ff788786068 call 7ff788786088 691->694 695 7ff78878b138-7ff78878b13b 691->695 694->705 701 7ff78878b141-7ff78878b147 695->701 702 7ff78878b4a3-7ff78878b4a5 695->702 703 7ff78878b4c1-7ff78878b4d8 698->703 701->702 706 7ff78878b14d-7ff78878b150 701->706 702->703 705->698 706->694 709 7ff78878b152-7ff78878b177 706->709 711 7ff78878b179-7ff78878b17b 709->711 712 7ff78878b1aa-7ff78878b1b1 709->712 715 7ff78878b1a2-7ff78878b1a8 711->715 716 7ff78878b17d-7ff78878b184 711->716 713 7ff78878b1b3-7ff78878b1db call 7ff78878cc2c call 7ff788789f78 * 2 712->713 714 7ff78878b186-7ff78878b19d call 7ff788786068 call 7ff788786088 call 7ff788789f10 712->714 747 7ff78878b1f8-7ff78878b223 call 7ff78878b8b4 713->747 748 7ff78878b1dd-7ff78878b1f3 call 7ff788786088 call 7ff788786068 713->748 744 7ff78878b330 714->744 718 7ff78878b228-7ff78878b23f 715->718 716->714 716->715 721 7ff78878b241-7ff78878b249 718->721 722 7ff78878b2ba-7ff78878b2c4 call 7ff788792abc 718->722 721->722 726 7ff78878b24b-7ff78878b24d 721->726 733 7ff78878b2ca-7ff78878b2df 722->733 734 7ff78878b34e 722->734 726->722 730 7ff78878b24f-7ff78878b265 726->730 730->722 735 7ff78878b267-7ff78878b273 730->735 733->734 739 7ff78878b2e1-7ff78878b2f3 GetConsoleMode 733->739 737 7ff78878b353-7ff78878b373 ReadFile 734->737 735->722 740 7ff78878b275-7ff78878b277 735->740 742 7ff78878b379-7ff78878b381 737->742 743 7ff78878b46d-7ff78878b476 GetLastError 737->743 739->734 745 7ff78878b2f5-7ff78878b2fd 739->745 740->722 746 7ff78878b279-7ff78878b291 740->746 742->743 750 7ff78878b387 742->750 753 7ff78878b493-7ff78878b496 743->753 754 7ff78878b478-7ff78878b48e call 7ff788786088 call 7ff788786068 743->754 755 7ff78878b333-7ff78878b33d call 7ff788789f78 744->755 745->737 752 7ff78878b2ff-7ff78878b321 ReadConsoleW 745->752 746->722 756 7ff78878b293-7ff78878b29f 746->756 747->718 748->744 760 7ff78878b38e-7ff78878b3a3 750->760 762 7ff78878b342-7ff78878b34c 752->762 763 7ff78878b323 GetLastError 752->763 757 7ff78878b329-7ff78878b32b call 7ff788785ffc 753->757 758 7ff78878b49c-7ff78878b49e 753->758 754->744 755->703 756->722 766 7ff78878b2a1-7ff78878b2a3 756->766 757->744 758->755 760->755 769 7ff78878b3a5-7ff78878b3b0 760->769 762->760 763->757 766->722 767 7ff78878b2a5-7ff78878b2b5 766->767 767->722 774 7ff78878b3b2-7ff78878b3cb call 7ff78878aca4 769->774 775 7ff78878b3d7-7ff78878b3df 769->775 782 7ff78878b3d0-7ff78878b3d2 774->782 778 7ff78878b3e1-7ff78878b3f3 775->778 779 7ff78878b45b-7ff78878b468 call 7ff78878aae4 775->779 783 7ff78878b3f5 778->783 784 7ff78878b44e-7ff78878b456 778->784 779->782 782->755 786 7ff78878b3fa-7ff78878b401 783->786 784->755 787 7ff78878b403-7ff78878b407 786->787 788 7ff78878b43d-7ff78878b448 786->788 789 7ff78878b423 787->789 790 7ff78878b409-7ff78878b410 787->790 788->784 791 7ff78878b429-7ff78878b439 789->791 790->789 792 7ff78878b412-7ff78878b416 790->792 791->786 794 7ff78878b43b 791->794 792->789 793 7ff78878b418-7ff78878b421 792->793 793->791 794->784
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                  • Opcode ID: 5e2fa04a27a554ad5a06cbbe01d601b05b68f3aeb2922c25288f770f6f319bba
                                                                                                                                                                                                                                  • Instruction ID: 26727775064b3454a86e1a6692d31858b7b64182a9cf4bfc5a2243ec0df0a342
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5e2fa04a27a554ad5a06cbbe01d601b05b68f3aeb2922c25288f770f6f319bba
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 46C1E422A8C68A91E720AB9194412BDF771FB89B80FE54135DB5D07791CE7CE849C32C
                                                                                                                                                                                                                                  Function 00007FF78878C590 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 872 7ff78878c590-7ff78878c5b5 873 7ff78878c883 872->873 874 7ff78878c5bb-7ff78878c5be 872->874 875 7ff78878c885-7ff78878c895 873->875 876 7ff78878c5c0-7ff78878c5f2 call 7ff788789e44 874->876 877 7ff78878c5f7-7ff78878c623 874->877 876->875 879 7ff78878c625-7ff78878c62c 877->879 880 7ff78878c62e-7ff78878c634 877->880 879->876 879->880 881 7ff78878c644-7ff78878c659 call 7ff788792abc 880->881 882 7ff78878c636-7ff78878c63f call 7ff78878b950 880->882 887 7ff78878c65f-7ff78878c668 881->887 888 7ff78878c773-7ff78878c77c 881->888 882->881 887->888 891 7ff78878c66e-7ff78878c672 887->891 889 7ff78878c7d0-7ff78878c7f5 WriteFile 888->889 890 7ff78878c77e-7ff78878c784 888->890 892 7ff78878c800 889->892 893 7ff78878c7f7-7ff78878c7fd GetLastError 889->893 894 7ff78878c786-7ff78878c789 890->894 895 7ff78878c7bc-7ff78878c7ce call 7ff78878c048 890->895 896 7ff78878c683-7ff78878c68e 891->896 897 7ff78878c674-7ff78878c67c call 7ff788783830 891->897 898 7ff78878c803 892->898 893->892 899 7ff78878c7a8-7ff78878c7ba call 7ff78878c268 894->899 900 7ff78878c78b-7ff78878c78e 894->900 920 7ff78878c760-7ff78878c767 895->920 902 7ff78878c69f-7ff78878c6b4 GetConsoleMode 896->902 903 7ff78878c690-7ff78878c699 896->903 897->896 905 7ff78878c808 898->905 899->920 906 7ff78878c814-7ff78878c81e 900->906 907 7ff78878c794-7ff78878c7a6 call 7ff78878c14c 900->907 910 7ff78878c6ba-7ff78878c6c0 902->910 911 7ff78878c76c 902->911 903->888 903->902 913 7ff78878c80d 905->913 914 7ff78878c820-7ff78878c825 906->914 915 7ff78878c87c-7ff78878c881 906->915 907->920 918 7ff78878c6c6-7ff78878c6c9 910->918 919 7ff78878c749-7ff78878c75b call 7ff78878bbd0 910->919 911->888 913->906 921 7ff78878c853-7ff78878c85d 914->921 922 7ff78878c827-7ff78878c82a 914->922 915->875 924 7ff78878c6d4-7ff78878c6e2 918->924 925 7ff78878c6cb-7ff78878c6ce 918->925 919->920 920->905 931 7ff78878c85f-7ff78878c862 921->931 932 7ff78878c864-7ff78878c873 921->932 929 7ff78878c843-7ff78878c84e call 7ff788786044 922->929 930 7ff78878c82c-7ff78878c83b 922->930 927 7ff78878c740-7ff78878c744 924->927 928 7ff78878c6e4 924->928 925->913 925->924 927->898 933 7ff78878c6e8-7ff78878c6ff call 7ff788792b88 928->933 929->921 930->929 931->873 931->932 932->915 938 7ff78878c701-7ff78878c70d 933->938 939 7ff78878c737-7ff78878c73d GetLastError 933->939 940 7ff78878c70f-7ff78878c721 call 7ff788792b88 938->940 941 7ff78878c72c-7ff78878c733 938->941 939->927 940->939 945 7ff78878c723-7ff78878c72a 940->945 941->927 943 7ff78878c735 941->943 943->933 945->941
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF78878C57B), ref: 00007FF78878C6AC
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF78878C57B), ref: 00007FF78878C737
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 953036326-0
                                                                                                                                                                                                                                  • Opcode ID: 1ee269c4fb3492fdab786e16ea0be33da994e1b3a3006f3c14cd8905a42bf150
                                                                                                                                                                                                                                  • Instruction ID: b7c63c867f519763324ee69e5fb5e301f308c2d8ef9c5d930bb629a3fe96844c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1ee269c4fb3492fdab786e16ea0be33da994e1b3a3006f3c14cd8905a42bf150
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B891A632F5865285F790AFA5948027DEBB0BB98B88FA44139DE0E57A84DF3CD441C72C
                                                                                                                                                                                                                                  Function 00007FF78878E95C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4170891091-0
                                                                                                                                                                                                                                  • Opcode ID: 993f4cb53d01987759aa9ab87d439edc94425a62c6450610c4994d1423bcdf7f
                                                                                                                                                                                                                                  • Instruction ID: b54488ba40f4a0db6ba43926e2abd0ed5ce2c76352051eb2e46cec664e08b529
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 993f4cb53d01987759aa9ab87d439edc94425a62c6450610c4994d1423bcdf7f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B151F673F442118AEB14EFA49D85ABCEB71BB0835CFA40135DD1E56AE5DB38A442C718
                                                                                                                                                                                                                                  Function 00007FF78878483C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2780335769-0
                                                                                                                                                                                                                                  • Opcode ID: 81de7022a69b47ce39b5392d1784fece2718e2d2aab2765227a8e407644b98c7
                                                                                                                                                                                                                                  • Instruction ID: f928715efbf7e48fbf7cc5a126852401b7f05119d5e913e2e6cf2fcbc0ca36e9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 81de7022a69b47ce39b5392d1784fece2718e2d2aab2765227a8e407644b98c7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9B518D22A886418AFB20EFB094513BDE3B1BB58B58FA08035DE4967789DF78D441C368
                                                                                                                                                                                                                                  Function 00007FF7887846E8 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1279662727-0
                                                                                                                                                                                                                                  • Opcode ID: 58b178a13046118a9aa3eab3ad0445e857bf873c1952e3e12f7b4cc56e3b75ff
                                                                                                                                                                                                                                  • Instruction ID: f8fb023072568e62fb031e8cf524a16fa3327dc9f5c740ee1d531b3221e4c5e8
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 58b178a13046118a9aa3eab3ad0445e857bf873c1952e3e12f7b4cc56e3b75ff
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2841B622D9878183E750ABA09510379F770FB99764F649334E69C03BD5EFACA5A0C728
                                                                                                                                                                                                                                  Function 00007FF78877A51C Relevance: 4.6, APIs: 3, Instructions: 102COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3058843127-0
                                                                                                                                                                                                                                  • Opcode ID: 0a8c62a57e2cf59f1561fe537eeb51f2220189f8d74725526a3d26dbeb988a7e
                                                                                                                                                                                                                                  • Instruction ID: 9e0de20663d8b4324d398863b5fc90575a000ea3b82c281c8ba5a319650bc2c0
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0a8c62a57e2cf59f1561fe537eeb51f2220189f8d74725526a3d26dbeb988a7e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E1313C21E8924242FA54BBE0D6513B9E3B1BF8E784FE44435EA0D472D7DE2CA445C379
                                                                                                                                                                                                                                  Function 00007FF7887889E8 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1703294689-0
                                                                                                                                                                                                                                  • Opcode ID: fc68bfbf785dc4e8d02d30f22ac316467e06faf73d836825e3014864920bd8dd
                                                                                                                                                                                                                                  • Instruction ID: 925d2a3eadc9e996c686945ac83f632618590ea34410132571c66880520bba06
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fc68bfbf785dc4e8d02d30f22ac316467e06faf73d836825e3014864920bd8dd
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 64D06714B8964286FA643BB05D95179D2717F8C711BA41438CC5B06393DD3DA44DD26D
                                                                                                                                                                                                                                  Function 00007FF78877E6FC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                  • Opcode ID: a3600ff4682811ddeb36fb761298261c2e9791cf1ca8f4758584451e9995ac85
                                                                                                                                                                                                                                  • Instruction ID: dfc1145205c0d3efeafa65c0b869f4eea2ea31214b54c46dc0fc40625f13a773
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a3600ff4682811ddeb36fb761298261c2e9791cf1ca8f4758584451e9995ac85
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1151E623B4924146F768BAE5940067AE2A1BF49FA4FA84634DE7C077C5CE3CE401C769
                                                                                                                                                                                                                                  Function 00007FF78878BA48 Relevance: 3.1, APIs: 2, Instructions: 71COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FileHandleType
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3000768030-0
                                                                                                                                                                                                                                  • Opcode ID: 51d66a3ea3a1e5720d3031fa8d01ef1f6d3b4a26eee4bfd04239a76c9c1293a5
                                                                                                                                                                                                                                  • Instruction ID: 158d691e6c616d5f9248dc9c28a949691d4b33f1558042d21019253e4d6b090d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 51d66a3ea3a1e5720d3031fa8d01ef1f6d3b4a26eee4bfd04239a76c9c1293a5
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D831D622A58B4A81D7209B548590178EA70FB4DBB4FB81339DB6E073E4CF38E491D31D
                                                                                                                                                                                                                                  Function 00007FF78878B764 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF78878B750,00000000,?,?,?,00007FF788771023,00007FF78878B859), ref: 00007FF78878B7B0
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,00007FF78878B750,00000000,?,?,?,00007FF788771023,00007FF78878B859), ref: 00007FF78878B7BA
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2976181284-0
                                                                                                                                                                                                                                  • Opcode ID: 7196098b30ecd42809471233c9619b7315c9fb41ce716e28bdee8d0b35162eb6
                                                                                                                                                                                                                                  • Instruction ID: a9f8659f0e787c087dc2e20c81c8ceeadc5d9c5092f520e59c2cb0c1d06f9ce4
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7196098b30ecd42809471233c9619b7315c9fb41ce716e28bdee8d0b35162eb6
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A111C161618B8281DA10AB76A904169E371BB88BF4FA84332EE7D4B7D9CE3CD054C708
                                                                                                                                                                                                                                  Function 00007FF7887849E4 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7887848F9), ref: 00007FF788784A17
                                                                                                                                                                                                                                  • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7887848F9), ref: 00007FF788784A2D
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1707611234-0
                                                                                                                                                                                                                                  • Opcode ID: 5359c6eadbc125880de5eb3a516e79e0ad43a75e61374d6be107f92d83a7530b
                                                                                                                                                                                                                                  • Instruction ID: 6ed29d5f192712568142e5ad2e7a1abd621d8f948be6302eafdeabe3b60ceada
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5359c6eadbc125880de5eb3a516e79e0ad43a75e61374d6be107f92d83a7530b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7811E33268C64281EB20AB50A40103BF7B0FB887A0FB00235F6AD85AD8EF6CD054DB1C
                                                                                                                                                                                                                                  Function 00007FF788786AE8 Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF788786965), ref: 00007FF788786B0B
                                                                                                                                                                                                                                  • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF788786965), ref: 00007FF788786B21
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1707611234-0
                                                                                                                                                                                                                                  • Opcode ID: 4979fb33e8de5b56483d857dcf3248564858e1df126649fde4a887e8262e5eb8
                                                                                                                                                                                                                                  • Instruction ID: c5f9ed1ad139bb660843bb13adab425f0de70c2457ae791fb2cf863f4af5a88f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4979fb33e8de5b56483d857dcf3248564858e1df126649fde4a887e8262e5eb8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AE01A13254C65186E750AB54E40523AFBB0FB89729FB00235F6B9019D4DF3DE050DB28
                                                                                                                                                                                                                                  Function 00007FF788789F78 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL(?,?,?,00007FF788791EC2,?,?,?,00007FF788791EFF,?,?,00000000,00007FF7887923C5,?,?,00000000,00007FF7887922F7), ref: 00007FF788789F8E
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF788791EC2,?,?,?,00007FF788791EFF,?,?,00000000,00007FF7887923C5,?,?,00000000,00007FF7887922F7), ref: 00007FF788789F98
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 485612231-0
                                                                                                                                                                                                                                  • Opcode ID: 38b70030576bf13f94cd83556ee530387765cecd0e7570bb2763cadcf4087263
                                                                                                                                                                                                                                  • Instruction ID: 8181e60e0374375873ffe33025ade153b242f0b9af9f3c12eaa6a1530f8fab34
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 38b70030576bf13f94cd83556ee530387765cecd0e7570bb2763cadcf4087263
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1FE0BF50E8E54242FE187BF25945578D1717F9C740BA45034D91D56251EE2CA889C67C
                                                                                                                                                                                                                                  Function 00007FF7887870D4 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DeleteErrorFileLast
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2018770650-0
                                                                                                                                                                                                                                  • Opcode ID: d9df61864aacf0c38aa57b7a7eccc268b2766f97fd3960567bd6780660c5006e
                                                                                                                                                                                                                                  • Instruction ID: 6efbc4b083ec1f10ea86a289355e470bde61487932f9e02a0ca65721cedfc646
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d9df61864aacf0c38aa57b7a7eccc268b2766f97fd3960567bd6780660c5006e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 33D0C910E9D50381E61437F51D86479D5B03F4D760FF00674D43A802D0EE1CA0C9812D
                                                                                                                                                                                                                                  Function 00007FF788786850 Relevance: 3.0, APIs: 2, Instructions: 12COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DirectoryErrorLastRemove
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 377330604-0
                                                                                                                                                                                                                                  • Opcode ID: f10b0acbf04ce372ff2bba8e22346aa2cd94a9581c077f1b6ddec38c1268e9e8
                                                                                                                                                                                                                                  • Instruction ID: ad4d3fc6629063558ce31723a6b14e01834540bfaa0450a0ceaa252dc9185177
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f10b0acbf04ce372ff2bba8e22346aa2cd94a9581c077f1b6ddec38c1268e9e8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EDD0CA10E9E50382EA1837F61D8A478D4B03F8C720FF00634C43E812E0FE2CA4C9822D
                                                                                                                                                                                                                                  Function 00007FF78878A188 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • CloseHandle.KERNELBASE(?,?,?,00007FF78878A005,?,?,00000000,00007FF78878A0BA), ref: 00007FF78878A1F6
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF78878A005,?,?,00000000,00007FF78878A0BA), ref: 00007FF78878A200
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 918212764-0
                                                                                                                                                                                                                                  • Opcode ID: 6fe57093fbbb00cdf8389479e1e18e52ea82cce6ea34632ee61e1d7ac301845a
                                                                                                                                                                                                                                  • Instruction ID: cda6a7429926099457180346f8c0caeba85ce1ff2c8733b2bea62d1816014225
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6fe57093fbbb00cdf8389479e1e18e52ea82cce6ea34632ee61e1d7ac301845a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C421C210F5864241FA6077E19A94279E2B1BF8C7A4FA44234DE2E473C5DE6CA444C32E
                                                                                                                                                                                                                                  Function 00007FF788775DF0 Relevance: 1.6, APIs: 1, Instructions: 141COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ByteCharMultiWide_findclose
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2772937645-0
                                                                                                                                                                                                                                  • Opcode ID: 181f2765e85eb4e7ebd6c50f12fb6341e80b998725aa5779b2beb13a577095ea
                                                                                                                                                                                                                                  • Instruction ID: 36ab663c414ea506646df2e57bd3301ea96eb8d786dce83a1de1184e3ce99bc9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 181f2765e85eb4e7ebd6c50f12fb6341e80b998725aa5779b2beb13a577095ea
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4771A152E18AC581E611EB2CC5052FDB370F7A9B4CFA4E325DB9C12596EF28E2D9C304
                                                                                                                                                                                                                                  Function 00007FF78878B4DC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                  • Opcode ID: 3cb10c43647639a768565940e1ce5c449de1869fbc1a92892aa118bde093882e
                                                                                                                                                                                                                                  • Instruction ID: 117d0353dbd16151432f47124aaf57a6f8959f1fea7a12b5e585d3a817b58e69
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3cb10c43647639a768565940e1ce5c449de1869fbc1a92892aa118bde093882e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A141B032A4824587EA24EB99E550279F3B0FB5AB40FB41131D78E836D5DF2CE402C76D
                                                                                                                                                                                                                                  Function 00007FF788776360 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _fread_nolock
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 840049012-0
                                                                                                                                                                                                                                  • Opcode ID: 55dd1c4a42a8cd9ba37efdbaa529a5d7591506b4685dbca8f65d782d7b6cfa4d
                                                                                                                                                                                                                                  • Instruction ID: 4328651a35dcf3decaf87fe8556f29969863b88e3b72b76e7a3cb7446935a1bc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 55dd1c4a42a8cd9ba37efdbaa529a5d7591506b4685dbca8f65d782d7b6cfa4d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B4216221B8869245EA14BB9269043BAE661BF49FD8FD84430EE0D0778ADF7CF145C618
                                                                                                                                                                                                                                  Function 00007FF78878AF6C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                  • Opcode ID: ff4bd6b019ced27284b6fa2760217448de45b7808968d4935831090a049e7df0
                                                                                                                                                                                                                                  • Instruction ID: 5d71915011892b49899071b47912a346a48028abe41f322ca66005d63fac2759
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ff4bd6b019ced27284b6fa2760217448de45b7808968d4935831090a049e7df0
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B7319E62A5860286E711BB95884437CE670BB88BA4FE10135EA3D073D2DE7CF846D73D
                                                                                                                                                                                                                                  Function 00007FF788788919 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3947729631-0
                                                                                                                                                                                                                                  • Opcode ID: 7474e071a48ef7130f5acd4d7b35ddfbaeb0d66e7037ac086cf5d56d8c80b409
                                                                                                                                                                                                                                  • Instruction ID: 5a9f789c34a5fc9546f0c24aee733b121b64a2f75f7e1dad1a8328d64e94a360
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7474e071a48ef7130f5acd4d7b35ddfbaeb0d66e7037ac086cf5d56d8c80b409
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3E21AE72A44702CAFB24AFA4C4402FCB3B0FB18318FA81636D65D06AC5DF38D484C7A9
                                                                                                                                                                                                                                  Function 00007FF788785538 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                  • Opcode ID: 25f020cec256df429067bb606d051891f0f83e0bb8faa834007163ccabd97c9c
                                                                                                                                                                                                                                  • Instruction ID: 533fb270f6bbf8043efffe64a09a28e0a2d45165a0f1e528c06f491b29a3a0d9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 25f020cec256df429067bb606d051891f0f83e0bb8faa834007163ccabd97c9c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 77118121A5C68181EB61BF91940067DE2B0BF89B80FE44431EA8C57A86CF7DE841D76C
                                                                                                                                                                                                                                  Function 00007FF7887957DC Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                  • Opcode ID: e860bb9bc84c29a06dccfc010b7eb52daf61d2c250f48aeb7393b4a8ace16f10
                                                                                                                                                                                                                                  • Instruction ID: ed22d38186ef2b1748799f127303453be0194e266f77866bef4aac82fe7c0f66
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e860bb9bc84c29a06dccfc010b7eb52daf61d2c250f48aeb7393b4a8ace16f10
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9F219532A18A8187DB61AF68D880779F6B0FB88B54FA44234EA6D476D5DF3CD401CB14
                                                                                                                                                                                                                                  Function 00007FF78877E97C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                  • Opcode ID: 298f7b2a666c55937c0a4044f00fb88544ba948c427ceaa5fd6043e577695ec0
                                                                                                                                                                                                                                  • Instruction ID: ecebca251f9b4d81c0372b97f25670e93856484d79739193c72677e71f8d6b8d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 298f7b2a666c55937c0a4044f00fb88544ba948c427ceaa5fd6043e577695ec0
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C701C422A8875141EA44FBD29900179F6B5BF9AFE0FA84631DE6C17BD6CE3CE411C718
                                                                                                                                                                                                                                  Function 00007FF788776490 Relevance: 1.3, APIs: 1, Instructions: 92COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DirectoryErrorLastRemove
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 377330604-0
                                                                                                                                                                                                                                  • Opcode ID: 084d7b594bcd28fb49fbeb931c26155fa6ca1cda91761dc2622677426efca5d5
                                                                                                                                                                                                                                  • Instruction ID: 88826c696f7d974e373e6ff63da0d29c6dc7c8b57e764560562a36ddf8ec9826
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 084d7b594bcd28fb49fbeb931c26155fa6ca1cda91761dc2622677426efca5d5
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EB418416D587C181EA51FB6495412BCE370FBA8744FA4A332DB8D4219BEF28F2D8C324
                                                                                                                                                                                                                                  Function 00007FF78878DEB8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • HeapAlloc.KERNEL32(?,?,00000000,00007FF78878AA16,?,?,?,00007FF788789BD3,?,?,00000000,00007FF788789E6E), ref: 00007FF78878DF0D
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AllocHeap
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4292702814-0
                                                                                                                                                                                                                                  • Opcode ID: 69550027ed8e3bf035e7bef6798a6f7658c1153be72ca181ca789a5114add420
                                                                                                                                                                                                                                  • Instruction ID: fc645b730fe34994f66bba238299955edb4ee4519e712605822a38250d1f6484
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 69550027ed8e3bf035e7bef6798a6f7658c1153be72ca181ca789a5114add420
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 61F04940B8A20341FE597BE259502B4D6B17F9CB40FEC4430C91E87AD2EE2CE482D23C
                                                                                                                                                                                                                                  Function 00007FF78878CC2C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • HeapAlloc.KERNEL32(?,?,?,00007FF78877F1E4,?,?,?,00007FF7887806F6,?,?,?,?,?,00007FF78878275D), ref: 00007FF78878CC6A
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AllocHeap
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4292702814-0
                                                                                                                                                                                                                                  • Opcode ID: b827a7ab023d1767f95784f6f7fefaf86c66ee15463514ccfd07e797832e7771
                                                                                                                                                                                                                                  • Instruction ID: a75b05323a084f7774ed1fef1a3ecc0b89d4364ff10573a73ba577075b87c034
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b827a7ab023d1767f95784f6f7fefaf86c66ee15463514ccfd07e797832e7771
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5BF05E10B9A24640FEA976F15941675D1A1BFCD7A0FA80234D93E852D1DD2CA480D23C

                                                                                                                                                                                                                                  Non-executed Functions

                                                                                                                                                                                                                                  Function 00007FF788772F20 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF7887722DE,?,?,?,?), ref: 00007FF788772F36
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF7887722DE,?,?,?,?), ref: 00007FF788772F75
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF7887722DE,?,?,?,?), ref: 00007FF788772F9A
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF7887722DE,?,?,?,?), ref: 00007FF788772FBF
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF7887722DE,?,?,?,?), ref: 00007FF788772FE7
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF7887722DE,?,?,?,?), ref: 00007FF78877300F
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF7887722DE,?,?,?,?), ref: 00007FF788773037
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF7887722DE,?,?,?,?), ref: 00007FF78877305F
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF7887722DE,?,?,?,?), ref: 00007FF788773087
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressProc
                                                                                                                                                                                                                                  • String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
                                                                                                                                                                                                                                  • API String ID: 190572456-3109299426
                                                                                                                                                                                                                                  • Opcode ID: 3d8788b48c699204fb620db4b6681a167f3e5177f9efbc96361098fa63709e71
                                                                                                                                                                                                                                  • Instruction ID: 913835995822e15adc95e55c424f9de91654b743c29c1e3c0a81f3e6e31da0bb
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3d8788b48c699204fb620db4b6681a167f3e5177f9efbc96361098fa63709e71
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 18429264A8EB0391EA15FBA9AD50174E2B1BF0C790BF45175C81E063A8FF7CE548D328
                                                                                                                                                                                                                                  Function 00007FF78879324C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                                                                                                                  • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                                                  • API String ID: 808467561-2761157908
                                                                                                                                                                                                                                  • Opcode ID: 94a7ddbc9dfde8fb095d9bbce1265888f255539b2e0e0fd568165e141f3b5970
                                                                                                                                                                                                                                  • Instruction ID: ca2bcbfd6393730e3ec29e3eec3c828516d594f39a8341542d7c560fc139e1a0
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 94a7ddbc9dfde8fb095d9bbce1265888f255539b2e0e0fd568165e141f3b5970
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 80B2D472A582828BE764DEB4D8407FDF7B1FB58388FA06135DA1D57A84DB3CA900CB54
                                                                                                                                                                                                                                  Function 00007FF788776670 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(WideCharToMultiByte,00007FF788771CE4,?,?,00000000,00007FF788776904), ref: 00007FF788776697
                                                                                                                                                                                                                                  • FormatMessageW.KERNEL32 ref: 00007FF7887766C6
                                                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32 ref: 00007FF78877671C
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788771CB0: GetLastError.KERNEL32(?,?,00000000,00007FF788776904,?,?,?,?,?,?,?,?,?,?,?,00007FF788771023), ref: 00007FF788771CD7
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorLast$ByteCharFormatMessageMultiWide
                                                                                                                                                                                                                                  • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                                                                                                                                  • API String ID: 2383786077-2573406579
                                                                                                                                                                                                                                  • Opcode ID: ee4750cad08e904e569e44cd6da303e01fcfffc44399732fd87d74f29f2688a4
                                                                                                                                                                                                                                  • Instruction ID: 5a3c580bd022a9cb0aa229dc47822488d61b71263ee1cb79edd71fa83302ddba
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ee4750cad08e904e569e44cd6da303e01fcfffc44399732fd87d74f29f2688a4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8121A471A48A4281FB60BBA4EC54376E775FB8D384FE40034D54D826A8EF3CE104C728
                                                                                                                                                                                                                                  Function 00007FF78877AA2C Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3140674995-0
                                                                                                                                                                                                                                  • Opcode ID: 414c3b7d1a52ef3ba5408d69683659119c26abb58edcf35ad0cee906abb0d3fb
                                                                                                                                                                                                                                  • Instruction ID: 24137f0c12913dfae8f2e654578cd7ce623fcbacafce13cbb3867e3601e403e8
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 414c3b7d1a52ef3ba5408d69683659119c26abb58edcf35ad0cee906abb0d3fb
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 01315072659A8186EB60AFA0E9403EDF371FB88744F94403ADA4D47A98EF3CD548C724
                                                                                                                                                                                                                                  Function 00007FF788789C44 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1239891234-0
                                                                                                                                                                                                                                  • Opcode ID: 5dfb057c3f1a11160ff10646ccc1b52b02cf652cbed9a545e94d4dbf2c44da7d
                                                                                                                                                                                                                                  • Instruction ID: e62e7179dd978e457198ef22bfb4e103cfa90b64f920cd892a8822e1a8c08712
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5dfb057c3f1a11160ff10646ccc1b52b02cf652cbed9a545e94d4dbf2c44da7d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AD315032658B8186E760EB65E8402AEF3B0FB88754FA00135EA9D43B95DF3CC555CB14
                                                                                                                                                                                                                                  Function 00007FF788790A34 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2227656907-0
                                                                                                                                                                                                                                  • Opcode ID: ced153bd746da3696451066ca553fc750e98195ae426049d21287c39b66479d4
                                                                                                                                                                                                                                  • Instruction ID: d1b8fb5d2b7e7486f4ecc551450bc512768da6211d1d00cfaa1358c09b7a25df
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ced153bd746da3696451066ca553fc750e98195ae426049d21287c39b66479d4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BAB1C822B6869241EA60ABB59C006B9E371FF49BE4FA44131ED5E07BC5DE3CE441C728
                                                                                                                                                                                                                                  Function 00007FF788792DB0 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memcpy_s
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1502251526-0
                                                                                                                                                                                                                                  • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                                  • Instruction ID: 068391a4f1d2259a87090af710bc62eb9079f646fe3a7339ae53fadfd6cb78cd
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 00C12772B5868687E724DFB9A44466AF7A1F788B84F909134DB5E43744DB3DE801CB04
                                                                                                                                                                                                                                  Function 00007FF788798BE8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ExceptionRaise_clrfp
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 15204871-0
                                                                                                                                                                                                                                  • Opcode ID: ce95b3d84f14f29cd4e01f3d624d654ffebb0793079cdf733c9da6505e2ad06c
                                                                                                                                                                                                                                  • Instruction ID: 4a98c513b0288ee62fe491f6754d7b3433f8e71a2b8c44375019c04de06d9129
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ce95b3d84f14f29cd4e01f3d624d654ffebb0793079cdf733c9da6505e2ad06c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 62B14B73604B898AEB25DF29C846368BBB0F748B48F688921DB5D83BA4CB3DD451C714
                                                                                                                                                                                                                                  Function 00007FF788782A18 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: $
                                                                                                                                                                                                                                  • API String ID: 0-227171996
                                                                                                                                                                                                                                  • Opcode ID: 12f3629fc0db3b94ce06ee7fe38b00bcc3d57b8cb20d1c91e47922b02d0d68b8
                                                                                                                                                                                                                                  • Instruction ID: 4ed0fc3398c80c5cfc50202f304af61494b4f9834bb3ac6c7369845eafdad803
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 12f3629fc0db3b94ce06ee7fe38b00bcc3d57b8cb20d1c91e47922b02d0d68b8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 32E1C53296964686EB68AE658150139F7B0FF4DB4BFB44135CE0E076A4DF39E841C72C
                                                                                                                                                                                                                                  Function 00007FF78878D1F8 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: e+000$gfff
                                                                                                                                                                                                                                  • API String ID: 0-3030954782
                                                                                                                                                                                                                                  • Opcode ID: 7f3e0c3824b7b5cf876389fd48d0d53d421d0873473af5a4edca9f3cc5d4c2f0
                                                                                                                                                                                                                                  • Instruction ID: c5646ef2243ddcf3d327e5e60b84efaa4a16dfef770b26941139cd9e318ca756
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7f3e0c3824b7b5cf876389fd48d0d53d421d0873473af5a4edca9f3cc5d4c2f0
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 26516922B186C186E7259EB5980176DFBA1F748B94F988231CB9C47ED6CF7DD440C718
                                                                                                                                                                                                                                  Function 00007FF78878FA88 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1010374628-0
                                                                                                                                                                                                                                  • Opcode ID: 5009b892dd91bf519e8c559ea5e1b5aef6c23d832387be5e86a00ec78a3f8015
                                                                                                                                                                                                                                  • Instruction ID: 9779948414b76436afe84e030d2e1c7c8f4c8e8b92715646cc2c5deeab625d8d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5009b892dd91bf519e8c559ea5e1b5aef6c23d832387be5e86a00ec78a3f8015
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6C02DF21A9D64281FA54BBA19850279E6B0BF5DB90FF48635ED6D463D2DE3CE801C33C
                                                                                                                                                                                                                                  Function 00007FF78878CD64 Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: gfffffff
                                                                                                                                                                                                                                  • API String ID: 0-1523873471
                                                                                                                                                                                                                                  • Opcode ID: 7cb6c3f32e91a926ccbf64ab8ba01f2a38c928c6639247976dccb01524fe6e1b
                                                                                                                                                                                                                                  • Instruction ID: ea08b25596d62509613ef161a862dfdcc4cf9db4bce4f8fc6dd7dd8a40c22020
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7cb6c3f32e91a926ccbf64ab8ba01f2a38c928c6639247976dccb01524fe6e1b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 94A15763B087CA46EB61DB65A0107A9FBA0FB98B84F648132DE4D47786DA3DD402C719
                                                                                                                                                                                                                                  Function 00007FF7887870FC Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID: TMP
                                                                                                                                                                                                                                  • API String ID: 3215553584-3125297090
                                                                                                                                                                                                                                  • Opcode ID: 19d64b0ab773cbfbd487bca6893bb747c2215c781c74349dcac5785039621920
                                                                                                                                                                                                                                  • Instruction ID: 643dae9a31514dbaa5f726cf69a6f2465f49e5c4ad8286e933a45593ee955c71
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 19d64b0ab773cbfbd487bca6893bb747c2215c781c74349dcac5785039621920
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9F51A111F8824241FA64BAA6591117AD2F1BF99BD4FE84034EE0F47BD5EE3CE442C22C
                                                                                                                                                                                                                                  Function 00007FF788792620 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: HeapProcess
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 54951025-0
                                                                                                                                                                                                                                  • Opcode ID: 5644672d7aec8b178d5bd48a95ace976e45fdc56d1edf0a539dccc581205543b
                                                                                                                                                                                                                                  • Instruction ID: 330d055a8d59f762f4538ced9a2d05a34d5af238a54cb8fe9dc98a95ddb52108
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5644672d7aec8b178d5bd48a95ace976e45fdc56d1edf0a539dccc581205543b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0BB09220E47B42C2EA083BA16D82614E2B57F5CB10FE80138C40C40320DF2C24EA9724
                                                                                                                                                                                                                                  Function 00007FF7887821DC Relevance: .4, Instructions: 351COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 7d7d821e27f440e8d5d3622ff09e7c05bc36f3fd6b9038f787498be69d76432a
                                                                                                                                                                                                                                  • Instruction ID: 65adff29fb20d681e902744b8cea6ec637a365805d7178ab6825881eec905c13
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7d7d821e27f440e8d5d3622ff09e7c05bc36f3fd6b9038f787498be69d76432a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4FE1E532AA860285E764AAA9C56437CE7B1FB4DB57FB44231CE1D066D5CF38D881C32C
                                                                                                                                                                                                                                  Function 00007FF788782614 Relevance: .3, Instructions: 327COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: c2f3b43ccd68eb767627d2655b116bae7479589a7f74a5058ab0c91b2e39ac12
                                                                                                                                                                                                                                  • Instruction ID: 3221935c26eda123cecfe5180c9ae73466395146c2f7cae9df7d9b6e22ae9cb3
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c2f3b43ccd68eb767627d2655b116bae7479589a7f74a5058ab0c91b2e39ac12
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 43D1E822A6864286EB68AAA5815023DE7B1FF1DB4BFB84135CE0D177D4CF39D841C72C
                                                                                                                                                                                                                                  Function 00007FF788777420 Relevance: .3, Instructions: 287COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: b723f182358e09e7314f6f73ac964ac7abcdc7414507ad18988289416ad7b41b
                                                                                                                                                                                                                                  • Instruction ID: e73503c58bd64e9e3785873fd62f1cd8c51661ae716f8c213b0c49bba0dda365
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b723f182358e09e7314f6f73ac964ac7abcdc7414507ad18988289416ad7b41b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 73C1F6722241E04BE688EB29F45987A73E2F788349FD9403AEB8747785CA3DE414D760
                                                                                                                                                                                                                                  Function 00007FF78878132C Relevance: .2, Instructions: 250COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 6c5c392cbfffe41992f0743bc4a0c2c3fe46246456b6811ff0c5dafdd99ec142
                                                                                                                                                                                                                                  • Instruction ID: 904616ceab1625df6bd53f74075562e2af80dc60f44e90a3a9d5ab9378ebb794
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6c5c392cbfffe41992f0743bc4a0c2c3fe46246456b6811ff0c5dafdd99ec142
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6AB1BE72A6864185E764AF69C05423DFBB0FB0AB48FA84135CA8E87399CF29D440C73D
                                                                                                                                                                                                                                  Function 00007FF7887816C4 Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 85060b88648c64536cd03416e20448513b0a4375a109c0566769b76d71526d0c
                                                                                                                                                                                                                                  • Instruction ID: f661f91484348d2749011adb4540045c71a79723247305159a95a055af03876f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 85060b88648c64536cd03416e20448513b0a4375a109c0566769b76d71526d0c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8EB19A72A68A8186E7649F69C09027CBBB4FB19B48FB80135CA4E83395CF39D441C73D
                                                                                                                                                                                                                                  Function 00007FF78878D878 Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 59ad0bfc87d4107bda453f5e7c9a116e1e97c6e992cf3a610b4e267b4cffcaca
                                                                                                                                                                                                                                  • Instruction ID: 79b74db0fac94bcd99baa512a0c878278bb61fddfcaf426988eca6ef48aee9e9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 59ad0bfc87d4107bda453f5e7c9a116e1e97c6e992cf3a610b4e267b4cffcaca
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E981E472A4C7818AEB74DB599480369EEB1FB49794FA44235DA9D43F8ACF3DD400CB18
                                                                                                                                                                                                                                  Function 00007FF7887958A0 Relevance: .2, Instructions: 183COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                  • Opcode ID: 2033a98ce9b9ae1b6fcbd26cbe8033cb2e42881aa268c02d842b0e820a1bc4f5
                                                                                                                                                                                                                                  • Instruction ID: b261988c3a37e360505c1f81a91d863065400cf181464996fbd444666e05edd1
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2033a98ce9b9ae1b6fcbd26cbe8033cb2e42881aa268c02d842b0e820a1bc4f5
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8B612C22E5C2E245F764A5B8888123DE9A1FF58730FF80235DA5E466C5DE6DE800D72C
                                                                                                                                                                                                                                  Function 00007FF788780354 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 4e0632a4a7e014686f42235b66fbebb9a54d6c0d44d943c89546efb0de6bc1d6
                                                                                                                                                                                                                                  • Instruction ID: 8a9b6e888ad963cad1e0d15b9743d8b66e6e8bf9693c537e75f258b1953bc30a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4e0632a4a7e014686f42235b66fbebb9a54d6c0d44d943c89546efb0de6bc1d6
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8151B132A98A5186E7249B69C04423CF3B0FB49B68F744135CE8C17BA5CB3AE853C75C
                                                                                                                                                                                                                                  Function 00007FF78877FF44 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 9a7d583fdacf7a8c68166448a21aae8e03012e85621840fd7aae1b2904462282
                                                                                                                                                                                                                                  • Instruction ID: 8bb73d67599d67adb31a197ebf8577467e960f77dfa642df481db52e53f9b110
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9a7d583fdacf7a8c68166448a21aae8e03012e85621840fd7aae1b2904462282
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C7519F36A58A5586E724AB69C040238F7B0FB49B68F744131CE9D17795CF3AE843C758
                                                                                                                                                                                                                                  Function 00007FF788780764 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: e009b45869f76b4bc0fd62373217406c0429eee7efa8b33e1f678da67ddd1256
                                                                                                                                                                                                                                  • Instruction ID: 78e8cf527ff4912ded65fe7bc42306c83773bdaab6bac06884770e86cb9fef0b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e009b45869f76b4bc0fd62373217406c0429eee7efa8b33e1f678da67ddd1256
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D6517136A5965186EB249B69C04423CF3B0FB58F68F784131CA4D57795CB3AE883CB9C
                                                                                                                                                                                                                                  Function 00007FF788780150 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: e8fed526c0ef6e22bd960d06d2221fad266d41c34a47db8c9ca14c01ed2528e2
                                                                                                                                                                                                                                  • Instruction ID: 9088e31efadf018b9b4da574a894eb31a54d6a83c4e6b56d2f206080446c2111
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e8fed526c0ef6e22bd960d06d2221fad266d41c34a47db8c9ca14c01ed2528e2
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DC51AE36A59A5186E7649B69C04023CE7B1FB4DB68FB44131CE4C177A8CF3AE892C758
                                                                                                                                                                                                                                  Function 00007FF78877FD40 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 1122cbedd3da6cae4974dcedcaf2c480ad91f4dcca857e3bd784bf5366bd6c74
                                                                                                                                                                                                                                  • Instruction ID: 07599334c165148e1ff97356a17d1ee31b710cb2e09e434ec2c495462d176761
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1122cbedd3da6cae4974dcedcaf2c480ad91f4dcca857e3bd784bf5366bd6c74
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9151BE32A58A5986E724AB69C150328E7B0FF4DB58FB44131CA4C177A5CB3AEC42C798
                                                                                                                                                                                                                                  Function 00007FF788780560 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: bbc3e59ea296ef31dc5cb467e3ef236485a99d13d7a42ba6bd49c72ea64a61b5
                                                                                                                                                                                                                                  • Instruction ID: d972bc06af846f6ee0e3deb8e85068249b3d3e946f190e119713466b5943dfca
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bbc3e59ea296ef31dc5cb467e3ef236485a99d13d7a42ba6bd49c72ea64a61b5
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A551B036B5865586E724DB68C044628E7B0FB8DB58FB84131CE4D177A4CF3AE843C768
                                                                                                                                                                                                                                  Function 00007FF788784FC0 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 7e13b74b0b529d91a8ac9ee6727b9f2d590474870fceb05c3e17ea5803dfc50d
                                                                                                                                                                                                                                  • Instruction ID: 318cd716306bd225632d88da4d2c5d17de3770957f1089666fc6c29fc1609ab7
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7e13b74b0b529d91a8ac9ee6727b9f2d590474870fceb05c3e17ea5803dfc50d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C1410A52CCD7CA44E9559BA805007B4EAA0FF26BE0DF862B4DCA9573C7DC0D6587C12C
                                                                                                                                                                                                                                  Function 00007FF788788D00 Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 485612231-0
                                                                                                                                                                                                                                  • Opcode ID: 71af8a295fdb51eaf04f4fd3d3cb7b5e4e2b88d375af3dc160b99af84fd8c420
                                                                                                                                                                                                                                  • Instruction ID: ec0fe99183e2c7629e74a35010bfb52e560b191961817bc62bb840fc03f89a9b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 71af8a295fdb51eaf04f4fd3d3cb7b5e4e2b88d375af3dc160b99af84fd8c420
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9B412962B14A5482FF14DF6AD9541AAF3A1B74CFD0B949032EE1D87B64EE3CD542C308
                                                                                                                                                                                                                                  Function 00007FF7887866C4 Relevance: .1, Instructions: 98COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: d783e1a3e72e92f8cc360288f3ef248e1cc566027f67d0610760681409bc4687
                                                                                                                                                                                                                                  • Instruction ID: d21ee0cec809cc6c9ada8173bc70f96154c8cf6245e5be846e251ff25c7543ef
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d783e1a3e72e92f8cc360288f3ef248e1cc566027f67d0610760681409bc4687
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2431A772B58B4241E714AF65684413DE6E5BF88BA0FA84238EA5D53BD5DF3CE402C71C
                                                                                                                                                                                                                                  Function 00007FF788798A30 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 0a7304cda62ef4e3fce1e8e531a8e9660a3231e70ec23179b9d25e44c0445acc
                                                                                                                                                                                                                                  • Instruction ID: 04c62b3ac6fd6a1018c150f43e81ccc8bb99762138c86ecc404775b99ba86eba
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0a7304cda62ef4e3fce1e8e531a8e9660a3231e70ec23179b9d25e44c0445acc
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F9F068717582568AEBA89FA9A802629BBE1F71C3C0F948039D68D83B05D63C9050CF18
                                                                                                                                                                                                                                  Function 00007FF78877ABD4 Relevance: .0, Instructions: 2COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 53f093bed3a5d0e4e42a94d80c7232e3ca8df1b9ab80f13d9c22a8443e6849f1
                                                                                                                                                                                                                                  • Instruction ID: c884b8aff12374d897954ab686706638d4951fbf99524eccb870efff4576d1ca
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 53f093bed3a5d0e4e42a94d80c7232e3ca8df1b9ab80f13d9c22a8443e6849f1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 76A00125989803D0E644AB90AA60020E231BB58304BA40131D54D410B0EE2CA840C268
                                                                                                                                                                                                                                  Function 00007FF788774730 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressProc$LibraryLoad
                                                                                                                                                                                                                                  • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                                  • API String ID: 2238633743-1453502826
                                                                                                                                                                                                                                  • Opcode ID: 387b05963c1573a630a89e02a7d3e5c8a0eed87054fdcdadb8995d5c72bb8a89
                                                                                                                                                                                                                                  • Instruction ID: 5faa5308fe38eeb74b5df8f6694ebcc9621f669aadd90b9aa33b9b38797f8b19
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 387b05963c1573a630a89e02a7d3e5c8a0eed87054fdcdadb8995d5c72bb8a89
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 36E1B160A8AB4391FE15FBA8AD50274E3B6BF5C790BF45035C81E06364EF6CE548D368
                                                                                                                                                                                                                                  Function 00007FF788776BF0 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 113COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32 ref: 00007FF788776C2C
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788771CB0: GetLastError.KERNEL32(?,?,00000000,00007FF788776904,?,?,?,?,?,?,?,?,?,?,?,00007FF788771023), ref: 00007FF788771CD7
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ByteCharErrorLastMultiWide
                                                                                                                                                                                                                                  • String ID: Failed to decode wchar_t from UTF-8$Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$WideCharToMultiByte$win32_utils_from_utf8$win32_wcs_to_mbs
                                                                                                                                                                                                                                  • API String ID: 203985260-1562484376
                                                                                                                                                                                                                                  • Opcode ID: 3862dad7a734e1b5327f1da3e4475b8c5beb01cc5423311b44373fd47d1e8b31
                                                                                                                                                                                                                                  • Instruction ID: 3e9ec167223b084d9fbdef6e345a8913fed002b5f5cc04939055fd96b46d528e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3862dad7a734e1b5327f1da3e4475b8c5beb01cc5423311b44373fd47d1e8b31
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F1415421A8CA4342EA20BBA5AC40179E6B1BF9CBD0FE44135D94D477A9EF3CE505C728
                                                                                                                                                                                                                                  Function 00007FF78877F5C8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID: f$f$p$p$f
                                                                                                                                                                                                                                  • API String ID: 3215553584-1325933183
                                                                                                                                                                                                                                  • Opcode ID: 5b8d5396a44c552a0cc4e48ad8092be8cf806d396b8c8f6251230df5f0eb9214
                                                                                                                                                                                                                                  • Instruction ID: 8f2851315a8d050e86bf585d362265128d8e5f721060da5d17948e364bb2335d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5b8d5396a44c552a0cc4e48ad8092be8cf806d396b8c8f6251230df5f0eb9214
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5D12B422E4C24B85FB207AA4D2547BAF2B1FF58754FE44032D699466D4DF3CE480DB29
                                                                                                                                                                                                                                  Function 00007FF7887712B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                  • API String ID: 0-3659356012
                                                                                                                                                                                                                                  • Opcode ID: 10f526c2ff5c455780097855da84ddc8bd92fc37151a2808746bad80a4acf650
                                                                                                                                                                                                                                  • Instruction ID: 924fa46cd3ce181b95145d76cc7868bdc15a371cb41df9c70e6dee3ef83b7f9d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 10f526c2ff5c455780097855da84ddc8bd92fc37151a2808746bad80a4acf650
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BF418F22B8964281EA14FB91E8416B9E3B0FB487D4FE44432DE4D87B55EF3CE542C328
                                                                                                                                                                                                                                  Function 00007FF78877CF90 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                                  • String ID: csm$csm$csm
                                                                                                                                                                                                                                  • API String ID: 849930591-393685449
                                                                                                                                                                                                                                  • Opcode ID: c9717f7599358984fa081211ebe6d8e8a7f2fe77f13a54a703b9fcdffbee59eb
                                                                                                                                                                                                                                  • Instruction ID: c28d6b4b293eb74c2f05b7dc09d09e14019d3df69625319a5514488678528c99
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c9717f7599358984fa081211ebe6d8e8a7f2fe77f13a54a703b9fcdffbee59eb
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BCE18032A4874186EB20BBA5D4402ADFBB0FB8C788F600135EE4D57B5ACF38E491C754
                                                                                                                                                                                                                                  Function 00007FF7887767C0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 103COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF788771023), ref: 00007FF78877685F
                                                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF788771023), ref: 00007FF7887768AF
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ByteCharMultiWide
                                                                                                                                                                                                                                  • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                                                  • API String ID: 626452242-27947307
                                                                                                                                                                                                                                  • Opcode ID: 02e5b0b248b44fa656670cb4dcae359b0766aafddf42063cad3b4e8aee1a8378
                                                                                                                                                                                                                                  • Instruction ID: 24810c703084adfed3a6f65ec866fe3a002c6ad13f0d294aab2f5ce7c0a7301a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 02e5b0b248b44fa656670cb4dcae359b0766aafddf42063cad3b4e8aee1a8378
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CA419532A4CB8286E660FF95B840169F7B5FB98790FA44135DA8D43B98EF3CE055C718
                                                                                                                                                                                                                                  Function 00007FF788776EC0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00007FF788772D35,?,?,?,?,?,?), ref: 00007FF788776F01
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788771CB0: GetLastError.KERNEL32(?,?,00000000,00007FF788776904,?,?,?,?,?,?,?,?,?,?,?,00007FF788771023), ref: 00007FF788771CD7
                                                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00007FF788772D35,?,?,?,?,?,?), ref: 00007FF788776F75
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                                                                                                                                  • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                                                  • API String ID: 1717984340-27947307
                                                                                                                                                                                                                                  • Opcode ID: d869b65ad41923ea885775a182ffbbb4fa8a6a55f9429b012359a23964d7bd56
                                                                                                                                                                                                                                  • Instruction ID: dcc9b6c30be8843f9ed0c5b9e3fbf10f69d17c5f8952b1ef46833169396a101f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d869b65ad41923ea885775a182ffbbb4fa8a6a55f9429b012359a23964d7bd56
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1E217E21A48B4285EB20FBA5AC40179F775BB88B90BE44135DA4D837A9EF3CF504C328
                                                                                                                                                                                                                                  Function 00007FF7887893C4 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID: f$p$p
                                                                                                                                                                                                                                  • API String ID: 3215553584-1995029353
                                                                                                                                                                                                                                  • Opcode ID: d478605e8072a694eb9a9d804e4987f1596106984b5661be3eee2fb972e34d58
                                                                                                                                                                                                                                  • Instruction ID: 9b0306b815dcc7409587b52278638256297dd88d97b281521e8b2f03bb4746ec
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d478605e8072a694eb9a9d804e4987f1596106984b5661be3eee2fb972e34d58
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 89129F22E4C14386FB20BA95D0543B9F6B1FB98754FE84035E69A466C4DB3CED81DB2C
                                                                                                                                                                                                                                  Function 00007FF788776FB0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 98COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ByteCharMultiWide
                                                                                                                                                                                                                                  • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                                                  • API String ID: 626452242-876015163
                                                                                                                                                                                                                                  • Opcode ID: 9c6e19a5a84aeb67727d60a37d4bc604be489eb4fd0075111d56c9fa607bfdf6
                                                                                                                                                                                                                                  • Instruction ID: 06cde90cff2c4d1447dee610560de93a2437f03f0bda5d5ca113a46256985e1f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9c6e19a5a84aeb67727d60a37d4bc604be489eb4fd0075111d56c9fa607bfdf6
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7A419332A49B4282E620FF65A840279F6B5FB88B90FA44135DE5D47BA4EF3CD452C718
                                                                                                                                                                                                                                  Function 00007FF78877C248 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • LoadLibraryExW.KERNEL32(?,?,?,00007FF78877C4FA,?,?,?,00007FF78877C1EC,?,?,00000001,00007FF78877BE09), ref: 00007FF78877C2CD
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF78877C4FA,?,?,?,00007FF78877C1EC,?,?,00000001,00007FF78877BE09), ref: 00007FF78877C2DB
                                                                                                                                                                                                                                  • LoadLibraryExW.KERNEL32(?,?,?,00007FF78877C4FA,?,?,?,00007FF78877C1EC,?,?,00000001,00007FF78877BE09), ref: 00007FF78877C305
                                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(?,?,?,00007FF78877C4FA,?,?,?,00007FF78877C1EC,?,?,00000001,00007FF78877BE09), ref: 00007FF78877C34B
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,?,00007FF78877C4FA,?,?,?,00007FF78877C1EC,?,?,00000001,00007FF78877BE09), ref: 00007FF78877C357
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                                  • String ID: api-ms-
                                                                                                                                                                                                                                  • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                                  • Opcode ID: 9ce77a0163c425c367fd7c26c9c82fe5a817cd2dfec158d19dd861a4531b58f3
                                                                                                                                                                                                                                  • Instruction ID: 7d0fa3547cb09baad6612aa326fab9f70292af7ffad437a53786d2714bdf0c0a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9ce77a0163c425c367fd7c26c9c82fe5a817cd2dfec158d19dd861a4531b58f3
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5831C621B4A64281EE51BB96A800579E3B4FF4DBA0FA90535DD2D46340EF3CE444C729
                                                                                                                                                                                                                                  Function 00007FF7887755E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788776DB0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF788776DEA
                                                                                                                                                                                                                                  • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF78877592F,?,00000000,?,TokenIntegrityLevel), ref: 00007FF78877563F
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF788775616
                                                                                                                                                                                                                                  • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF788775653
                                                                                                                                                                                                                                  • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF78877569A
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ByteCharEnvironmentExpandMultiStringsWide
                                                                                                                                                                                                                                  • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                                                                                                                                                                                                                  • API String ID: 2001182103-3498232454
                                                                                                                                                                                                                                  • Opcode ID: fdd7dde3b259d5c85a5860e4beb10e1e90b11722a954db2bd89b45fefe27c6de
                                                                                                                                                                                                                                  • Instruction ID: 3e7b51f66d8a52a856cf089d5deca7b5f1c8de558caadfb189daabd1c4612fa2
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fdd7dde3b259d5c85a5860e4beb10e1e90b11722a954db2bd89b45fefe27c6de
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 49319551B597C280FA20B7A599553BAD2B1BF9D7C0FE40035DA0E82786FE2CE104C72C
                                                                                                                                                                                                                                  Function 00007FF788776DB0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF788776DEA
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788771CB0: GetLastError.KERNEL32(?,?,00000000,00007FF788776904,?,?,?,?,?,?,?,?,?,?,?,00007FF788771023), ref: 00007FF788771CD7
                                                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF788776E70
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                                                                                                                                  • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                                                  • API String ID: 1717984340-876015163
                                                                                                                                                                                                                                  • Opcode ID: 7f54e5da8ee4cb54e1cd0e604769d215f15cea2374718bc11fd99751b49c0007
                                                                                                                                                                                                                                  • Instruction ID: 02f16c72fc895eebc0123a64903ebce6081ae419d4db6dfa5eaffd404900e1e1
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7f54e5da8ee4cb54e1cd0e604769d215f15cea2374718bc11fd99751b49c0007
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1E216521B48A4242EF50EB69F800165E771FB8D7C4FA84135DB5C83B69EF2CE551C718
                                                                                                                                                                                                                                  Function 00007FF78878A780 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF7887924B3,?,?,?,00007FF78878CCEC,?,?,00000000,00007FF78878386F,?,?,?,00007FF788789473), ref: 00007FF78878A78F
                                                                                                                                                                                                                                  • FlsGetValue.KERNEL32(?,?,?,00007FF7887924B3,?,?,?,00007FF78878CCEC,?,?,00000000,00007FF78878386F,?,?,?,00007FF788789473), ref: 00007FF78878A7A4
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF7887924B3,?,?,?,00007FF78878CCEC,?,?,00000000,00007FF78878386F,?,?,?,00007FF788789473), ref: 00007FF78878A7C5
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF7887924B3,?,?,?,00007FF78878CCEC,?,?,00000000,00007FF78878386F,?,?,?,00007FF788789473), ref: 00007FF78878A7F2
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF7887924B3,?,?,?,00007FF78878CCEC,?,?,00000000,00007FF78878386F,?,?,?,00007FF788789473), ref: 00007FF78878A803
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF7887924B3,?,?,?,00007FF78878CCEC,?,?,00000000,00007FF78878386F,?,?,?,00007FF788789473), ref: 00007FF78878A814
                                                                                                                                                                                                                                  • SetLastError.KERNEL32(?,?,?,00007FF7887924B3,?,?,?,00007FF78878CCEC,?,?,00000000,00007FF78878386F,?,?,?,00007FF788789473), ref: 00007FF78878A82F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Value$ErrorLast
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2506987500-0
                                                                                                                                                                                                                                  • Opcode ID: c556bcea9941d530c195de90c7ce9b2392d0a01d085d118c12b8cb389224617b
                                                                                                                                                                                                                                  • Instruction ID: 465359d6503f8b812241494b0ba2586e8ce8030f315bb2a72b11d2243adc4c6e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c556bcea9941d530c195de90c7ce9b2392d0a01d085d118c12b8cb389224617b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 36217C20E8864242FA5973E1A681139E5727F4C7B0FB84734E93E47AC6DE2CA441C22E
                                                                                                                                                                                                                                  Function 00007FF7887970EC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                                  • String ID: CONOUT$
                                                                                                                                                                                                                                  • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                                  • Opcode ID: 900c1da012dee1dfb60ea43974335527b3f6c3b56b4e810762f126343bdfd55c
                                                                                                                                                                                                                                  • Instruction ID: d9e2e8ee1ddc546faafdb15665962540908f3207f7e4d17dd3b816a11a57151f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 900c1da012dee1dfb60ea43974335527b3f6c3b56b4e810762f126343bdfd55c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D3118121A58A4186E350AB96FC54329E6B1FB8CBE4FA40234DA5D87794EF3CD414C758
                                                                                                                                                                                                                                  Function 00007FF78878A8F8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF788786091,?,?,?,?,00007FF78878DF1F,?,?,00000000,00007FF78878AA16,?,?,?), ref: 00007FF78878A907
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF788786091,?,?,?,?,00007FF78878DF1F,?,?,00000000,00007FF78878AA16,?,?,?), ref: 00007FF78878A93D
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF788786091,?,?,?,?,00007FF78878DF1F,?,?,00000000,00007FF78878AA16,?,?,?), ref: 00007FF78878A96A
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF788786091,?,?,?,?,00007FF78878DF1F,?,?,00000000,00007FF78878AA16,?,?,?), ref: 00007FF78878A97B
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF788786091,?,?,?,?,00007FF78878DF1F,?,?,00000000,00007FF78878AA16,?,?,?), ref: 00007FF78878A98C
                                                                                                                                                                                                                                  • SetLastError.KERNEL32(?,?,?,00007FF788786091,?,?,?,?,00007FF78878DF1F,?,?,00000000,00007FF78878AA16,?,?,?), ref: 00007FF78878A9A7
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Value$ErrorLast
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2506987500-0
                                                                                                                                                                                                                                  • Opcode ID: 145da5da8bf5c56ab714606efba7c2bb83000df48059acb1bf9ac444d479a10e
                                                                                                                                                                                                                                  • Instruction ID: c7bfc034d2d1e443546d06a38e6091769e2780f86998b3f186822ee22af76330
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 145da5da8bf5c56ab714606efba7c2bb83000df48059acb1bf9ac444d479a10e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4C11CD20B8C64242FA5477E29641139E2727F8D7B0FB54734EC6E477D6DE2CA481C22E
                                                                                                                                                                                                                                  Function 00007FF78877BC08 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                                  • String ID: csm$f
                                                                                                                                                                                                                                  • API String ID: 2395640692-629598281
                                                                                                                                                                                                                                  • Opcode ID: e4cc0f9b1589dd73a5d4f416534ce71b9b3e94dd2aede877d85d93aa73312820
                                                                                                                                                                                                                                  • Instruction ID: f10410b5a174d2badf3fbd176be22ab00f217c3a141b926cc93428790ca97633
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e4cc0f9b1589dd73a5d4f416534ce71b9b3e94dd2aede877d85d93aa73312820
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B451C132A496028AEB14FF65E404A79F7B5FB48B88FA08531DB5E47748DF39E841C718
                                                                                                                                                                                                                                  Function 00007FF788788A40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                  • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                  • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                  • Opcode ID: 78a1a69aac29132cf000f84d0d5f993c26bceca4d1e4e1c3cfa2e89eec15c9a9
                                                                                                                                                                                                                                  • Instruction ID: c666a9d5e2b908501de8cdee70fa68fcf1dc633d4b262388b87e498d82d4d311
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 78a1a69aac29132cf000f84d0d5f993c26bceca4d1e4e1c3cfa2e89eec15c9a9
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4DF04421649B0241FA206BA5EC45339D370BF4D761FA40635CA6E451E4DF3CD448D328
                                                                                                                                                                                                                                  Function 00007FF788798824 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _set_statfp
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1156100317-0
                                                                                                                                                                                                                                  • Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                                                                                                                                  • Instruction ID: 59b09443ab64ea3fe7550b559d5a8a6516030b4a9c9b812a8b228bbe47d896bf
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D8118222EE8A0341F67431B8DC85775D1627F5C364EAA0638E97E4A7D7CE3CA840C138
                                                                                                                                                                                                                                  Function 00007FF78878A9C0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • FlsGetValue.KERNEL32(?,?,?,00007FF788789BD3,?,?,00000000,00007FF788789E6E,?,?,?,?,?,00007FF788781A40), ref: 00007FF78878A9DF
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF788789BD3,?,?,00000000,00007FF788789E6E,?,?,?,?,?,00007FF788781A40), ref: 00007FF78878A9FE
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF788789BD3,?,?,00000000,00007FF788789E6E,?,?,?,?,?,00007FF788781A40), ref: 00007FF78878AA26
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF788789BD3,?,?,00000000,00007FF788789E6E,?,?,?,?,?,00007FF788781A40), ref: 00007FF78878AA37
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF788789BD3,?,?,00000000,00007FF788789E6E,?,?,?,?,?,00007FF788781A40), ref: 00007FF78878AA48
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Value
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3702945584-0
                                                                                                                                                                                                                                  • Opcode ID: fe685267061b1d7826c58759cf3d75ed099b9be309ea2abb6383fb5ceaf5ba53
                                                                                                                                                                                                                                  • Instruction ID: 802f2c5a33544dfaa7e8056ae98faaab89a9d532ac85a79af9f93c9419a1500d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fe685267061b1d7826c58759cf3d75ed099b9be309ea2abb6383fb5ceaf5ba53
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 99113D11A8864241FA58B3E59681279E5627F4C7F0FA44334E83E47AD6DE2CE841C62E
                                                                                                                                                                                                                                  Function 00007FF78878A854 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7887924B3,?,?,?,00007FF78878CCEC,?,?,00000000,00007FF78878386F), ref: 00007FF78878A865
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7887924B3,?,?,?,00007FF78878CCEC,?,?,00000000,00007FF78878386F), ref: 00007FF78878A884
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7887924B3,?,?,?,00007FF78878CCEC,?,?,00000000,00007FF78878386F), ref: 00007FF78878A8AC
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7887924B3,?,?,?,00007FF78878CCEC,?,?,00000000,00007FF78878386F), ref: 00007FF78878A8BD
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7887924B3,?,?,?,00007FF78878CCEC,?,?,00000000,00007FF78878386F), ref: 00007FF78878A8CE
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Value
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3702945584-0
                                                                                                                                                                                                                                  • Opcode ID: 46640cf929105097b223292b0b206d62ba136b58cd2f6612e783bcd6201db716
                                                                                                                                                                                                                                  • Instruction ID: 907826abcd9529a4294c5fb0005a2c0404b54d248f469e08df5066141cdd1514
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 46640cf929105097b223292b0b206d62ba136b58cd2f6612e783bcd6201db716
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9611D610E8860341F9A972E56592279E1726F4D360FB84734D93E4A6D3DE2CB482C23E
                                                                                                                                                                                                                                  Function 00007FF78878F218 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                                  • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                                  • Opcode ID: fa9c2c0b9e0b51f4f192ae3b8b8b95ed4a793ff286fdede4dba764f85164dfb1
                                                                                                                                                                                                                                  • Instruction ID: f0684abdd02a4338f954b7ef4c13df6dce0a2f628c8803bf8d87a9d48dd659a9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fa9c2c0b9e0b51f4f192ae3b8b8b95ed4a793ff286fdede4dba764f85164dfb1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B381A272E8820285F7A47EA5C154278F6B0BF19B84FF58032DA0DD7A95CB2DE941D32D
                                                                                                                                                                                                                                  Function 00007FF78877D468 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                                  • String ID: MOC$RCC
                                                                                                                                                                                                                                  • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                                  • Opcode ID: f09742bcba9082defbae069630545238114b431a0e4fd7be58dd8469a5d7fef1
                                                                                                                                                                                                                                  • Instruction ID: ad112efbc37ef7d317ca95eb9a5265a97a9f9feed28a38ccb94fae0fec48a5b3
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f09742bcba9082defbae069630545238114b431a0e4fd7be58dd8469a5d7fef1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FF618972A08A858AE710EFA5D4403ADBBB0FB49B8CF644235EE4D13B99DF38E055C714
                                                                                                                                                                                                                                  Function 00007FF78877D7C4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                                                  • String ID: csm$csm
                                                                                                                                                                                                                                  • API String ID: 3896166516-3733052814
                                                                                                                                                                                                                                  • Opcode ID: a3990994d2fbb822c09bdc2a35b5fa2b647080e9aebb1a5b00e12dffe7bfe986
                                                                                                                                                                                                                                  • Instruction ID: 8156a7135d11b3983da4b8bb41441f8a6c55bf052b7976a82c4b763eaea7ec2d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a3990994d2fbb822c09bdc2a35b5fa2b647080e9aebb1a5b00e12dffe7bfe986
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7351A53294824286EB64BF519584378FBB0FB99B94FA44135DA9C47BDACF3CE450CB18
                                                                                                                                                                                                                                  Function 00007FF788772CD0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(?,00007FF7887727C9,?,?,?,?,?,?), ref: 00007FF788772D01
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788771CB0: GetLastError.KERNEL32(?,?,00000000,00007FF788776904,?,?,?,?,?,?,?,?,?,?,?,00007FF788771023), ref: 00007FF788771CD7
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                                                  • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                                                                                                                                  • API String ID: 2776309574-1977442011
                                                                                                                                                                                                                                  • Opcode ID: 7987a5ce4ff3c8cba7d8c38c60f2d05ca27952d1a3ea66f3204455115dc1ef10
                                                                                                                                                                                                                                  • Instruction ID: b1af1a631ab846f22043f40529ccae9c8aee66a3160260051db749d422291f88
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7987a5ce4ff3c8cba7d8c38c60f2d05ca27952d1a3ea66f3204455115dc1ef10
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 11018420BAD64245FA61B7A0D8153F5D2B1BF5C3C0FE00031D84E8A296EE5CE104C738
                                                                                                                                                                                                                                  Function 00007FF78878BBD0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2718003287-0
                                                                                                                                                                                                                                  • Opcode ID: 47f9f7c1e3185106a498671fedee26090088e719dd8e44b73d57f810765c87d4
                                                                                                                                                                                                                                  • Instruction ID: 38458e930b701bc0b968b256e6657084bfda7250781033b11bd36e2ea6650285
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 47f9f7c1e3185106a498671fedee26090088e719dd8e44b73d57f810765c87d4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 81D1E072B18A8589E710DFA5D4402ACF7B5FB487D8BA04236CF5E97B99DE38D006C718
                                                                                                                                                                                                                                  Function 00007FF788794DBC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID: ?
                                                                                                                                                                                                                                  • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                                  • Opcode ID: 610c018c2ed3d43a6dc6b39dfd7623f8c002a97b49fdc2d3a9d4eaa2ab755e24
                                                                                                                                                                                                                                  • Instruction ID: 7539351b4ab64d9876b8dcda744cf2b9b933c6fb9fc82d9e17eb1da383ecea6f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 610c018c2ed3d43a6dc6b39dfd7623f8c002a97b49fdc2d3a9d4eaa2ab755e24
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 20411E32AA828241FB64ABB59841379D670FF88BA4F744235EE5C07AD5DF3CD481C718
                                                                                                                                                                                                                                  Function 00007FF788787FD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _invalid_parameter_noinfo.LIBCMT ref: 00007FF788788002
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788789F78: RtlFreeHeap.NTDLL(?,?,?,00007FF788791EC2,?,?,?,00007FF788791EFF,?,?,00000000,00007FF7887923C5,?,?,00000000,00007FF7887922F7), ref: 00007FF788789F8E
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788789F78: GetLastError.KERNEL32(?,?,?,00007FF788791EC2,?,?,?,00007FF788791EFF,?,?,00000000,00007FF7887923C5,?,?,00000000,00007FF7887922F7), ref: 00007FF788789F98
                                                                                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF78877A485), ref: 00007FF788788020
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID: C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                  • API String ID: 3580290477-651273546
                                                                                                                                                                                                                                  • Opcode ID: 87397ab4d942c93eb7ecf5272dbc7224ab3e9c0a5ace0b49458789d652eb9e0d
                                                                                                                                                                                                                                  • Instruction ID: 1483f088819f5974ab432a7c47e80e1c4356b374feab3c595140be73758f7dfc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 87397ab4d942c93eb7ecf5272dbc7224ab3e9c0a5ace0b49458789d652eb9e0d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 83416132A8864285F714AF61D8411B9F3B5FF487D4BA44035EA4E47B95DF3DE441C328
                                                                                                                                                                                                                                  Function 00007FF78878C268 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                  • String ID: U
                                                                                                                                                                                                                                  • API String ID: 442123175-4171548499
                                                                                                                                                                                                                                  • Opcode ID: 3868b3aae24abb70b6c7ced641cfa87b6d54125405e373b4c87f7bfc476be08b
                                                                                                                                                                                                                                  • Instruction ID: bcb166d6383145293a162039711eae07cfbb0c43253169c4642e0515b071c31b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3868b3aae24abb70b6c7ced641cfa87b6d54125405e373b4c87f7bfc476be08b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2741C722B18A4185EB60EFA5E8443AAF770FB98794FA44031EE4D87B98DF3CD441D758
                                                                                                                                                                                                                                  Function 00007FF78878E588 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentDirectory
                                                                                                                                                                                                                                  • String ID: :
                                                                                                                                                                                                                                  • API String ID: 1611563598-336475711
                                                                                                                                                                                                                                  • Opcode ID: 18b7638caf06c09ebc69002de91f62cb772c0954a617d485b77ce50a76d6b06e
                                                                                                                                                                                                                                  • Instruction ID: 86500980749a7816713edb6f60d477c2796ef1b2fc5f1327337b21982cc93d38
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 18b7638caf06c09ebc69002de91f62cb772c0954a617d485b77ce50a76d6b06e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9B21CE63B4828181EB20AB51D44426EF3B2FB88B84FE58035DA8D43285DF7CE945CB69
                                                                                                                                                                                                                                  Function 00007FF78877E310 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                                  • String ID: csm
                                                                                                                                                                                                                                  • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                                  • Opcode ID: ee4cd62d6736e0f26efa3482034fbaa09f2706f16dc7c85cfdea4997af4e44da
                                                                                                                                                                                                                                  • Instruction ID: ea91264fd502427c9ef1cd79e84088bbe0f759e19e62bcf86cfd2f365a4b2b34
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ee4cd62d6736e0f26efa3482034fbaa09f2706f16dc7c85cfdea4997af4e44da
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 17113A32648B4182EB209F25F940269F7B4FB88B84F684231EE8D07768DF3CD551CB04
                                                                                                                                                                                                                                  Function 00007FF78878F08C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.1918359018.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918314428.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918408147.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918455625.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.1918535599.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID: :
                                                                                                                                                                                                                                  • API String ID: 2595371189-336475711
                                                                                                                                                                                                                                  • Opcode ID: 231bdef7d4e4c9a314d514652501e8a1bb3d1d6653b2e53c967e9d93a887682d
                                                                                                                                                                                                                                  • Instruction ID: f38bfe74bddd6410cdff3019d28e6eb305edd97ea475694ea42e777eeee511ff
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 231bdef7d4e4c9a314d514652501e8a1bb3d1d6653b2e53c967e9d93a887682d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 93018F61A586028AF720BFA0946127EE3B0FF4C714FE40036D56D46681EE2CE545DA3C

                                                                                                                                                                                                                                  Execution Graph

                                                                                                                                                                                                                                  Execution Coverage:7.6%
                                                                                                                                                                                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                  Signature Coverage:0%
                                                                                                                                                                                                                                  Total number of Nodes:1925
                                                                                                                                                                                                                                  Total number of Limit Nodes:57
                                                                                                                                                                                                                                  execution_graph 18880 7ff788797020 18883 7ff7887917b0 18880->18883 18884 7ff7887917bd 18883->18884 18886 7ff788791802 18883->18886 18887 7ff788791484 18884->18887 18906 7ff7887916f4 18887->18906 18889 7ff7887914b9 18917 7ff788791184 18889->18917 18892 7ff7887914d6 18892->18886 18893 7ff78878cc2c _fread_nolock 2 API calls 18894 7ff7887914e7 18893->18894 18895 7ff7887914ef 18894->18895 18897 7ff7887914fe 18894->18897 18896 7ff788789f78 __free_lconv_mon 2 API calls 18895->18896 18896->18892 18898 7ff7887915fa 18897->18898 18902 7ff788791614 18897->18902 18901 7ff788789f78 __free_lconv_mon 2 API calls 18898->18901 18899 7ff788791655 18900 7ff7887916bc 18899->18900 18924 7ff788790fb4 18899->18924 18905 7ff788789f78 __free_lconv_mon 2 API calls 18900->18905 18901->18892 18902->18899 18903 7ff788789f78 __free_lconv_mon 2 API calls 18902->18903 18903->18899 18905->18892 18907 7ff788791717 18906->18907 18911 7ff788791721 18907->18911 18933 7ff78878f808 EnterCriticalSection 18907->18933 18909 7ff788791793 18909->18889 18911->18909 18912 7ff78878936c __CxxCallCatchBlock 16 API calls 18911->18912 18915 7ff7887917ab 18912->18915 18914 7ff788791802 18914->18889 18915->18914 18916 7ff788791484 41 API calls 18915->18916 18916->18914 18918 7ff788784a84 26 API calls 18917->18918 18919 7ff788791198 18918->18919 18920 7ff7887911a4 GetOEMCP 18919->18920 18921 7ff7887911b6 18919->18921 18923 7ff7887911cb 18920->18923 18922 7ff7887911bb GetACP 18921->18922 18921->18923 18922->18923 18923->18892 18923->18893 18934 7ff78878f808 EnterCriticalSection 18924->18934 15267 7ff78877a51c 15287 7ff78877a6fc 15267->15287 15270 7ff78877a53d __scrt_acquire_startup_lock 15273 7ff78877a67d 15270->15273 15277 7ff78877a55b 15270->15277 15271 7ff78877a673 15390 7ff78877aa2c IsProcessorFeaturePresent 15271->15390 15274 7ff78877aa2c 7 API calls 15273->15274 15276 7ff78877a580 __CxxCallCatchBlock 15274->15276 15275 7ff78877a5b1 __scrt_release_startup_lock 15280 7ff78877a5bd 15275->15280 15277->15275 15277->15276 15278 7ff78877a606 15295 7ff788788738 15278->15295 15280->15278 15383 7ff788788ae4 15280->15383 15282 7ff78877a60b 15301 7ff788771000 15282->15301 15286 7ff78877a62f 15286->15276 15397 7ff78877accc 15287->15397 15290 7ff78877a72b 15399 7ff7887891ec 15290->15399 15292 7ff78877a535 15292->15270 15292->15271 15296 7ff788788748 15295->15296 15297 7ff78878875d 15295->15297 15296->15297 15440 7ff7887881c8 15296->15440 15297->15282 15302 7ff788771011 15301->15302 15588 7ff7887767c0 15302->15588 15304 7ff788771023 15595 7ff788784f7c 15304->15595 15306 7ff7887727ab 15602 7ff788771af0 15306->15602 15310 7ff78877a100 _wfindfirst32i64 8 API calls 15311 7ff7887728de 15310->15311 15388 7ff78877ab80 GetModuleHandleW 15311->15388 15312 7ff7887727c9 15374 7ff7887728ca 15312->15374 15618 7ff788772c50 15312->15618 15314 7ff7887727fb 15314->15374 15621 7ff788775af0 15314->15621 15316 7ff788772817 15317 7ff788772863 15316->15317 15319 7ff788775af0 49 API calls 15316->15319 15636 7ff7887760f0 15317->15636 15323 7ff788772838 __std_exception_destroy 15319->15323 15320 7ff788772878 15640 7ff7887719d0 15320->15640 15323->15317 15327 7ff7887760f0 46 API calls 15323->15327 15324 7ff78877296d 15325 7ff788772998 15324->15325 15736 7ff7887724a0 15324->15736 15334 7ff7887729db 15325->15334 15651 7ff788776db0 15325->15651 15326 7ff7887719d0 113 API calls 15330 7ff7887728ae 15326->15330 15327->15317 15332 7ff7887728b2 15330->15332 15333 7ff7887728f0 15330->15333 15331 7ff7887729b8 15335 7ff7887729bd 15331->15335 15336 7ff7887729ce SetDllDirectoryW 15331->15336 15707 7ff788771c50 15332->15707 15333->15324 15713 7ff788772de0 15333->15713 15665 7ff788774fa0 15334->15665 15339 7ff788771c50 43 API calls 15335->15339 15336->15334 15339->15374 15343 7ff788772a36 15350 7ff788772af6 15343->15350 15356 7ff788772a49 15343->15356 15344 7ff788772912 15349 7ff788771c50 43 API calls 15344->15349 15347 7ff7887729f8 15347->15343 15750 7ff7887747a0 15347->15750 15348 7ff788772940 15348->15324 15351 7ff788772945 15348->15351 15349->15374 15697 7ff788772330 15350->15697 15732 7ff78877e60c 15351->15732 15362 7ff788772a95 15356->15362 15850 7ff788771b30 15356->15850 15357 7ff788772a0d 15770 7ff788774730 15357->15770 15358 7ff788772a2c 15844 7ff7887749f0 15358->15844 15362->15374 15669 7ff7887722d0 15362->15669 15363 7ff788772a17 15363->15358 15365 7ff788772a1b 15363->15365 15364 7ff788772b03 15366 7ff788775af0 49 API calls 15364->15366 15364->15374 15838 7ff788774df0 15365->15838 15369 7ff788772b37 15366->15369 15372 7ff788772b48 15369->15372 15369->15374 15370 7ff788772ad1 15373 7ff7887749f0 FreeLibrary 15370->15373 15854 7ff788776130 15372->15854 15373->15374 15374->15310 15377 7ff7887749f0 FreeLibrary 15379 7ff788772b6c 15377->15379 15378 7ff788772b87 15884 7ff788771ab0 15378->15884 15379->15378 15872 7ff788775df0 15379->15872 15382 7ff788772b8f 15382->15374 15384 7ff788788afb 15383->15384 15385 7ff788788b1c 15383->15385 15384->15278 17444 7ff788789238 15385->17444 15389 7ff78877ab91 15388->15389 15389->15286 15391 7ff78877aa52 _wfindfirst32i64 15390->15391 15392 7ff78877aa71 RtlCaptureContext RtlLookupFunctionEntry 15391->15392 15393 7ff78877aa9a RtlVirtualUnwind 15392->15393 15394 7ff78877aad6 15392->15394 15393->15394 15395 7ff78877ab08 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15394->15395 15396 7ff78877ab5a _wfindfirst32i64 15395->15396 15396->15273 15398 7ff78877a71e __scrt_dllmain_crt_thread_attach 15397->15398 15398->15290 15398->15292 15400 7ff78879264c 15399->15400 15401 7ff78877a730 15400->15401 15409 7ff78878bb50 15400->15409 15401->15292 15403 7ff78877be28 15401->15403 15404 7ff78877be3a 15403->15404 15405 7ff78877be30 15403->15405 15404->15292 15419 7ff78877c1a4 15405->15419 15418 7ff78878f808 EnterCriticalSection 15409->15418 15420 7ff78877c1b3 15419->15420 15421 7ff78877be35 15419->15421 15427 7ff78877c3e0 15420->15427 15423 7ff78877c210 15421->15423 15424 7ff78877c23b 15423->15424 15425 7ff78877c21e DeleteCriticalSection 15424->15425 15426 7ff78877c23f 15424->15426 15425->15424 15426->15404 15431 7ff78877c248 15427->15431 15432 7ff78877c362 TlsFree 15431->15432 15438 7ff78877c28c __vcrt_InitializeCriticalSectionEx 15431->15438 15433 7ff78877c2ba LoadLibraryExW 15435 7ff78877c2db GetLastError 15433->15435 15436 7ff78877c331 15433->15436 15434 7ff78877c351 GetProcAddress 15434->15432 15435->15438 15436->15434 15437 7ff78877c348 FreeLibrary 15436->15437 15437->15434 15438->15432 15438->15433 15438->15434 15439 7ff78877c2fd LoadLibraryExW 15438->15439 15439->15436 15439->15438 15441 7ff7887881e1 15440->15441 15452 7ff7887881dd 15440->15452 15460 7ff788791bfc GetEnvironmentStringsW 15441->15460 15444 7ff7887881fa 15471 7ff788788348 15444->15471 15445 7ff7887881ee 15467 7ff788789f78 15445->15467 15449 7ff788789f78 __free_lconv_mon 2 API calls 15450 7ff788788221 15449->15450 15451 7ff788789f78 __free_lconv_mon 2 API calls 15450->15451 15451->15452 15452->15297 15453 7ff788788588 15452->15453 15454 7ff7887885ab 15453->15454 15456 7ff7887885c2 15453->15456 15454->15297 15455 7ff78878deb8 _fread_nolock 2 API calls 15455->15456 15456->15454 15456->15455 15457 7ff788788636 15456->15457 15459 7ff788789f78 __free_lconv_mon 2 API calls 15456->15459 15458 7ff788789f78 __free_lconv_mon 2 API calls 15457->15458 15458->15454 15459->15456 15461 7ff7887881e6 15460->15461 15464 7ff788791c20 15460->15464 15461->15444 15461->15445 15463 7ff788791c57 memcpy_s 15465 7ff788789f78 __free_lconv_mon 2 API calls 15463->15465 15490 7ff78878cc2c 15464->15490 15466 7ff788791c77 FreeEnvironmentStringsW 15465->15466 15466->15461 15468 7ff788789fa5 __free_lconv_mon 15467->15468 15469 7ff788789f7d HeapFree 15467->15469 15468->15452 15469->15468 15470 7ff788789f98 GetLastError 15469->15470 15470->15468 15472 7ff788788370 15471->15472 15502 7ff78878deb8 15472->15502 15474 7ff7887883b3 15475 7ff788789f78 __free_lconv_mon 2 API calls 15474->15475 15476 7ff788788202 15475->15476 15476->15449 15477 7ff78878842d 15478 7ff788789f78 __free_lconv_mon 2 API calls 15477->15478 15478->15476 15479 7ff78878deb8 _fread_nolock 2 API calls 15485 7ff7887883ab 15479->15485 15480 7ff78878841c 15511 7ff788788464 15480->15511 15484 7ff788788450 15517 7ff788789f30 IsProcessorFeaturePresent 15484->15517 15485->15474 15485->15477 15485->15479 15485->15480 15485->15484 15488 7ff788789f78 __free_lconv_mon 2 API calls 15485->15488 15507 7ff78878f9a4 15485->15507 15486 7ff788789f78 __free_lconv_mon 2 API calls 15486->15474 15488->15485 15492 7ff78878cc75 15490->15492 15493 7ff78878cc3b _fread_nolock 15490->15493 15491 7ff78878cc5e HeapAlloc 15491->15492 15491->15493 15492->15463 15493->15491 15493->15492 15495 7ff788792730 15493->15495 15498 7ff788792770 15495->15498 15501 7ff78878f808 EnterCriticalSection 15498->15501 15506 7ff78878dec9 _fread_nolock 15502->15506 15503 7ff78878df18 15503->15485 15504 7ff78878defe HeapAlloc 15504->15503 15504->15506 15505 7ff788792730 _fread_nolock EnterCriticalSection 15505->15506 15506->15503 15506->15504 15506->15505 15510 7ff78878f9b1 15507->15510 15509 7ff78878f9cf 15509->15485 15510->15509 15521 7ff788789f10 15510->15521 15512 7ff788788424 15511->15512 15513 7ff788788469 15511->15513 15512->15486 15514 7ff788788492 15513->15514 15515 7ff788789f78 __free_lconv_mon 2 API calls 15513->15515 15516 7ff788789f78 __free_lconv_mon 2 API calls 15514->15516 15515->15513 15516->15512 15518 7ff788789f43 15517->15518 15566 7ff788789c44 15518->15566 15523 7ff788789da8 15521->15523 15524 7ff788789dd3 15523->15524 15527 7ff788789e44 15524->15527 15526 7ff788789dfa 15535 7ff788789b8c 15527->15535 15530 7ff788789e7f 15530->15526 15533 7ff788789f30 _wfindfirst32i64 17 API calls 15534 7ff788789f0f 15533->15534 15536 7ff788789be3 15535->15536 15537 7ff788789ba8 GetLastError 15535->15537 15536->15530 15541 7ff788789bf8 15536->15541 15538 7ff788789bb8 15537->15538 15544 7ff78878a9c0 15538->15544 15542 7ff788789c14 GetLastError SetLastError 15541->15542 15543 7ff788789c2c 15541->15543 15542->15543 15543->15530 15543->15533 15545 7ff78878a9df FlsGetValue 15544->15545 15546 7ff78878a9fa FlsSetValue 15544->15546 15548 7ff78878a9f4 15545->15548 15549 7ff788789bd3 SetLastError 15545->15549 15547 7ff78878aa07 15546->15547 15546->15549 15550 7ff78878deb8 _fread_nolock 2 API calls 15547->15550 15548->15546 15549->15536 15551 7ff78878aa16 15550->15551 15552 7ff78878aa34 FlsSetValue 15551->15552 15553 7ff78878aa24 FlsSetValue 15551->15553 15555 7ff78878aa40 FlsSetValue 15552->15555 15556 7ff78878aa52 15552->15556 15554 7ff78878aa2d 15553->15554 15557 7ff788789f78 __free_lconv_mon 2 API calls 15554->15557 15555->15554 15561 7ff78878a524 15556->15561 15557->15549 15560 7ff788789f78 __free_lconv_mon 2 API calls 15560->15549 15562 7ff78878a3fc _invalid_parameter_noinfo EnterCriticalSection 15561->15562 15563 7ff78878a5d6 15562->15563 15564 7ff78878a47c _invalid_parameter_noinfo HeapFree GetLastError EnterCriticalSection 15563->15564 15565 7ff78878a5eb 15564->15565 15565->15560 15567 7ff788789c7e _wfindfirst32i64 15566->15567 15568 7ff788789ca6 RtlCaptureContext RtlLookupFunctionEntry 15567->15568 15569 7ff788789ce0 RtlVirtualUnwind 15568->15569 15570 7ff788789d16 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15568->15570 15569->15570 15571 7ff788789d68 _wfindfirst32i64 15570->15571 15574 7ff78877a100 15571->15574 15575 7ff78877a109 15574->15575 15576 7ff78877a114 GetCurrentProcess TerminateProcess 15575->15576 15577 7ff78877a1c0 IsProcessorFeaturePresent 15575->15577 15578 7ff78877a1d8 15577->15578 15583 7ff78877a3b4 RtlCaptureContext 15578->15583 15584 7ff78877a3ce RtlLookupFunctionEntry 15583->15584 15585 7ff78877a1eb 15584->15585 15586 7ff78877a3e4 RtlVirtualUnwind 15584->15586 15587 7ff78877a180 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 15585->15587 15586->15584 15586->15585 15590 7ff7887767df 15588->15590 15589 7ff788776830 WideCharToMultiByte 15589->15590 15593 7ff7887768d8 15589->15593 15590->15589 15592 7ff788776886 WideCharToMultiByte 15590->15592 15590->15593 15594 7ff7887767e7 __std_exception_destroy 15590->15594 15592->15590 15592->15593 15888 7ff788771cb0 15593->15888 15594->15304 15598 7ff78878ecc0 15595->15598 15596 7ff78878ed13 15597 7ff788789e44 _invalid_parameter_noinfo 30 API calls 15596->15597 15601 7ff78878ed3c 15597->15601 15598->15596 15599 7ff78878ed66 15598->15599 16105 7ff78878eb98 15599->16105 15601->15306 15603 7ff788771b05 15602->15603 15604 7ff788771b20 15603->15604 16113 7ff788771c10 15603->16113 15604->15374 15606 7ff788772cd0 15604->15606 16136 7ff78877a130 15606->16136 15609 7ff788772d0b 15611 7ff788771cb0 43 API calls 15609->15611 15610 7ff788772d22 16138 7ff788776ec0 15610->16138 15614 7ff788772d1e 15611->15614 15616 7ff78877a100 _wfindfirst32i64 8 API calls 15614->15616 15615 7ff788771c50 43 API calls 15615->15614 15617 7ff788772d5f 15616->15617 15617->15312 15619 7ff788771b30 33 API calls 15618->15619 15620 7ff788772c6d 15619->15620 15620->15314 15622 7ff788775afa 15621->15622 15623 7ff788776db0 45 API calls 15622->15623 15624 7ff788775b1c GetEnvironmentVariableW 15623->15624 15625 7ff788775b86 15624->15625 15626 7ff788775b34 ExpandEnvironmentStringsW 15624->15626 15627 7ff78877a100 _wfindfirst32i64 8 API calls 15625->15627 15628 7ff788776ec0 45 API calls 15626->15628 15629 7ff788775b98 15627->15629 15630 7ff788775b5c 15628->15630 15629->15316 15630->15625 15631 7ff788775b66 15630->15631 16149 7ff78878926c 15631->16149 15634 7ff78877a100 _wfindfirst32i64 8 API calls 15635 7ff788775b7e 15634->15635 15635->15316 15637 7ff788776db0 45 API calls 15636->15637 15638 7ff788776107 SetEnvironmentVariableW 15637->15638 15639 7ff78877611f __std_exception_destroy 15638->15639 15639->15320 15641 7ff788771b30 33 API calls 15640->15641 15642 7ff788771a00 15641->15642 15643 7ff788771b30 33 API calls 15642->15643 15649 7ff788771a7a 15642->15649 15644 7ff788771a22 15643->15644 15645 7ff788772c50 33 API calls 15644->15645 15644->15649 15646 7ff788771a3b 15645->15646 16160 7ff7887717b0 15646->16160 15649->15324 15649->15326 15650 7ff78877e60c 55 API calls 15650->15649 15652 7ff788776e57 MultiByteToWideChar 15651->15652 15653 7ff788776dd1 MultiByteToWideChar 15651->15653 15654 7ff788776e7a 15652->15654 15655 7ff788776e9f 15652->15655 15656 7ff788776e1c 15653->15656 15657 7ff788776df7 15653->15657 15658 7ff788771cb0 43 API calls 15654->15658 15655->15331 15656->15652 15662 7ff788776e32 15656->15662 15659 7ff788771cb0 43 API calls 15657->15659 15660 7ff788776e8d 15658->15660 15661 7ff788776e0a 15659->15661 15660->15331 15661->15331 15663 7ff788771cb0 43 API calls 15662->15663 15664 7ff788776e45 15663->15664 15664->15331 15666 7ff788774fb5 15665->15666 15667 7ff7887729e0 15666->15667 15668 7ff788771c10 62 API calls 15666->15668 15667->15343 15740 7ff788774c40 15667->15740 15668->15667 16229 7ff788773ac0 15669->16229 15672 7ff78877231d 15672->15370 15674 7ff7887722f4 15674->15672 16285 7ff788773840 15674->16285 15676 7ff788772300 15676->15672 16295 7ff7887739a0 15676->16295 15678 7ff78877230c 15678->15672 15679 7ff78877255c 15678->15679 15680 7ff788772547 15678->15680 15683 7ff78877257c 15679->15683 15689 7ff788772592 __std_exception_destroy 15679->15689 15681 7ff788771c50 43 API calls 15680->15681 15682 7ff788772553 15681->15682 15684 7ff78877a100 _wfindfirst32i64 8 API calls 15682->15684 15685 7ff788771c50 43 API calls 15683->15685 15686 7ff7887726ea 15684->15686 15685->15682 15686->15370 15689->15682 15690 7ff788771b30 33 API calls 15689->15690 15691 7ff78877273f 15689->15691 15693 7ff788772719 15689->15693 15695 7ff7887726f6 15689->15695 16300 7ff7887712b0 15689->16300 16326 7ff788771780 15689->16326 15690->15689 15692 7ff788771c50 43 API calls 15691->15692 15692->15682 15694 7ff788771c50 43 API calls 15693->15694 15694->15682 15696 7ff788771c50 43 API calls 15695->15696 15696->15682 15699 7ff7887723e4 15697->15699 15703 7ff7887723a3 15697->15703 15698 7ff788772423 15701 7ff78877a100 _wfindfirst32i64 8 API calls 15698->15701 15699->15698 15700 7ff788771ab0 55 API calls 15699->15700 15700->15699 15702 7ff788772435 15701->15702 15702->15364 15703->15699 15705 7ff788771780 43 API calls 15703->15705 16568 7ff788771dc0 15703->16568 16617 7ff788771440 15703->16617 15705->15703 15708 7ff788771c6e 15707->15708 15709 7ff788771b90 32 API calls 15708->15709 15710 7ff788771c8c 15709->15710 15711 7ff788771d00 43 API calls 15710->15711 15712 7ff788771c9b 15711->15712 15712->15374 15714 7ff788772dec 15713->15714 15715 7ff788776db0 45 API calls 15714->15715 15716 7ff788772e17 15715->15716 15717 7ff788776db0 45 API calls 15716->15717 15718 7ff788772e2a 15717->15718 17108 7ff788785538 15718->17108 15720 7ff788772e39 15721 7ff78877a100 _wfindfirst32i64 8 API calls 15720->15721 15722 7ff78877290a 15721->15722 15722->15344 15723 7ff788776360 15722->15723 15724 7ff788776384 15723->15724 15725 7ff78877645b __std_exception_destroy 15724->15725 15726 7ff78877ec94 54 API calls 15724->15726 15725->15348 15727 7ff78877639e 15726->15727 15727->15725 17384 7ff788787a9c 15727->17384 15729 7ff78877ec94 54 API calls 15731 7ff7887763b3 15729->15731 15730 7ff78877e95c _fread_nolock 51 API calls 15730->15731 15731->15725 15731->15729 15731->15730 15733 7ff78877e63c 15732->15733 17399 7ff78877e3e8 15733->17399 15735 7ff78877e655 15735->15344 15737 7ff7887724b7 15736->15737 15738 7ff7887724e0 15736->15738 15737->15738 15739 7ff788771780 43 API calls 15737->15739 15738->15325 15739->15737 15741 7ff788774c64 15740->15741 15745 7ff788774c91 15740->15745 15742 7ff788774c8c 15741->15742 15743 7ff788771780 43 API calls 15741->15743 15741->15745 15749 7ff788774c87 memcpy_s __std_exception_destroy 15741->15749 15744 7ff7887712b0 114 API calls 15742->15744 15743->15741 15744->15745 15746 7ff788772e60 33 API calls 15745->15746 15745->15749 15747 7ff788774cf7 15746->15747 15748 7ff788771c50 43 API calls 15747->15748 15747->15749 15748->15749 15749->15347 15751 7ff7887747ba memcpy_s 15750->15751 15752 7ff7887748df 15751->15752 15755 7ff7887748fb 15751->15755 15758 7ff788772e60 33 API calls 15751->15758 15759 7ff7887748c0 15751->15759 15767 7ff788771440 132 API calls 15751->15767 15768 7ff7887748e1 15751->15768 17410 7ff788771650 15751->17410 15754 7ff788772e60 33 API calls 15752->15754 15756 7ff788774958 15754->15756 15757 7ff788771c50 43 API calls 15755->15757 15760 7ff788772e60 33 API calls 15756->15760 15763 7ff7887748f1 __std_exception_destroy 15757->15763 15758->15751 15759->15752 15761 7ff788772e60 33 API calls 15759->15761 15762 7ff788774988 15760->15762 15761->15752 15766 7ff788772e60 33 API calls 15762->15766 15764 7ff78877a100 _wfindfirst32i64 8 API calls 15763->15764 15765 7ff788772a09 15764->15765 15765->15357 15765->15358 15766->15763 15767->15751 15769 7ff788771c50 43 API calls 15768->15769 15769->15763 15771 7ff788776310 46 API calls 15770->15771 15772 7ff788774742 15771->15772 15773 7ff788776310 46 API calls 15772->15773 15774 7ff788774755 15773->15774 15775 7ff78877477a 15774->15775 15776 7ff78877476d GetProcAddress 15774->15776 15777 7ff788771c50 43 API calls 15775->15777 15780 7ff7887750fc GetProcAddress 15776->15780 15781 7ff7887750d9 15776->15781 15779 7ff788774786 15777->15779 15779->15363 15780->15781 15782 7ff788775121 GetProcAddress 15780->15782 15784 7ff788771cb0 43 API calls 15781->15784 15782->15781 15783 7ff788775146 GetProcAddress 15782->15783 15783->15781 15786 7ff78877516e GetProcAddress 15783->15786 15785 7ff7887750ec 15784->15785 15785->15363 15786->15781 15787 7ff788775196 GetProcAddress 15786->15787 15787->15781 15788 7ff7887751be GetProcAddress 15787->15788 15789 7ff7887751da 15788->15789 15790 7ff7887751e6 GetProcAddress 15788->15790 15789->15790 15791 7ff78877520e GetProcAddress 15790->15791 15792 7ff788775202 15790->15792 15793 7ff78877522a 15791->15793 15794 7ff788775236 GetProcAddress 15791->15794 15792->15791 15793->15794 15795 7ff78877525e GetProcAddress 15794->15795 15796 7ff788775252 15794->15796 15797 7ff78877527a 15795->15797 15798 7ff788775286 GetProcAddress 15795->15798 15796->15795 15797->15798 15799 7ff7887752ae GetProcAddress 15798->15799 15800 7ff7887752a2 15798->15800 15801 7ff7887752ca 15799->15801 15802 7ff7887752d6 GetProcAddress 15799->15802 15800->15799 15801->15802 15803 7ff7887752fe GetProcAddress 15802->15803 15804 7ff7887752f2 15802->15804 15805 7ff78877531a 15803->15805 15806 7ff788775326 GetProcAddress 15803->15806 15804->15803 15805->15806 15807 7ff78877534e GetProcAddress 15806->15807 15808 7ff788775342 15806->15808 15809 7ff78877536a 15807->15809 15810 7ff788775376 GetProcAddress 15807->15810 15808->15807 15809->15810 15811 7ff78877539e GetProcAddress 15810->15811 15812 7ff788775392 15810->15812 15813 7ff7887753ba 15811->15813 15814 7ff7887753c6 GetProcAddress 15811->15814 15812->15811 15813->15814 15815 7ff7887753ee GetProcAddress 15814->15815 15816 7ff7887753e2 15814->15816 15817 7ff78877540a 15815->15817 15818 7ff788775416 GetProcAddress 15815->15818 15816->15815 15817->15818 15819 7ff78877543e GetProcAddress 15818->15819 15820 7ff788775432 15818->15820 15821 7ff78877545a 15819->15821 15822 7ff788775466 GetProcAddress 15819->15822 15820->15819 15821->15822 15823 7ff78877548e GetProcAddress 15822->15823 15824 7ff788775482 15822->15824 15825 7ff7887754aa 15823->15825 15826 7ff7887754b6 GetProcAddress 15823->15826 15824->15823 15825->15826 15827 7ff7887754de GetProcAddress 15826->15827 15828 7ff7887754d2 15826->15828 15829 7ff7887754fa 15827->15829 15830 7ff788775506 GetProcAddress 15827->15830 15828->15827 15829->15830 15831 7ff78877552e GetProcAddress 15830->15831 15832 7ff788775522 15830->15832 15833 7ff78877554a 15831->15833 15834 7ff788775556 GetProcAddress 15831->15834 15832->15831 15833->15834 15835 7ff78877557e GetProcAddress 15834->15835 15836 7ff788775572 15834->15836 15837 7ff78877559a 15835->15837 15836->15835 15837->15363 15839 7ff788774e14 15838->15839 15840 7ff788771c50 43 API calls 15839->15840 15843 7ff788772a2a 15839->15843 15841 7ff788774e6e 15840->15841 15842 7ff7887749f0 FreeLibrary 15841->15842 15842->15843 15843->15343 15845 7ff788774a1d 15844->15845 15846 7ff788774a02 15844->15846 15845->15343 15846->15845 15847 7ff788774ae0 15846->15847 17415 7ff7887762f0 FreeLibrary 15846->17415 15847->15845 17416 7ff7887762f0 FreeLibrary 15847->17416 15851 7ff788771b55 15850->15851 15852 7ff788783c80 33 API calls 15851->15852 15853 7ff788771b78 15852->15853 15853->15362 15855 7ff788776140 15854->15855 15856 7ff788776db0 45 API calls 15855->15856 15857 7ff788776171 SetConsoleCtrlHandler GetStartupInfoW 15856->15857 15858 7ff7887761d2 15857->15858 15859 7ff7887892e4 _fread_nolock 30 API calls 15858->15859 15860 7ff7887761da 15859->15860 15861 7ff7887892e4 _fread_nolock 30 API calls 15860->15861 15862 7ff788776200 15861->15862 15863 7ff7887892e4 _fread_nolock 30 API calls 15862->15863 15864 7ff788776227 15863->15864 15865 7ff78877622e GetCommandLineW CreateProcessW 15864->15865 15866 7ff78877628a WaitForSingleObject GetExitCodeProcess 15865->15866 15867 7ff7887762b0 15865->15867 15868 7ff7887762c3 15866->15868 15869 7ff788771cb0 43 API calls 15867->15869 15870 7ff78877a100 _wfindfirst32i64 8 API calls 15868->15870 15869->15868 15871 7ff788772b60 15870->15871 15871->15377 15873 7ff788775e00 15872->15873 15874 7ff788776db0 45 API calls 15873->15874 15875 7ff788775e2b 15874->15875 15876 7ff78877604e 15875->15876 17417 7ff788776490 15875->17417 15877 7ff78877a100 _wfindfirst32i64 8 API calls 15876->15877 15879 7ff78877606b 15877->15879 15879->15378 15880 7ff788776046 17433 7ff788786b78 FindClose 15880->17433 15882 7ff788776490 59 API calls 15883 7ff788775f7e 15882->15883 15883->15880 15883->15882 15885 7ff788771ad8 __std_exception_destroy 15884->15885 15886 7ff788771ab5 __std_exception_destroy 15884->15886 15885->15382 15886->15885 15887 7ff78877e60c 55 API calls 15886->15887 15887->15885 15895 7ff788771d00 15888->15895 15896 7ff788771d10 15895->15896 15920 7ff788783c80 15896->15920 15900 7ff788771d70 15953 7ff788771b90 15900->15953 15903 7ff78877a100 _wfindfirst32i64 8 API calls 15904 7ff788771cd7 GetLastError 15903->15904 15905 7ff788776670 15904->15905 15906 7ff78877667c 15905->15906 15907 7ff78877669d FormatMessageW 15906->15907 15908 7ff788776697 GetLastError 15906->15908 15909 7ff7887766ec WideCharToMultiByte 15907->15909 15910 7ff7887766d0 15907->15910 15908->15907 15912 7ff788776726 15909->15912 15913 7ff7887766e3 15909->15913 15911 7ff788771cb0 40 API calls 15910->15911 15911->15913 15914 7ff788771cb0 40 API calls 15912->15914 15915 7ff78877a100 _wfindfirst32i64 8 API calls 15913->15915 15914->15913 15916 7ff788771ce4 15915->15916 15917 7ff788771be0 15916->15917 15918 7ff788771d00 43 API calls 15917->15918 15919 7ff788771c02 15918->15919 15919->15594 15921 7ff788783cda 15920->15921 15922 7ff788783cff 15921->15922 15924 7ff788783d3b 15921->15924 15923 7ff788789e44 _invalid_parameter_noinfo 30 API calls 15922->15923 15926 7ff788783d29 15923->15926 15957 7ff7887816c4 15924->15957 15929 7ff78877a100 _wfindfirst32i64 8 API calls 15926->15929 15927 7ff788783e18 15928 7ff788789f78 __free_lconv_mon 2 API calls 15927->15928 15928->15926 15930 7ff788771d58 15929->15930 15938 7ff788776bf0 MultiByteToWideChar 15930->15938 15932 7ff788783ded 15934 7ff788789f78 __free_lconv_mon 2 API calls 15932->15934 15933 7ff788783e3c 15933->15927 15936 7ff788783e46 15933->15936 15934->15926 15935 7ff788783de4 15935->15927 15935->15932 15937 7ff788789f78 __free_lconv_mon 2 API calls 15936->15937 15937->15926 15939 7ff788776c39 15938->15939 15940 7ff788776c53 15938->15940 15941 7ff788771cb0 39 API calls 15939->15941 15942 7ff788776c69 15940->15942 15943 7ff788776c83 MultiByteToWideChar 15940->15943 15952 7ff788776c4c __std_exception_destroy 15941->15952 15946 7ff788771cb0 39 API calls 15942->15946 15944 7ff788776ca6 15943->15944 15945 7ff788776cc0 WideCharToMultiByte 15943->15945 15947 7ff788771cb0 39 API calls 15944->15947 15948 7ff788776cf6 15945->15948 15950 7ff788776ced 15945->15950 15946->15952 15947->15952 15949 7ff788776d1b WideCharToMultiByte 15948->15949 15948->15950 15949->15950 15949->15952 15951 7ff788771cb0 39 API calls 15950->15951 15951->15952 15952->15900 15954 7ff788771bb6 15953->15954 16092 7ff788783b5c 15954->16092 15956 7ff788771bcc 15956->15903 15958 7ff788781702 15957->15958 15959 7ff7887816f2 15957->15959 15960 7ff78878170b 15958->15960 15964 7ff788781739 15958->15964 15961 7ff788789e44 _invalid_parameter_noinfo 30 API calls 15959->15961 15962 7ff788789e44 _invalid_parameter_noinfo 30 API calls 15960->15962 15963 7ff788781731 15961->15963 15962->15963 15963->15927 15963->15932 15963->15933 15963->15935 15964->15959 15964->15963 15966 7ff7887819e8 15964->15966 15970 7ff788782614 15964->15970 15996 7ff788781ea4 15964->15996 16026 7ff78878120c 15964->16026 15968 7ff788789e44 _invalid_parameter_noinfo 30 API calls 15966->15968 15968->15959 15971 7ff7887826c9 15970->15971 15972 7ff788782656 15970->15972 15975 7ff7887826ce 15971->15975 15976 7ff788782723 15971->15976 15973 7ff78878265c 15972->15973 15974 7ff7887826f3 15972->15974 15982 7ff788782661 15973->15982 15985 7ff788782732 15973->15985 16041 7ff788780150 15974->16041 15977 7ff788782703 15975->15977 15978 7ff7887826d0 15975->15978 15976->15974 15976->15985 15994 7ff78878268c 15976->15994 16048 7ff78877fd40 15977->16048 15979 7ff788782671 15978->15979 15984 7ff7887826df 15978->15984 15995 7ff788782761 15979->15995 16029 7ff788782f78 15979->16029 15982->15979 15986 7ff7887826a4 15982->15986 15982->15994 15984->15974 15988 7ff7887826e4 15984->15988 15985->15995 16055 7ff788780560 15985->16055 15986->15995 16033 7ff788783434 15986->16033 15988->15995 16037 7ff7887835cc 15988->16037 15990 7ff78877a100 _wfindfirst32i64 8 API calls 15992 7ff7887829f7 15990->15992 15992->15964 15994->15995 16062 7ff78878db60 15994->16062 15995->15990 15997 7ff788781ec5 15996->15997 15998 7ff788781eaf 15996->15998 15999 7ff788789e44 _invalid_parameter_noinfo 30 API calls 15997->15999 16000 7ff788781f03 15997->16000 15998->16000 16001 7ff7887826c9 15998->16001 16002 7ff788782656 15998->16002 15999->16000 16000->15964 16005 7ff7887826ce 16001->16005 16006 7ff788782723 16001->16006 16003 7ff78878265c 16002->16003 16004 7ff7887826f3 16002->16004 16013 7ff788782661 16003->16013 16016 7ff788782732 16003->16016 16010 7ff788780150 31 API calls 16004->16010 16007 7ff788782703 16005->16007 16008 7ff7887826d0 16005->16008 16006->16004 16006->16016 16024 7ff78878268c 16006->16024 16011 7ff78877fd40 31 API calls 16007->16011 16009 7ff788782671 16008->16009 16014 7ff7887826df 16008->16014 16012 7ff788782f78 4 API calls 16009->16012 16025 7ff788782761 16009->16025 16010->16024 16011->16024 16012->16024 16013->16009 16015 7ff7887826a4 16013->16015 16013->16024 16014->16004 16018 7ff7887826e4 16014->16018 16019 7ff788783434 32 API calls 16015->16019 16015->16025 16017 7ff788780560 31 API calls 16016->16017 16016->16025 16017->16024 16021 7ff7887835cc 30 API calls 16018->16021 16018->16025 16019->16024 16020 7ff78877a100 _wfindfirst32i64 8 API calls 16022 7ff7887829f7 16020->16022 16021->16024 16022->15964 16023 7ff78878db60 32 API calls 16023->16024 16024->16023 16024->16025 16025->16020 16081 7ff78877f314 16026->16081 16030 7ff788782f9a 16029->16030 16070 7ff78877f180 16030->16070 16032 7ff788782fe2 16032->15994 16034 7ff7887834b4 16033->16034 16035 7ff78878344c 16033->16035 16034->15994 16035->16034 16036 7ff78878db60 32 API calls 16035->16036 16036->16034 16039 7ff7887835ed 16037->16039 16038 7ff788789e44 _invalid_parameter_noinfo 30 API calls 16040 7ff78878361e 16038->16040 16039->16038 16039->16040 16040->15994 16042 7ff788780183 16041->16042 16043 7ff7887801b2 16042->16043 16045 7ff78878026f 16042->16045 16044 7ff78877f180 4 API calls 16043->16044 16047 7ff7887801ef 16043->16047 16044->16047 16046 7ff788789e44 _invalid_parameter_noinfo 30 API calls 16045->16046 16046->16047 16047->15994 16049 7ff78877fd73 16048->16049 16050 7ff78877fda2 16049->16050 16052 7ff78877fe5f 16049->16052 16051 7ff78877f180 4 API calls 16050->16051 16054 7ff78877fddf 16050->16054 16051->16054 16053 7ff788789e44 _invalid_parameter_noinfo 30 API calls 16052->16053 16053->16054 16054->15994 16056 7ff788780593 16055->16056 16057 7ff7887805c2 16056->16057 16060 7ff78878067f 16056->16060 16058 7ff7887805ff 16057->16058 16059 7ff78877f180 4 API calls 16057->16059 16058->15994 16059->16058 16061 7ff788789e44 _invalid_parameter_noinfo 30 API calls 16060->16061 16061->16058 16065 7ff78878db88 16062->16065 16063 7ff788789e44 _invalid_parameter_noinfo 30 API calls 16068 7ff78878db8d 16063->16068 16064 7ff78878dbb6 16064->16063 16064->16068 16065->16064 16065->16068 16078 7ff78878f138 16065->16078 16068->15994 16071 7ff78877f1b7 16070->16071 16077 7ff78877f1a6 16070->16077 16072 7ff78878cc2c _fread_nolock 2 API calls 16071->16072 16071->16077 16073 7ff78877f1e4 16072->16073 16074 7ff78877f1f8 16073->16074 16075 7ff788789f78 __free_lconv_mon 2 API calls 16073->16075 16076 7ff788789f78 __free_lconv_mon 2 API calls 16074->16076 16075->16074 16076->16077 16077->16032 16079 7ff78878f15c WideCharToMultiByte 16078->16079 16082 7ff78877f353 16081->16082 16083 7ff78877f341 16081->16083 16084 7ff78877f360 16082->16084 16088 7ff78877f39d 16082->16088 16085 7ff788789f10 _invalid_parameter_noinfo 30 API calls 16083->16085 16086 7ff788789e44 _invalid_parameter_noinfo 30 API calls 16084->16086 16089 7ff78877f351 16085->16089 16086->16089 16087 7ff78877f446 16087->16089 16090 7ff788789f10 _invalid_parameter_noinfo 30 API calls 16087->16090 16088->16087 16091 7ff788789f10 _invalid_parameter_noinfo 30 API calls 16088->16091 16089->15964 16090->16089 16091->16087 16094 7ff788783b86 16092->16094 16093 7ff788783bbe 16095 7ff788789e44 _invalid_parameter_noinfo 30 API calls 16093->16095 16094->16093 16096 7ff788783bf1 16094->16096 16098 7ff788783be7 16095->16098 16099 7ff78877f140 16096->16099 16098->15956 16104 7ff78878438c EnterCriticalSection 16099->16104 16112 7ff78878438c EnterCriticalSection 16105->16112 16114 7ff788771d00 43 API calls 16113->16114 16115 7ff788771c37 16114->16115 16118 7ff7887844e0 16115->16118 16119 7ff78878450b 16118->16119 16122 7ff7887843a4 16119->16122 16135 7ff788786d50 EnterCriticalSection 16122->16135 16137 7ff788772cdc GetModuleFileNameW 16136->16137 16137->15609 16137->15610 16139 7ff788776ee4 WideCharToMultiByte 16138->16139 16140 7ff788776f52 WideCharToMultiByte 16138->16140 16141 7ff788776f0e 16139->16141 16142 7ff788776f25 16139->16142 16143 7ff788772d35 16140->16143 16144 7ff788776f7f 16140->16144 16145 7ff788771cb0 43 API calls 16141->16145 16142->16140 16147 7ff788776f3b 16142->16147 16143->15614 16143->15615 16146 7ff788771cb0 43 API calls 16144->16146 16145->16143 16146->16143 16148 7ff788771cb0 43 API calls 16147->16148 16148->16143 16150 7ff788775b6e 16149->16150 16151 7ff788789283 16149->16151 16150->15634 16151->16150 16156 7ff78878930c 16151->16156 16154 7ff788789f30 _wfindfirst32i64 17 API calls 16155 7ff7887892e0 16154->16155 16157 7ff788789319 16156->16157 16158 7ff788789f10 _invalid_parameter_noinfo 30 API calls 16157->16158 16159 7ff7887892b0 16157->16159 16158->16159 16159->16150 16159->16154 16161 7ff7887717d4 16160->16161 16162 7ff7887717e4 16160->16162 16163 7ff788772de0 112 API calls 16161->16163 16164 7ff788776360 70 API calls 16162->16164 16192 7ff788771842 16162->16192 16163->16162 16165 7ff788771815 16164->16165 16165->16192 16194 7ff78877ec94 16165->16194 16167 7ff78877a100 _wfindfirst32i64 8 API calls 16169 7ff7887719c0 16167->16169 16168 7ff78877182b 16170 7ff78877184c 16168->16170 16171 7ff78877182f 16168->16171 16169->15649 16169->15650 16198 7ff78877e95c 16170->16198 16172 7ff788771c10 62 API calls 16171->16172 16172->16192 16175 7ff788771867 16177 7ff788771c10 62 API calls 16175->16177 16176 7ff78877ec94 54 API calls 16178 7ff7887718d1 16176->16178 16177->16192 16179 7ff7887718fe 16178->16179 16180 7ff7887718e3 16178->16180 16182 7ff78877e95c _fread_nolock 51 API calls 16179->16182 16181 7ff788771c10 62 API calls 16180->16181 16181->16192 16183 7ff788771913 16182->16183 16183->16175 16184 7ff788771925 16183->16184 16201 7ff78877e6d0 16184->16201 16187 7ff78877193d 16188 7ff788771c50 43 API calls 16187->16188 16188->16192 16189 7ff788771993 16190 7ff78877e60c 55 API calls 16189->16190 16189->16192 16190->16192 16191 7ff788771950 16191->16189 16193 7ff788771c50 43 API calls 16191->16193 16192->16167 16193->16189 16195 7ff78877ecc4 16194->16195 16205 7ff78877ea24 16195->16205 16197 7ff78877ecdd 16197->16168 16217 7ff78877e97c 16198->16217 16202 7ff788771939 16201->16202 16203 7ff78877e6d9 16201->16203 16202->16187 16202->16191 16204 7ff788789f10 _invalid_parameter_noinfo 30 API calls 16203->16204 16204->16202 16206 7ff78877ea8e 16205->16206 16207 7ff78877ea4e 16205->16207 16206->16207 16209 7ff78877ea9a 16206->16209 16208 7ff788789e44 _invalid_parameter_noinfo 30 API calls 16207->16208 16215 7ff78877ea75 16208->16215 16216 7ff78878438c EnterCriticalSection 16209->16216 16215->16197 16218 7ff78877e9a6 16217->16218 16227 7ff788771861 16217->16227 16219 7ff78877e9b5 16218->16219 16220 7ff78877e9f2 16218->16220 16218->16227 16224 7ff788789f10 _invalid_parameter_noinfo 30 API calls 16219->16224 16228 7ff78878438c EnterCriticalSection 16220->16228 16224->16227 16227->16175 16227->16176 16230 7ff788773ad0 16229->16230 16231 7ff788771b30 33 API calls 16230->16231 16232 7ff788773b02 16231->16232 16233 7ff788773b2b 16232->16233 16234 7ff788773b0b 16232->16234 16235 7ff788773b82 16233->16235 16330 7ff788772e60 16233->16330 16236 7ff788771c50 43 API calls 16234->16236 16238 7ff788772e60 33 API calls 16235->16238 16256 7ff788773b21 16236->16256 16243 7ff788773b9b 16238->16243 16239 7ff788773b4c 16240 7ff788773b6a 16239->16240 16246 7ff788771c50 43 API calls 16239->16246 16333 7ff788772d70 16240->16333 16241 7ff78877a100 _wfindfirst32i64 8 API calls 16248 7ff7887722de 16241->16248 16242 7ff788773bb9 16245 7ff788776310 46 API calls 16242->16245 16243->16242 16244 7ff788771c50 43 API calls 16243->16244 16244->16242 16249 7ff788773bc6 16245->16249 16246->16240 16248->15672 16257 7ff788773e40 16248->16257 16251 7ff788773bed 16249->16251 16252 7ff788773bcb 16249->16252 16343 7ff788772f20 GetProcAddress 16251->16343 16253 7ff788771cb0 43 API calls 16252->16253 16253->16256 16256->16241 16258 7ff788775af0 49 API calls 16257->16258 16261 7ff788773e55 16258->16261 16259 7ff788773e70 16260 7ff788776db0 45 API calls 16259->16260 16263 7ff788773eb4 16260->16263 16261->16259 16262 7ff788771c50 43 API calls 16261->16262 16262->16259 16264 7ff788773eb9 16263->16264 16265 7ff788773ed0 16263->16265 16266 7ff788771c50 43 API calls 16264->16266 16268 7ff788776db0 45 API calls 16265->16268 16267 7ff788773ec5 16266->16267 16267->15674 16269 7ff788773f05 16268->16269 16271 7ff788771b30 33 API calls 16269->16271 16283 7ff788773f0a __std_exception_destroy 16269->16283 16270 7ff788771c50 43 API calls 16272 7ff7887740b1 16270->16272 16273 7ff788773f87 16271->16273 16272->15674 16274 7ff788773f8e 16273->16274 16275 7ff788773fb3 16273->16275 16276 7ff788771c50 43 API calls 16274->16276 16277 7ff788776db0 45 API calls 16275->16277 16278 7ff788773fa3 16276->16278 16279 7ff788773fcc 16277->16279 16278->15674 16279->16283 16450 7ff788773c20 16279->16450 16283->16270 16284 7ff78877409a 16283->16284 16284->15674 16286 7ff788773857 16285->16286 16286->16286 16287 7ff788773880 16286->16287 16291 7ff788773897 __std_exception_destroy 16286->16291 16288 7ff788771c50 43 API calls 16287->16288 16289 7ff78877388c 16288->16289 16289->15676 16290 7ff78877397b 16290->15676 16291->16290 16292 7ff7887712b0 114 API calls 16291->16292 16293 7ff788771780 43 API calls 16291->16293 16294 7ff788771c50 43 API calls 16291->16294 16292->16291 16293->16291 16294->16291 16297 7ff788773aa7 16295->16297 16299 7ff7887739bb 16295->16299 16296 7ff788771780 43 API calls 16296->16299 16297->15678 16298 7ff788771c50 43 API calls 16298->16299 16299->16296 16299->16297 16299->16298 16301 7ff7887712f8 16300->16301 16302 7ff7887712c6 16300->16302 16304 7ff78877ec94 54 API calls 16301->16304 16303 7ff788772de0 112 API calls 16302->16303 16305 7ff7887712d6 16303->16305 16306 7ff78877130a 16304->16306 16305->16301 16307 7ff7887712de 16305->16307 16308 7ff78877130e 16306->16308 16309 7ff78877132f 16306->16309 16310 7ff788771c50 43 API calls 16307->16310 16311 7ff788771c10 62 API calls 16308->16311 16314 7ff788771364 16309->16314 16315 7ff788771344 16309->16315 16313 7ff7887712ee 16310->16313 16312 7ff788771325 16311->16312 16312->15689 16313->15689 16317 7ff78877137e 16314->16317 16321 7ff788771395 16314->16321 16316 7ff788771c10 62 API calls 16315->16316 16323 7ff78877135f __std_exception_destroy 16316->16323 16531 7ff788771050 16317->16531 16319 7ff788771421 16319->15689 16320 7ff78877e95c _fread_nolock 51 API calls 16320->16321 16321->16320 16321->16323 16324 7ff7887713de 16321->16324 16322 7ff78877e60c 55 API calls 16322->16319 16323->16319 16323->16322 16325 7ff788771c10 62 API calls 16324->16325 16325->16323 16327 7ff7887717a1 16326->16327 16328 7ff788771795 16326->16328 16327->15689 16329 7ff788771c50 43 API calls 16328->16329 16329->16327 16331 7ff788771b30 33 API calls 16330->16331 16332 7ff788772e90 16331->16332 16332->16239 16334 7ff788772d7a 16333->16334 16335 7ff788776db0 45 API calls 16334->16335 16336 7ff788772da2 16335->16336 16337 7ff78877a100 _wfindfirst32i64 8 API calls 16336->16337 16338 7ff788772dca 16337->16338 16338->16235 16339 7ff788776310 16338->16339 16340 7ff788776db0 45 API calls 16339->16340 16341 7ff788776327 LoadLibraryExW 16340->16341 16342 7ff788776344 __std_exception_destroy 16341->16342 16342->16235 16344 7ff788772f6b GetProcAddress 16343->16344 16345 7ff788772f48 16343->16345 16344->16345 16346 7ff788772f90 GetProcAddress 16344->16346 16347 7ff788771cb0 43 API calls 16345->16347 16346->16345 16348 7ff788772fb5 GetProcAddress 16346->16348 16350 7ff788772f5b 16347->16350 16348->16345 16349 7ff788772fdd GetProcAddress 16348->16349 16349->16345 16351 7ff788773005 GetProcAddress 16349->16351 16350->16256 16351->16345 16352 7ff78877302d GetProcAddress 16351->16352 16353 7ff788773049 16352->16353 16354 7ff788773055 GetProcAddress 16352->16354 16353->16354 16355 7ff78877307d GetProcAddress 16354->16355 16356 7ff788773071 16354->16356 16357 7ff788773099 16355->16357 16356->16355 16358 7ff7887730ad GetProcAddress 16357->16358 16359 7ff7887730d5 GetProcAddress 16357->16359 16358->16359 16360 7ff7887730c9 16358->16360 16361 7ff7887730fd GetProcAddress 16359->16361 16362 7ff7887730f1 16359->16362 16360->16359 16363 7ff788773119 16361->16363 16364 7ff788773125 GetProcAddress 16361->16364 16362->16361 16363->16364 16365 7ff78877314d GetProcAddress 16364->16365 16366 7ff788773141 16364->16366 16367 7ff788773169 16365->16367 16368 7ff788773175 GetProcAddress 16365->16368 16366->16365 16367->16368 16369 7ff78877319d GetProcAddress 16368->16369 16370 7ff788773191 16368->16370 16371 7ff7887731b9 16369->16371 16372 7ff7887731c5 GetProcAddress 16369->16372 16370->16369 16371->16372 16373 7ff7887731ed GetProcAddress 16372->16373 16374 7ff7887731e1 16372->16374 16375 7ff788773209 16373->16375 16376 7ff788773215 GetProcAddress 16373->16376 16374->16373 16375->16376 16377 7ff78877323d GetProcAddress 16376->16377 16378 7ff788773231 16376->16378 16379 7ff788773259 16377->16379 16380 7ff788773265 GetProcAddress 16377->16380 16378->16377 16379->16380 16381 7ff78877328d GetProcAddress 16380->16381 16382 7ff788773281 16380->16382 16383 7ff7887732a9 16381->16383 16384 7ff7887732b5 GetProcAddress 16381->16384 16382->16381 16383->16384 16385 7ff7887732dd GetProcAddress 16384->16385 16386 7ff7887732d1 16384->16386 16387 7ff7887732f9 16385->16387 16388 7ff788773305 GetProcAddress 16385->16388 16386->16385 16387->16388 16389 7ff78877332d GetProcAddress 16388->16389 16390 7ff788773321 16388->16390 16391 7ff788773349 16389->16391 16392 7ff788773355 GetProcAddress 16389->16392 16390->16389 16391->16392 16393 7ff78877337d GetProcAddress 16392->16393 16394 7ff788773371 16392->16394 16395 7ff788773399 16393->16395 16396 7ff7887733a5 GetProcAddress 16393->16396 16394->16393 16395->16396 16397 7ff7887733cd GetProcAddress 16396->16397 16398 7ff7887733c1 16396->16398 16399 7ff7887733e9 16397->16399 16400 7ff7887733f5 GetProcAddress 16397->16400 16398->16397 16399->16400 16401 7ff78877341d GetProcAddress 16400->16401 16402 7ff788773411 16400->16402 16403 7ff788773439 16401->16403 16404 7ff788773445 GetProcAddress 16401->16404 16402->16401 16403->16404 16405 7ff78877346d GetProcAddress 16404->16405 16406 7ff788773461 16404->16406 16407 7ff788773489 16405->16407 16408 7ff788773495 GetProcAddress 16405->16408 16406->16405 16407->16408 16409 7ff7887734bd GetProcAddress 16408->16409 16410 7ff7887734b1 16408->16410 16411 7ff7887734d9 16409->16411 16412 7ff7887734e5 GetProcAddress 16409->16412 16410->16409 16411->16412 16413 7ff78877350d GetProcAddress 16412->16413 16414 7ff788773501 16412->16414 16415 7ff788773529 16413->16415 16416 7ff788773535 GetProcAddress 16413->16416 16414->16413 16415->16416 16417 7ff78877355d GetProcAddress 16416->16417 16418 7ff788773551 16416->16418 16419 7ff788773579 16417->16419 16420 7ff788773585 GetProcAddress 16417->16420 16418->16417 16419->16420 16421 7ff7887735ad GetProcAddress 16420->16421 16422 7ff7887735a1 16420->16422 16423 7ff7887735c9 16421->16423 16424 7ff7887735d5 GetProcAddress 16421->16424 16422->16421 16423->16424 16425 7ff7887735fd GetProcAddress 16424->16425 16426 7ff7887735f1 16424->16426 16427 7ff788773619 16425->16427 16428 7ff788773625 GetProcAddress 16425->16428 16426->16425 16427->16428 16429 7ff78877364d GetProcAddress 16428->16429 16430 7ff788773641 16428->16430 16431 7ff788773669 16429->16431 16432 7ff788773675 GetProcAddress 16429->16432 16430->16429 16431->16432 16433 7ff78877369d GetProcAddress 16432->16433 16434 7ff788773691 16432->16434 16435 7ff7887736b9 16433->16435 16436 7ff7887736c5 GetProcAddress 16433->16436 16434->16433 16435->16436 16437 7ff7887736ed GetProcAddress 16436->16437 16438 7ff7887736e1 16436->16438 16439 7ff788773709 16437->16439 16440 7ff788773715 GetProcAddress 16437->16440 16438->16437 16439->16440 16441 7ff78877373d GetProcAddress 16440->16441 16442 7ff788773731 16440->16442 16443 7ff788773759 16441->16443 16444 7ff788773765 GetProcAddress 16441->16444 16442->16441 16443->16444 16445 7ff78877378d GetProcAddress 16444->16445 16446 7ff788773781 16444->16446 16447 7ff7887737a9 16445->16447 16448 7ff7887737b5 GetProcAddress 16445->16448 16446->16445 16447->16448 16449 7ff7887737d1 16448->16449 16449->16256 16457 7ff788773c3a 16450->16457 16451 7ff788773df1 16452 7ff78877a100 _wfindfirst32i64 8 API calls 16451->16452 16453 7ff788773e10 16452->16453 16473 7ff788776fb0 16453->16473 16454 7ff788771780 43 API calls 16454->16457 16456 7ff788773d53 16456->16451 16484 7ff7887892e4 16456->16484 16457->16451 16457->16454 16457->16456 16459 7ff788773e29 16457->16459 16480 7ff788785740 16457->16480 16460 7ff788771c50 43 API calls 16459->16460 16460->16451 16461 7ff788773d6a 16462 7ff7887892e4 _fread_nolock 30 API calls 16461->16462 16463 7ff788773d88 16462->16463 16488 7ff788785dd4 16463->16488 16465 7ff788773da6 16466 7ff788785dd4 52 API calls 16465->16466 16467 7ff788773db8 16466->16467 16468 7ff788784f7c 52 API calls 16467->16468 16469 7ff788773dc9 16468->16469 16470 7ff788784f7c 52 API calls 16469->16470 16471 7ff788773ddd 16470->16471 16472 7ff788784f7c 52 API calls 16471->16472 16472->16451 16475 7ff788776fcf 16473->16475 16474 7ff788777020 MultiByteToWideChar 16474->16475 16477 7ff7887770ad 16474->16477 16475->16474 16476 7ff788777068 MultiByteToWideChar 16475->16476 16475->16477 16479 7ff788776fd7 __std_exception_destroy 16475->16479 16476->16475 16476->16477 16478 7ff788771cb0 43 API calls 16477->16478 16478->16479 16479->16283 16481 7ff788785770 16480->16481 16494 7ff788785544 16481->16494 16483 7ff788785789 16483->16457 16485 7ff7887892fd 16484->16485 16486 7ff7887892ed 16484->16486 16485->16461 16487 7ff788789f10 _invalid_parameter_noinfo 30 API calls 16486->16487 16487->16485 16489 7ff788785de2 16488->16489 16491 7ff788785de9 16488->16491 16514 7ff788785c0c 16489->16514 16492 7ff788785de7 16491->16492 16517 7ff788785bcc 16491->16517 16492->16465 16495 7ff788785577 16494->16495 16496 7ff78878558c 16495->16496 16497 7ff7887855b9 16495->16497 16503 7ff78878557c 16495->16503 16498 7ff788789e44 _invalid_parameter_noinfo 30 API calls 16496->16498 16499 7ff7887855db 16497->16499 16501 7ff7887855ff 16497->16501 16498->16503 16504 7ff78878f5fc 16499->16504 16502 7ff788785660 GetLastError 16501->16502 16501->16503 16502->16503 16503->16483 16508 7ff78878f714 16504->16508 16509 7ff78878f62d 16504->16509 16505 7ff788796210 8 API calls 16505->16508 16507 7ff78878f6e9 16507->16503 16508->16505 16508->16507 16509->16507 16510 7ff788796210 16509->16510 16512 7ff788796274 16510->16512 16511 7ff78877a100 _wfindfirst32i64 8 API calls 16513 7ff7887963da 16511->16513 16512->16511 16513->16509 16524 7ff788785ae8 16514->16524 16530 7ff78878438c EnterCriticalSection 16517->16530 16529 7ff78878f808 EnterCriticalSection 16524->16529 16532 7ff7887710a6 16531->16532 16533 7ff7887710ad 16532->16533 16534 7ff7887710d3 16532->16534 16535 7ff788771c50 43 API calls 16533->16535 16537 7ff7887710ed 16534->16537 16538 7ff788771109 16534->16538 16536 7ff7887710c0 16535->16536 16536->16323 16539 7ff788771c10 62 API calls 16537->16539 16540 7ff78877111b 16538->16540 16548 7ff788771137 memcpy_s 16538->16548 16544 7ff788771104 __std_exception_destroy 16539->16544 16541 7ff788771c10 62 API calls 16540->16541 16541->16544 16542 7ff78877e95c _fread_nolock 51 API calls 16542->16548 16543 7ff78877e6d0 30 API calls 16543->16548 16544->16323 16545 7ff7887711fe 16546 7ff788771c50 43 API calls 16545->16546 16546->16544 16548->16542 16548->16543 16548->16544 16548->16545 16549 7ff78877f09c 16548->16549 16550 7ff78877f0cc 16549->16550 16553 7ff78877edec 16550->16553 16552 7ff78877f0ea 16552->16548 16554 7ff78877ee0c 16553->16554 16559 7ff78877ee39 16553->16559 16555 7ff78877ee16 16554->16555 16556 7ff78877ee41 16554->16556 16554->16559 16557 7ff788789e44 _invalid_parameter_noinfo 30 API calls 16555->16557 16560 7ff78877ed2c 16556->16560 16557->16559 16559->16552 16567 7ff78878438c EnterCriticalSection 16560->16567 16569 7ff788771dd6 16568->16569 16570 7ff788771b30 33 API calls 16569->16570 16572 7ff788771e0b 16570->16572 16571 7ff788772211 16572->16571 16573 7ff788772c50 33 API calls 16572->16573 16574 7ff788771e7f 16573->16574 16650 7ff788772230 16574->16650 16577 7ff788771efa 16578 7ff788772230 71 API calls 16577->16578 16579 7ff788771f4c 16578->16579 16582 7ff788771fb6 16579->16582 16588 7ff788771f50 16579->16588 16580 7ff788771eea 16583 7ff788771c50 43 API calls 16580->16583 16586 7ff788771ef3 16580->16586 16581 7ff788771ec1 16581->16580 16658 7ff788775760 16581->16658 16585 7ff788772230 71 API calls 16582->16585 16583->16586 16587 7ff788771fe2 16585->16587 16589 7ff78877a100 _wfindfirst32i64 8 API calls 16586->16589 16590 7ff788772230 71 API calls 16587->16590 16595 7ff788772042 16587->16595 16588->16580 16591 7ff788775760 132 API calls 16588->16591 16592 7ff788771fab 16589->16592 16593 7ff788772012 16590->16593 16594 7ff788771f75 16591->16594 16592->15703 16593->16595 16596 7ff788772230 71 API calls 16593->16596 16594->16580 16598 7ff7887721f6 16594->16598 16595->16571 16597 7ff788771af0 62 API calls 16595->16597 16610 7ff78877216f 16595->16610 16596->16595 16599 7ff7887720af 16597->16599 16600 7ff788771c50 43 API calls 16598->16600 16599->16571 16603 7ff788771b30 33 API calls 16599->16603 16601 7ff78877216a 16600->16601 16602 7ff788771ab0 55 API calls 16601->16602 16602->16571 16604 7ff7887720d7 16603->16604 16604->16598 16606 7ff788771b30 33 API calls 16604->16606 16605 7ff7887721db 16605->16598 16608 7ff788771440 132 API calls 16605->16608 16607 7ff788772104 16606->16607 16607->16598 16609 7ff788771b30 33 API calls 16607->16609 16608->16605 16611 7ff788772131 16609->16611 16610->16605 16612 7ff788771780 43 API calls 16610->16612 16611->16598 16613 7ff7887717b0 113 API calls 16611->16613 16612->16610 16614 7ff788772153 16613->16614 16614->16610 16615 7ff788772157 16614->16615 16616 7ff788771c50 43 API calls 16615->16616 16616->16601 16618 7ff788771454 16617->16618 16619 7ff788771459 16618->16619 16620 7ff788775ba0 130 API calls 16618->16620 16619->15703 16621 7ff78877147f 16620->16621 16622 7ff7887714a7 16621->16622 16623 7ff788771487 16621->16623 16625 7ff7887714e0 16622->16625 16627 7ff788772de0 112 API calls 16622->16627 16624 7ff788771c10 62 API calls 16623->16624 16626 7ff78877149d 16624->16626 16628 7ff78877ec94 54 API calls 16625->16628 16626->15703 16629 7ff7887714bf 16627->16629 16630 7ff7887714f2 16628->16630 16629->16625 16631 7ff7887714c7 16629->16631 16632 7ff788771516 16630->16632 16633 7ff7887714f6 16630->16633 16636 7ff788771c50 43 API calls 16631->16636 16634 7ff78877151c 16632->16634 16635 7ff788771534 16632->16635 16637 7ff788771c10 62 API calls 16633->16637 16638 7ff788771050 80 API calls 16634->16638 16639 7ff788771556 16635->16639 16648 7ff788771575 16635->16648 16644 7ff7887714d6 __std_exception_destroy 16636->16644 16637->16644 16638->16644 16642 7ff788771c10 62 API calls 16639->16642 16640 7ff788771624 16641 7ff78877e60c 55 API calls 16640->16641 16641->16626 16642->16644 16643 7ff78877e60c 55 API calls 16643->16640 16644->16640 16644->16643 16645 7ff78877e95c _fread_nolock 51 API calls 16645->16648 16646 7ff7887715d5 16649 7ff788771c10 62 API calls 16646->16649 16647 7ff78877f09c 57 API calls 16647->16648 16648->16644 16648->16645 16648->16646 16648->16647 16649->16644 16651 7ff788772264 16650->16651 16652 7ff788783c80 33 API calls 16651->16652 16653 7ff78877228a 16652->16653 16654 7ff78877229b 16653->16654 16682 7ff788784e70 16653->16682 16656 7ff78877a100 _wfindfirst32i64 8 API calls 16654->16656 16657 7ff788771ebd 16656->16657 16657->16577 16657->16581 16659 7ff78877576e 16658->16659 16660 7ff788772de0 112 API calls 16659->16660 16661 7ff788775795 16660->16661 16961 7ff788775ba0 16661->16961 16664 7ff788775853 16665 7ff78877584f 16664->16665 16668 7ff78877e60c 55 API calls 16664->16668 16669 7ff78877a100 _wfindfirst32i64 8 API calls 16665->16669 16666 7ff7887757bd 16986 7ff78877e6a4 16666->16986 16668->16665 16670 7ff788775875 16669->16670 16670->16580 16671 7ff78877e60c 55 API calls 16672 7ff788775847 16671->16672 16674 7ff78877e60c 55 API calls 16672->16674 16673 7ff78877e95c _fread_nolock 51 API calls 16675 7ff7887757c2 16673->16675 16674->16665 16675->16673 16676 7ff78877f09c 57 API calls 16675->16676 16677 7ff7887757f9 16675->16677 16678 7ff78877e6d0 30 API calls 16675->16678 16679 7ff78877e6a4 30 API calls 16675->16679 16681 7ff788775830 16675->16681 16676->16675 16990 7ff7887874ec 16677->16990 16678->16675 16679->16675 16681->16671 16683 7ff788784e8d 16682->16683 16684 7ff788784e99 16682->16684 16699 7ff7887846e8 16683->16699 16720 7ff788784a84 16684->16720 16687 7ff788784e92 16687->16654 16691 7ff788784ed1 16731 7ff78878456c 16691->16731 16692 7ff788784f29 16693 7ff788784f2d 16692->16693 16694 7ff788784f41 16692->16694 16693->16687 16696 7ff788789f78 __free_lconv_mon 2 API calls 16693->16696 16695 7ff7887846e8 67 API calls 16694->16695 16697 7ff788784f4d 16695->16697 16696->16687 16697->16687 16698 7ff788789f78 __free_lconv_mon 2 API calls 16697->16698 16698->16687 16700 7ff788784702 16699->16700 16701 7ff78878471f 16699->16701 16709 7ff788789f10 _invalid_parameter_noinfo 30 API calls 16700->16709 16701->16700 16702 7ff788784732 CreateFileW 16701->16702 16703 7ff78878479c 16702->16703 16704 7ff788784766 16702->16704 16769 7ff788784d60 16703->16769 16747 7ff78878483c GetFileType 16704->16747 16715 7ff78878471a 16709->16715 16710 7ff78878477b CloseHandle 16710->16715 16711 7ff788784791 CloseHandle 16711->16715 16712 7ff7887847a5 16779 7ff788785ffc 16712->16779 16713 7ff7887847d0 16784 7ff788784b20 16713->16784 16715->16687 16719 7ff7887847af 16719->16715 16721 7ff788784aa8 16720->16721 16727 7ff788784aa3 16720->16727 16721->16727 16895 7ff78878a780 GetLastError 16721->16895 16727->16691 16728 7ff78878e144 16727->16728 16952 7ff78878df30 16728->16952 16732 7ff7887845ba 16731->16732 16733 7ff788784596 16731->16733 16734 7ff7887845bf 16732->16734 16739 7ff788784614 16732->16739 16735 7ff788789f78 __free_lconv_mon 2 API calls 16733->16735 16743 7ff7887845a5 16733->16743 16736 7ff7887845d4 16734->16736 16737 7ff788789f78 __free_lconv_mon 2 API calls 16734->16737 16734->16743 16735->16743 16738 7ff78878cc2c _fread_nolock 2 API calls 16736->16738 16737->16736 16738->16743 16740 7ff788784637 GetLastError 16739->16740 16742 7ff788784665 16739->16742 16744 7ff788789f78 __free_lconv_mon 2 API calls 16739->16744 16746 7ff788784672 16739->16746 16741 7ff788785ffc _fread_nolock 10 API calls 16740->16741 16741->16743 16745 7ff78878cc2c _fread_nolock 2 API calls 16742->16745 16743->16692 16744->16742 16745->16746 16746->16740 16746->16743 16748 7ff788784947 16747->16748 16750 7ff78878488a 16747->16750 16751 7ff788784971 16748->16751 16752 7ff78878494f 16748->16752 16749 7ff7887848b6 GetFileInformationByHandle 16754 7ff788784962 GetLastError 16749->16754 16755 7ff7887848df 16749->16755 16750->16749 16753 7ff788784c5c 20 API calls 16750->16753 16756 7ff788784994 PeekNamedPipe 16751->16756 16768 7ff78878491a 16751->16768 16752->16754 16752->16768 16757 7ff7887848a4 16753->16757 16759 7ff788785ffc _fread_nolock 10 API calls 16754->16759 16758 7ff788784b20 44 API calls 16755->16758 16756->16768 16757->16749 16757->16768 16761 7ff7887848ea 16758->16761 16759->16768 16760 7ff78877a100 _wfindfirst32i64 8 API calls 16762 7ff788784774 16760->16762 16801 7ff7887849e4 16761->16801 16762->16710 16762->16711 16765 7ff7887849e4 10 API calls 16766 7ff788784909 16765->16766 16767 7ff7887849e4 10 API calls 16766->16767 16767->16768 16768->16760 16772 7ff788784d96 16769->16772 16770 7ff78877a100 _wfindfirst32i64 8 API calls 16771 7ff7887847a1 16770->16771 16771->16712 16771->16713 16778 7ff788784e2e __std_exception_destroy 16772->16778 16808 7ff7887853b8 16772->16808 16774 7ff788784dc5 16775 7ff7887853b8 43 API calls 16774->16775 16776 7ff788784dcd 16774->16776 16774->16778 16775->16776 16777 7ff788784e20 GetDriveTypeW 16776->16777 16776->16778 16777->16778 16778->16770 16853 7ff78878a8f8 GetLastError 16779->16853 16781 7ff788786009 __free_lconv_mon 16782 7ff78878a8f8 _fread_nolock 10 API calls 16781->16782 16783 7ff78878602b 16782->16783 16783->16719 16785 7ff788784b48 16784->16785 16793 7ff7887847dd 16785->16793 16870 7ff78878e6f4 16785->16870 16787 7ff788784bdc 16788 7ff78878e6f4 44 API calls 16787->16788 16787->16793 16789 7ff788784bef 16788->16789 16790 7ff78878e6f4 44 API calls 16789->16790 16789->16793 16791 7ff788784c02 16790->16791 16792 7ff78878e6f4 44 API calls 16791->16792 16791->16793 16792->16793 16794 7ff788784c5c 16793->16794 16795 7ff788784c76 16794->16795 16796 7ff788784cad 16795->16796 16797 7ff788784c86 16795->16797 16883 7ff78878e588 16796->16883 16799 7ff788785ffc _fread_nolock 10 API calls 16797->16799 16800 7ff788784c96 16797->16800 16799->16800 16800->16719 16802 7ff788784a0d FileTimeToSystemTime 16801->16802 16803 7ff788784a00 16801->16803 16804 7ff788784a21 SystemTimeToTzSpecificLocalTime 16802->16804 16805 7ff788784a08 16802->16805 16803->16802 16803->16805 16804->16805 16806 7ff78877a100 _wfindfirst32i64 8 API calls 16805->16806 16807 7ff7887848f9 16806->16807 16807->16765 16809 7ff7887853d4 16808->16809 16810 7ff788785442 16808->16810 16809->16810 16811 7ff7887853d9 16809->16811 16834 7ff78878f110 16810->16834 16813 7ff78878540e 16811->16813 16814 7ff7887853f1 16811->16814 16824 7ff7887851fc GetFullPathNameW 16813->16824 16820 7ff788785188 GetFullPathNameW 16814->16820 16817 7ff788785423 16830 7ff7887852d4 16817->16830 16819 7ff788785406 __std_exception_destroy 16819->16774 16821 7ff7887851ae GetLastError 16820->16821 16823 7ff7887851bb 16820->16823 16822 7ff788785ffc _fread_nolock 10 API calls 16821->16822 16822->16823 16823->16819 16825 7ff78878522f GetLastError 16824->16825 16828 7ff788785245 __std_exception_destroy 16824->16828 16826 7ff788785ffc _fread_nolock 10 API calls 16825->16826 16827 7ff78878523c 16826->16827 16827->16817 16828->16827 16829 7ff78878529f GetFullPathNameW 16828->16829 16829->16825 16829->16827 16831 7ff788785348 memcpy_s 16830->16831 16833 7ff7887852fd 16830->16833 16831->16819 16832 7ff788789f10 _invalid_parameter_noinfo 30 API calls 16832->16831 16833->16831 16833->16832 16837 7ff78878ef20 16834->16837 16838 7ff78878ef62 16837->16838 16845 7ff78878ef4b 16837->16845 16839 7ff78878e588 14 API calls 16838->16839 16840 7ff78878ef66 16838->16840 16839->16840 16842 7ff78878f031 16840->16842 16840->16845 16848 7ff78878efb3 16840->16848 16841 7ff788789f10 _invalid_parameter_noinfo 30 API calls 16852 7ff78878ef5b __std_exception_destroy 16841->16852 16843 7ff78878f039 16842->16843 16842->16845 16846 7ff788785188 12 API calls 16843->16846 16844 7ff78877a100 _wfindfirst32i64 8 API calls 16847 7ff78878f081 16844->16847 16845->16841 16846->16852 16847->16819 16849 7ff7887851fc 13 API calls 16848->16849 16850 7ff78878eff7 16849->16850 16851 7ff7887852d4 30 API calls 16850->16851 16850->16852 16851->16852 16852->16844 16854 7ff78878a939 FlsSetValue 16853->16854 16859 7ff78878a91c 16853->16859 16855 7ff78878a929 16854->16855 16856 7ff78878a94b 16854->16856 16857 7ff78878a9a5 SetLastError 16855->16857 16858 7ff78878deb8 _fread_nolock 2 API calls 16856->16858 16857->16781 16860 7ff78878a95a 16858->16860 16859->16854 16859->16855 16861 7ff78878a978 FlsSetValue 16860->16861 16862 7ff78878a968 FlsSetValue 16860->16862 16864 7ff78878a984 FlsSetValue 16861->16864 16865 7ff78878a996 16861->16865 16863 7ff78878a971 16862->16863 16866 7ff788789f78 __free_lconv_mon 2 API calls 16863->16866 16864->16863 16867 7ff78878a524 _invalid_parameter_noinfo 3 API calls 16865->16867 16866->16855 16868 7ff78878a99e 16867->16868 16869 7ff788789f78 __free_lconv_mon 2 API calls 16868->16869 16869->16857 16871 7ff78878e701 16870->16871 16872 7ff78878e725 16870->16872 16871->16872 16873 7ff78878e706 16871->16873 16874 7ff78878e75f 16872->16874 16875 7ff78878e77e 16872->16875 16877 7ff788789f10 _invalid_parameter_noinfo 30 API calls 16873->16877 16879 7ff788789f10 _invalid_parameter_noinfo 30 API calls 16874->16879 16876 7ff788784a84 26 API calls 16875->16876 16881 7ff78878e78b 16876->16881 16878 7ff78878e716 16877->16878 16878->16787 16880 7ff78878e76f 16879->16880 16880->16787 16881->16880 16882 7ff7887946c0 32 API calls 16881->16882 16882->16881 16884 7ff78877b880 16883->16884 16885 7ff78878e5be GetCurrentDirectoryW 16884->16885 16886 7ff78878e5d5 16885->16886 16887 7ff78878e5fc 16885->16887 16890 7ff78877a100 _wfindfirst32i64 8 API calls 16886->16890 16888 7ff78878deb8 _fread_nolock 2 API calls 16887->16888 16889 7ff78878e60b 16888->16889 16891 7ff78878e615 GetCurrentDirectoryW 16889->16891 16893 7ff78878e624 16889->16893 16892 7ff78878e669 16890->16892 16891->16893 16892->16800 16894 7ff788789f78 __free_lconv_mon 2 API calls 16893->16894 16894->16886 16896 7ff78878a7c1 FlsSetValue 16895->16896 16897 7ff78878a7a4 FlsGetValue 16895->16897 16899 7ff78878a7d3 16896->16899 16914 7ff78878a7b1 16896->16914 16898 7ff78878a7bb 16897->16898 16897->16914 16898->16896 16901 7ff78878deb8 _fread_nolock 2 API calls 16899->16901 16900 7ff78878a82d SetLastError 16903 7ff788784ac3 16900->16903 16904 7ff78878a84d 16900->16904 16902 7ff78878a7e2 16901->16902 16906 7ff78878a800 FlsSetValue 16902->16906 16907 7ff78878a7f0 FlsSetValue 16902->16907 16917 7ff78878cc8c 16903->16917 16925 7ff78878936c 16904->16925 16910 7ff78878a80c FlsSetValue 16906->16910 16911 7ff78878a81e 16906->16911 16909 7ff78878a7f9 16907->16909 16912 7ff788789f78 __free_lconv_mon 2 API calls 16909->16912 16910->16909 16913 7ff78878a524 _invalid_parameter_noinfo 3 API calls 16911->16913 16912->16914 16915 7ff78878a826 16913->16915 16914->16900 16916 7ff788789f78 __free_lconv_mon 2 API calls 16915->16916 16916->16900 16918 7ff78878cca1 16917->16918 16919 7ff788784ae6 16917->16919 16918->16919 16938 7ff7887924a4 16918->16938 16921 7ff78878ccf8 16919->16921 16922 7ff78878cd0d 16921->16922 16924 7ff78878cd20 16921->16924 16922->16924 16949 7ff788791810 16922->16949 16924->16727 16932 7ff7887927f0 16925->16932 16927 7ff788789375 16928 7ff7887893b7 __CxxCallCatchBlock 16927->16928 16929 7ff78878938d IsProcessorFeaturePresent 16927->16929 16930 7ff78878939c 16929->16930 16931 7ff788789c44 _wfindfirst32i64 14 API calls 16930->16931 16931->16928 16935 7ff7887927a8 16932->16935 16934 7ff788792819 16934->16927 16936 7ff78878f808 _isindst EnterCriticalSection 16935->16936 16937 7ff7887927c1 16936->16937 16937->16934 16939 7ff78878a780 26 API calls 16938->16939 16940 7ff7887924b3 16939->16940 16941 7ff7887924fe 16940->16941 16948 7ff78878f808 EnterCriticalSection 16940->16948 16941->16919 16950 7ff78878a780 26 API calls 16949->16950 16951 7ff788791819 16950->16951 16953 7ff78878df8d 16952->16953 16954 7ff78878df88 __vcrt_InitializeCriticalSectionEx 16952->16954 16953->16691 16954->16953 16955 7ff78878dfbd LoadLibraryExW 16954->16955 16956 7ff78878e0b2 GetProcAddress 16954->16956 16960 7ff78878e01c LoadLibraryExW 16954->16960 16957 7ff78878e092 16955->16957 16958 7ff78878dfe2 GetLastError 16955->16958 16956->16953 16957->16956 16959 7ff78878e0a9 FreeLibrary 16957->16959 16958->16954 16959->16956 16960->16954 16960->16957 16962 7ff788775bb0 16961->16962 16963 7ff788771b30 33 API calls 16962->16963 16964 7ff788775be1 16963->16964 16965 7ff788775dab 16964->16965 16966 7ff788771b30 33 API calls 16964->16966 16967 7ff78877a100 _wfindfirst32i64 8 API calls 16965->16967 16969 7ff788775c08 16966->16969 16968 7ff7887757a3 16967->16968 16968->16664 16968->16666 16969->16965 17007 7ff788785158 16969->17007 16971 7ff788775d19 16972 7ff788776db0 45 API calls 16971->16972 16973 7ff788775d31 16972->16973 16974 7ff788775dda 16973->16974 16976 7ff788775af0 49 API calls 16973->16976 16981 7ff788775d62 __std_exception_destroy 16973->16981 16975 7ff788772de0 112 API calls 16974->16975 16975->16965 16976->16981 16977 7ff788775dce 16980 7ff788771c50 43 API calls 16977->16980 16978 7ff788775d9f 16982 7ff788771c50 43 API calls 16978->16982 16979 7ff788775c3d 16979->16965 16979->16971 16983 7ff788785158 30 API calls 16979->16983 16984 7ff788776db0 45 API calls 16979->16984 17016 7ff788776a60 16979->17016 16980->16974 16981->16977 16981->16978 16982->16965 16983->16979 16984->16979 16987 7ff78877e6ad 16986->16987 16988 7ff78877e6bd 16986->16988 16989 7ff788789f10 _invalid_parameter_noinfo 30 API calls 16987->16989 16988->16675 16989->16988 16991 7ff7887874f4 16990->16991 16992 7ff788787531 16991->16992 16993 7ff788787510 16991->16993 17107 7ff78878438c EnterCriticalSection 16992->17107 16997 7ff788789f10 _invalid_parameter_noinfo 30 API calls 16993->16997 17003 7ff78878751f 16997->17003 17003->16681 17008 7ff78878a780 26 API calls 17007->17008 17010 7ff78878516d 17008->17010 17009 7ff78878ef17 17033 7ff78877a294 17009->17033 17010->17009 17015 7ff78878ee36 17010->17015 17013 7ff78877a100 _wfindfirst32i64 8 API calls 17014 7ff78878ef0f 17013->17014 17014->16979 17015->17013 17017 7ff78877a130 17016->17017 17018 7ff788776a70 GetCurrentProcess OpenProcessToken 17017->17018 17019 7ff788776abb GetTokenInformation 17018->17019 17020 7ff788776b31 __std_exception_destroy 17018->17020 17021 7ff788776add GetLastError 17019->17021 17022 7ff788776ae8 17019->17022 17023 7ff788776b4a 17020->17023 17024 7ff788776b44 CloseHandle 17020->17024 17021->17020 17021->17022 17022->17020 17025 7ff788776afe GetTokenInformation 17022->17025 17046 7ff788776760 17023->17046 17024->17023 17025->17020 17027 7ff788776b24 ConvertSidToStringSidW 17025->17027 17027->17020 17029 7ff788776bbe 17031 7ff78877a100 _wfindfirst32i64 8 API calls 17029->17031 17030 7ff788776ba6 CreateDirectoryW 17030->17029 17032 7ff788776bd3 17031->17032 17032->16979 17036 7ff78877a2a8 IsProcessorFeaturePresent 17033->17036 17037 7ff78877a2bf 17036->17037 17042 7ff78877a344 RtlCaptureContext RtlLookupFunctionEntry 17037->17042 17043 7ff78877a2d3 17042->17043 17044 7ff78877a374 RtlVirtualUnwind 17042->17044 17045 7ff78877a180 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 17043->17045 17044->17043 17047 7ff788776785 17046->17047 17050 7ff788783ed4 17047->17050 17051 7ff788783f2e 17050->17051 17052 7ff788783f53 17051->17052 17054 7ff788783f8f 17051->17054 17053 7ff788789e44 _invalid_parameter_noinfo 30 API calls 17052->17053 17056 7ff788783f7d 17053->17056 17068 7ff788781a44 17054->17068 17058 7ff78877a100 _wfindfirst32i64 8 API calls 17056->17058 17057 7ff788784070 17059 7ff788789f78 __free_lconv_mon 2 API calls 17057->17059 17060 7ff7887767a8 LocalFree ConvertStringSecurityDescriptorToSecurityDescriptorW 17058->17060 17059->17056 17060->17029 17060->17030 17062 7ff788784096 17062->17057 17064 7ff7887840a0 17062->17064 17063 7ff788784045 17065 7ff788789f78 __free_lconv_mon 2 API calls 17063->17065 17067 7ff788789f78 __free_lconv_mon 2 API calls 17064->17067 17065->17056 17066 7ff78878403c 17066->17057 17066->17063 17067->17056 17069 7ff788781a82 17068->17069 17070 7ff788781a72 17068->17070 17071 7ff788781a8b 17069->17071 17076 7ff788781ab9 17069->17076 17072 7ff788789e44 _invalid_parameter_noinfo 30 API calls 17070->17072 17073 7ff788789e44 _invalid_parameter_noinfo 30 API calls 17071->17073 17074 7ff788781ab1 17072->17074 17073->17074 17074->17057 17074->17062 17074->17063 17074->17066 17076->17070 17076->17074 17078 7ff788782a18 17076->17078 17104 7ff78878129c 17076->17104 17079 7ff788782acb 17078->17079 17080 7ff788782a5a 17078->17080 17081 7ff788782b24 17079->17081 17082 7ff788782ad0 17079->17082 17083 7ff788782af5 17080->17083 17084 7ff788782a60 17080->17084 17081->17083 17095 7ff788782b33 17081->17095 17102 7ff788782a8f 17081->17102 17085 7ff788782b05 17082->17085 17086 7ff788782ad2 17082->17086 17088 7ff788780354 31 API calls 17083->17088 17091 7ff788782a65 17084->17091 17084->17095 17089 7ff78877ff44 31 API calls 17085->17089 17087 7ff788782a74 17086->17087 17094 7ff788782ae1 17086->17094 17090 7ff7887831cc HeapFree GetLastError HeapAlloc EnterCriticalSection 17087->17090 17103 7ff788782b64 17087->17103 17088->17102 17089->17102 17090->17102 17091->17087 17093 7ff788782aa6 17091->17093 17091->17102 17092 7ff788780764 31 API calls 17092->17102 17097 7ff788783508 8 API calls 17093->17097 17093->17103 17094->17083 17096 7ff788782ae6 17094->17096 17095->17092 17095->17103 17100 7ff7887835cc 30 API calls 17096->17100 17096->17103 17097->17102 17098 7ff78877a100 _wfindfirst32i64 8 API calls 17099 7ff788782e5e 17098->17099 17099->17076 17100->17102 17101 7ff78878dd10 8 API calls 17101->17102 17102->17101 17102->17103 17103->17098 17105 7ff78877f5c8 30 API calls 17104->17105 17106 7ff7887812eb 17105->17106 17106->17076 17110 7ff78878546c 17108->17110 17109 7ff788785492 17112 7ff788789f10 _invalid_parameter_noinfo 30 API calls 17109->17112 17110->17109 17111 7ff7887854c5 17110->17111 17115 7ff7887854a2 17111->17115 17119 7ff78878a258 17111->17119 17112->17115 17115->15720 17130 7ff78878f808 EnterCriticalSection 17119->17130 17385 7ff788787acc 17384->17385 17388 7ff7887875a8 17385->17388 17387 7ff788787ae5 17387->15731 17389 7ff7887875c3 17388->17389 17390 7ff7887875f2 17388->17390 17391 7ff788789e44 _invalid_parameter_noinfo 30 API calls 17389->17391 17398 7ff78878438c EnterCriticalSection 17390->17398 17393 7ff7887875e3 17391->17393 17393->17387 17400 7ff78877e403 17399->17400 17402 7ff78877e431 17399->17402 17401 7ff788789e44 _invalid_parameter_noinfo 30 API calls 17400->17401 17403 7ff78877e423 17401->17403 17402->17403 17409 7ff78878438c EnterCriticalSection 17402->17409 17403->15735 17411 7ff7887716aa 17410->17411 17412 7ff788771666 17410->17412 17411->15751 17412->17411 17413 7ff788771c50 43 API calls 17412->17413 17414 7ff7887716be 17413->17414 17414->15751 17415->15847 17416->15845 17418 7ff78877649c 17417->17418 17421 7ff7887765d1 17418->17421 17422 7ff78877659f 17418->17422 17432 7ff7887765c5 17418->17432 17419 7ff78877a100 _wfindfirst32i64 8 API calls 17420 7ff7887765fd 17419->17420 17420->15883 17440 7ff7887870d4 DeleteFileW 17421->17440 17435 7ff7887769e0 FindFirstFileExW 17422->17435 17426 7ff7887765da Sleep 17428 7ff7887870d4 12 API calls 17426->17428 17428->17432 17429 7ff788776ec0 45 API calls 17430 7ff7887765bb 17429->17430 17431 7ff788775df0 58 API calls 17430->17431 17431->17432 17432->17419 17434 7ff788786b86 17433->17434 17434->15876 17436 7ff788776a1d FindClose 17435->17436 17437 7ff788776a30 17435->17437 17436->17437 17438 7ff78877a100 _wfindfirst32i64 8 API calls 17437->17438 17439 7ff7887765a4 17438->17439 17439->17429 17439->17432 17441 7ff7887765d6 17440->17441 17442 7ff7887870e2 GetLastError 17440->17442 17441->17426 17441->17432 17443 7ff788785ffc _fread_nolock 10 API calls 17442->17443 17443->17441 17445 7ff78878a780 26 API calls 17444->17445 17446 7ff788789241 17445->17446 17447 7ff78878936c __CxxCallCatchBlock 16 API calls 17446->17447 17448 7ff788789261 17447->17448 17449 7ff78878c898 17450 7ff7887892e4 _fread_nolock 30 API calls 17449->17450 17451 7ff78878c8bd 17450->17451 17452 7ff78878c8cd 17451->17452 17453 7ff78878c95e 17451->17453 17455 7ff78878c8eb 17452->17455 17458 7ff78878c909 17452->17458 17454 7ff78878c470 50 API calls 17453->17454 17457 7ff78878c8f9 17454->17457 17456 7ff78878c470 50 API calls 17455->17456 17456->17457 17458->17457 17460 7ff78878b810 17458->17460 17461 7ff78878b840 17460->17461 17464 7ff78878b644 17461->17464 17463 7ff78878b859 17463->17457 17465 7ff78878b66d 17464->17465 17466 7ff78878b69b 17464->17466 17465->17463 17467 7ff78878b6b4 17466->17467 17469 7ff78878b70b 17466->17469 17468 7ff788789e44 _invalid_parameter_noinfo 30 API calls 17467->17468 17468->17465 17475 7ff788786d50 EnterCriticalSection 17469->17475 17510 7ff788788bb0 17513 7ff788788b30 17510->17513 17518 7ff78878f808 EnterCriticalSection 17513->17518 18070 7ff78878132c 18071 7ff78878136d 18070->18071 18072 7ff78878135d 18070->18072 18086 7ff7887838a8 18071->18086 18075 7ff788789e44 _invalid_parameter_noinfo 30 API calls 18072->18075 18076 7ff7887813ad 18075->18076 18077 7ff788781383 18078 7ff788789e44 _invalid_parameter_noinfo 30 API calls 18077->18078 18078->18076 18079 7ff78878dea0 54 API calls 18080 7ff7887813b5 18079->18080 18080->18072 18080->18076 18080->18079 18081 7ff78878120c 30 API calls 18080->18081 18083 7ff788781665 18080->18083 18092 7ff7887821dc 18080->18092 18130 7ff788781d1c 18080->18130 18081->18080 18085 7ff788789e44 _invalid_parameter_noinfo 30 API calls 18083->18085 18085->18072 18087 7ff788781372 18086->18087 18088 7ff7887838bb 18086->18088 18087->18076 18087->18077 18087->18080 18089 7ff7887892e4 _fread_nolock 30 API calls 18088->18089 18090 7ff7887838c0 18089->18090 18090->18087 18091 7ff788789f10 _invalid_parameter_noinfo 30 API calls 18090->18091 18091->18087 18093 7ff78878227e 18092->18093 18094 7ff788782214 18092->18094 18097 7ff788782283 18093->18097 18098 7ff7887822d1 18093->18098 18095 7ff78878221a 18094->18095 18096 7ff7887822a5 18094->18096 18105 7ff78878221f 18095->18105 18109 7ff7887822e0 18095->18109 18101 7ff788780150 31 API calls 18096->18101 18099 7ff788782285 18097->18099 18100 7ff7887822b2 18097->18100 18098->18096 18098->18109 18116 7ff788782247 18098->18116 18102 7ff78878222f 18099->18102 18108 7ff788782294 18099->18108 18103 7ff78877fd40 31 API calls 18100->18103 18101->18116 18104 7ff788782f78 4 API calls 18102->18104 18129 7ff788782308 18102->18129 18103->18116 18104->18116 18105->18102 18106 7ff78878225f 18105->18106 18105->18116 18110 7ff788783434 32 API calls 18106->18110 18106->18129 18107 7ff788780560 31 API calls 18107->18116 18108->18096 18111 7ff788782299 18108->18111 18109->18107 18109->18129 18110->18116 18114 7ff7887835cc 30 API calls 18111->18114 18111->18129 18112 7ff78877a100 _wfindfirst32i64 8 API calls 18113 7ff7887825fa 18112->18113 18113->18080 18114->18116 18115 7ff78878240c 18121 7ff78878243a 18115->18121 18185 7ff788783a90 18115->18185 18116->18115 18116->18129 18172 7ff78878dea0 18116->18172 18119 7ff7887824b5 18120 7ff78878254f 18119->18120 18125 7ff7887824ce 18119->18125 18122 7ff788783a90 54 API calls 18120->18122 18128 7ff788782548 18120->18128 18121->18119 18123 7ff78878dea0 54 API calls 18121->18123 18122->18128 18123->18121 18124 7ff78878db60 32 API calls 18124->18125 18125->18124 18127 7ff788783a90 54 API calls 18125->18127 18125->18128 18126 7ff78878dea0 54 API calls 18126->18128 18127->18125 18128->18126 18128->18129 18129->18112 18131 7ff788781d3d 18130->18131 18132 7ff788781d27 18130->18132 18133 7ff788789e44 _invalid_parameter_noinfo 30 API calls 18131->18133 18136 7ff788781d7b 18131->18136 18134 7ff78878227e 18132->18134 18135 7ff788782214 18132->18135 18132->18136 18133->18136 18139 7ff788782283 18134->18139 18140 7ff7887822d1 18134->18140 18137 7ff78878221a 18135->18137 18138 7ff7887822a5 18135->18138 18136->18080 18147 7ff78878221f 18137->18147 18149 7ff7887822e0 18137->18149 18143 7ff788780150 31 API calls 18138->18143 18141 7ff788782285 18139->18141 18142 7ff7887822b2 18139->18142 18140->18138 18140->18149 18158 7ff788782247 18140->18158 18144 7ff78878222f 18141->18144 18151 7ff788782294 18141->18151 18145 7ff78877fd40 31 API calls 18142->18145 18143->18158 18146 7ff788782f78 4 API calls 18144->18146 18171 7ff788782308 18144->18171 18145->18158 18146->18158 18147->18144 18148 7ff78878225f 18147->18148 18147->18158 18152 7ff788783434 32 API calls 18148->18152 18148->18171 18150 7ff788780560 31 API calls 18149->18150 18149->18171 18150->18158 18151->18138 18153 7ff788782299 18151->18153 18152->18158 18156 7ff7887835cc 30 API calls 18153->18156 18153->18171 18154 7ff78877a100 _wfindfirst32i64 8 API calls 18155 7ff7887825fa 18154->18155 18155->18080 18156->18158 18157 7ff78878240c 18159 7ff788783a90 54 API calls 18157->18159 18163 7ff78878243a 18157->18163 18158->18157 18160 7ff78878dea0 54 API calls 18158->18160 18158->18171 18159->18163 18160->18158 18161 7ff7887824b5 18162 7ff78878254f 18161->18162 18167 7ff7887824ce 18161->18167 18164 7ff788783a90 54 API calls 18162->18164 18170 7ff788782548 18162->18170 18163->18161 18165 7ff78878dea0 54 API calls 18163->18165 18164->18170 18165->18163 18166 7ff78878db60 32 API calls 18166->18167 18167->18166 18169 7ff788783a90 54 API calls 18167->18169 18167->18170 18168 7ff78878dea0 54 API calls 18168->18170 18169->18167 18170->18168 18170->18171 18171->18154 18173 7ff78878deaa 18172->18173 18174 7ff78878ca0c 18172->18174 18173->18116 18175 7ff7887892e4 _fread_nolock 30 API calls 18174->18175 18177 7ff78878ca2b 18175->18177 18176 7ff78878ca6c 18178 7ff78878ca33 18176->18178 18180 7ff78878caad 18176->18180 18194 7ff78878cad8 18176->18194 18177->18176 18177->18178 18189 7ff78878c990 18177->18189 18178->18116 18205 7ff78878c898 18180->18205 18186 7ff788783ac3 18185->18186 18187 7ff788783b3c 18186->18187 18188 7ff78878dea0 54 API calls 18186->18188 18187->18121 18188->18186 18190 7ff78878c9a2 18189->18190 18191 7ff78878c9a6 18189->18191 18190->18176 18191->18190 18192 7ff78878c9c9 SetFilePointerEx 18191->18192 18192->18190 18193 7ff78878c9e3 GetFileSizeEx 18192->18193 18193->18190 18195 7ff78878caeb 18194->18195 18196 7ff78878caa1 18195->18196 18197 7ff7887892e4 _fread_nolock 30 API calls 18195->18197 18196->18180 18200 7ff788792b1c 18196->18200 18198 7ff78878cb07 18197->18198 18199 7ff788792abc _fread_nolock 30 API calls 18198->18199 18199->18196 18201 7ff78878deb8 _fread_nolock 2 API calls 18200->18201 18202 7ff788792b40 18201->18202 18203 7ff788789f78 __free_lconv_mon 2 API calls 18202->18203 18204 7ff788792b4b 18203->18204 18204->18180 18206 7ff7887892e4 _fread_nolock 30 API calls 18205->18206 18207 7ff78878c8bd 18206->18207 18208 7ff78878c8cd 18207->18208 18209 7ff78878c95e 18207->18209 18211 7ff78878c8eb 18208->18211 18214 7ff78878c909 18208->18214 18210 7ff78878c470 50 API calls 18209->18210 18213 7ff78878c8f9 18210->18213 18212 7ff78878c470 50 API calls 18211->18212 18212->18213 18213->18178 18214->18213 18215 7ff78878b810 34 API calls 18214->18215 18215->18213 18224 7ff788784330 18225 7ff78878433b 18224->18225 18233 7ff78878e4c4 18225->18233 18244 7ff78878f808 EnterCriticalSection 18233->18244 17476 7ff78878e95c 17477 7ff78878eb3e 17476->17477 17480 7ff78878e99e _isindst 17476->17480 17478 7ff78877a100 _wfindfirst32i64 8 API calls 17477->17478 17479 7ff78878eb69 17478->17479 17480->17477 17492 7ff788795434 17480->17492 17483 7ff78878ea59 _get_daylight 17484 7ff78878eb7a 17483->17484 17485 7ff78878ea6a 17483->17485 17486 7ff788789f30 _wfindfirst32i64 17 API calls 17484->17486 17499 7ff788794898 17485->17499 17488 7ff78878eb8e 17486->17488 17490 7ff78878ea7b 17490->17477 17503 7ff788795478 17490->17503 17493 7ff78878ea3c _get_daylight 17492->17493 17494 7ff788795443 17492->17494 17493->17483 17493->17484 17508 7ff78878f808 EnterCriticalSection 17494->17508 17500 7ff7887948a1 17499->17500 17501 7ff78878ea73 17499->17501 17502 7ff788789f10 _invalid_parameter_noinfo 30 API calls 17500->17502 17501->17484 17501->17490 17502->17501 17509 7ff78878f808 EnterCriticalSection 17503->17509 18541 7ff7887758e0 18542 7ff7887758f8 18541->18542 18543 7ff78877596b 18542->18543 18545 7ff788775af0 49 API calls 18542->18545 18544 7ff788775970 GetTempPathW GetCurrentProcessId 18543->18544 18608 7ff788776610 18544->18608 18547 7ff788775924 18545->18547 18578 7ff7887755e0 18547->18578 18549 7ff78877592f 18577 7ff788775964 __std_exception_destroy 18549->18577 18602 7ff788786818 18549->18602 18552 7ff78877594a __std_exception_destroy 18552->18544 18558 7ff788775958 18552->18558 18553 7ff78877a100 _wfindfirst32i64 8 API calls 18555 7ff788775ad8 18553->18555 18554 7ff788776a60 41 API calls 18557 7ff78877599e __std_exception_destroy 18554->18557 18556 7ff788775a46 18559 7ff788776ec0 45 API calls 18556->18559 18557->18554 18557->18556 18562 7ff7887759d1 18557->18562 18612 7ff7887874d0 18557->18612 18560 7ff788771c50 43 API calls 18558->18560 18561 7ff788775a57 __std_exception_destroy 18559->18561 18560->18577 18565 7ff788776db0 45 API calls 18561->18565 18561->18577 18563 7ff788776db0 45 API calls 18562->18563 18562->18577 18564 7ff7887759e7 18563->18564 18566 7ff7887759ec 18564->18566 18567 7ff788775a29 SetEnvironmentVariableW 18564->18567 18568 7ff788775a75 18565->18568 18569 7ff788776db0 45 API calls 18566->18569 18567->18577 18570 7ff788775aad SetEnvironmentVariableW 18568->18570 18571 7ff788775a7a 18568->18571 18572 7ff7887759fc 18569->18572 18570->18577 18573 7ff788776db0 45 API calls 18571->18573 18575 7ff788786818 31 API calls 18572->18575 18574 7ff788775a8a 18573->18574 18576 7ff788786818 31 API calls 18574->18576 18575->18577 18576->18577 18577->18553 18579 7ff7887755ec 18578->18579 18580 7ff788776db0 45 API calls 18579->18580 18581 7ff78877560e 18580->18581 18582 7ff788775629 ExpandEnvironmentStringsW 18581->18582 18583 7ff788775616 18581->18583 18585 7ff78877564f __std_exception_destroy 18582->18585 18584 7ff788771c50 43 API calls 18583->18584 18586 7ff788775622 18584->18586 18587 7ff788775653 18585->18587 18590 7ff788775666 18585->18590 18589 7ff78877a100 _wfindfirst32i64 8 API calls 18586->18589 18588 7ff788771c50 43 API calls 18587->18588 18588->18586 18591 7ff788775748 18589->18591 18592 7ff788775674 18590->18592 18593 7ff788775680 18590->18593 18591->18549 18615 7ff7887860a8 18592->18615 18595 7ff7887853b8 43 API calls 18593->18595 18596 7ff78877567e 18595->18596 18597 7ff78877569a 18596->18597 18600 7ff7887756ad 18596->18600 18598 7ff788771c50 43 API calls 18597->18598 18598->18586 18599 7ff788775722 CreateDirectoryW 18599->18586 18600->18599 18601 7ff7887756fc CreateDirectoryW 18600->18601 18601->18600 18603 7ff788786838 18602->18603 18604 7ff788786825 18602->18604 18622 7ff78878649c 18603->18622 18607 7ff788789f10 _invalid_parameter_noinfo 30 API calls 18604->18607 18606 7ff788786836 18606->18552 18607->18606 18609 7ff788776635 18608->18609 18610 7ff788783ed4 31 API calls 18609->18610 18611 7ff788776654 18610->18611 18611->18557 18628 7ff7887870fc 18612->18628 18616 7ff7887860c6 18615->18616 18619 7ff7887860f9 18615->18619 18617 7ff78878f9a4 _wfindfirst32i64 30 API calls 18616->18617 18616->18619 18618 7ff7887860f5 18617->18618 18618->18619 18620 7ff788789f30 _wfindfirst32i64 17 API calls 18618->18620 18619->18596 18621 7ff788786129 18620->18621 18627 7ff78878f808 EnterCriticalSection 18622->18627 18669 7ff788790718 18628->18669 18704 7ff788790490 18669->18704 18717 7ff78878f808 EnterCriticalSection 18704->18717 18294 7ff78877e574 18295 7ff78877e5a4 18294->18295 18298 7ff78877e464 18295->18298 18297 7ff78877e5bd 18299 7ff78877e4a4 18298->18299 18300 7ff78877e47f 18298->18300 18302 7ff78877e49f 18299->18302 18312 7ff788785c6c 18299->18312 18301 7ff788789e44 _invalid_parameter_noinfo 30 API calls 18300->18301 18301->18302 18302->18297 18305 7ff78878a3b8 2 API calls 18306 7ff78877e4c1 18305->18306 18307 7ff7887892e4 _fread_nolock 30 API calls 18306->18307 18308 7ff78877e4c9 18307->18308 18318 7ff78878a02c 18308->18318 18311 7ff788789f78 __free_lconv_mon 2 API calls 18311->18302 18313 7ff788785c92 18312->18313 18317 7ff78877e4b7 18312->18317 18314 7ff7887892e4 _fread_nolock 30 API calls 18313->18314 18313->18317 18315 7ff788785cb3 18314->18315 18316 7ff78878c470 50 API calls 18315->18316 18316->18317 18317->18305 18319 7ff78878a058 18318->18319 18324 7ff78877e4d3 18318->18324 18320 7ff78878a0bc 18319->18320 18322 7ff78878a088 18319->18322 18321 7ff788789e44 _invalid_parameter_noinfo 30 API calls 18320->18321 18321->18324 18325 7ff788789fb4 18322->18325 18324->18302 18324->18311 18332 7ff788786d50 EnterCriticalSection 18325->18332 17872 7ff78878a600 17873 7ff78878a61a 17872->17873 17874 7ff78878a605 17872->17874 17878 7ff78878a620 17874->17878 17879 7ff78878a662 17878->17879 17880 7ff78878a66a 17878->17880 17881 7ff788789f78 __free_lconv_mon 2 API calls 17879->17881 17882 7ff788789f78 __free_lconv_mon 2 API calls 17880->17882 17881->17880 17883 7ff78878a677 17882->17883 17884 7ff788789f78 __free_lconv_mon 2 API calls 17883->17884 17885 7ff78878a684 17884->17885 17886 7ff788789f78 __free_lconv_mon 2 API calls 17885->17886 17887 7ff78878a691 17886->17887 17888 7ff788789f78 __free_lconv_mon 2 API calls 17887->17888 17889 7ff78878a69e 17888->17889 17890 7ff788789f78 __free_lconv_mon 2 API calls 17889->17890 17891 7ff78878a6ab 17890->17891 17892 7ff788789f78 __free_lconv_mon 2 API calls 17891->17892 17893 7ff78878a6b8 17892->17893 17894 7ff788789f78 __free_lconv_mon 2 API calls 17893->17894 17895 7ff78878a6c5 17894->17895 17896 7ff788789f78 __free_lconv_mon 2 API calls 17895->17896 17897 7ff78878a6d5 17896->17897 17898 7ff788789f78 __free_lconv_mon 2 API calls 17897->17898 17899 7ff78878a6e5 17898->17899 17904 7ff78878a4c4 17899->17904 17914 7ff78878f808 EnterCriticalSection 17904->17914 19450 7ff788788c88 19455 7ff78878f808 EnterCriticalSection 19450->19455

                                                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                                                  Function 00007FF788794EA0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 110 7ff788794ea0-7ff788794edb call 7ff788794828 call 7ff788794830 call 7ff788794898 117 7ff788794ee1-7ff788794eec _get_daylight 110->117 118 7ff788795105-7ff788795151 call 7ff788789f30 call 7ff788794828 call 7ff788794830 call 7ff788794898 110->118 117->118 119 7ff788794ef2-7ff788794efc 117->119 145 7ff78879528f-7ff7887952fd call 7ff788789f30 call 7ff788790738 118->145 146 7ff788795157-7ff788795162 _get_daylight 118->146 121 7ff788794f1e-7ff788794f22 119->121 122 7ff788794efe-7ff788794f01 119->122 125 7ff788794f25-7ff788794f2d 121->125 124 7ff788794f04-7ff788794f0f 122->124 127 7ff788794f11-7ff788794f18 124->127 128 7ff788794f1a-7ff788794f1c 124->128 125->125 129 7ff788794f2f-7ff788794f42 call 7ff78878cc2c 125->129 127->124 127->128 128->121 131 7ff788794f4b-7ff788794f59 128->131 136 7ff788794f44-7ff788794f46 call 7ff788789f78 129->136 137 7ff788794f5a-7ff788794f66 call 7ff788789f78 129->137 136->131 144 7ff788794f6d-7ff788794f75 137->144 144->144 148 7ff788794f77-7ff788794f88 call 7ff78878f9a4 144->148 163 7ff7887952ff-7ff788795306 145->163 164 7ff78879530b-7ff78879530e 145->164 146->145 147 7ff788795168-7ff788795173 _get_daylight 146->147 147->145 151 7ff788795179-7ff78879519c call 7ff788789f78 GetTimeZoneInformation 147->151 148->118 158 7ff788794f8e-7ff788794fe4 call 7ff78877b880 * 4 call 7ff788794dbc 148->158 160 7ff7887951a2-7ff7887951c3 151->160 161 7ff788795264-7ff78879528e call 7ff788794820 call 7ff788794810 call 7ff788794818 151->161 219 7ff788794fe6-7ff788794fea 158->219 165 7ff7887951c5-7ff7887951cb 160->165 166 7ff7887951ce-7ff7887951d5 160->166 169 7ff78879539b-7ff78879539e 163->169 173 7ff788795310 164->173 174 7ff788795345-7ff788795358 call 7ff78878cc2c 164->174 165->166 170 7ff7887951d7-7ff7887951df 166->170 171 7ff7887951e9 166->171 180 7ff788795313 169->180 181 7ff7887953a4-7ff7887953ac call 7ff788794ea0 169->181 170->171 178 7ff7887951e1-7ff7887951e7 170->178 182 7ff7887951eb-7ff78879525f call 7ff78877b880 * 4 call 7ff788791cfc call 7ff7887953b4 * 2 171->182 173->180 192 7ff788795363-7ff78879537e call 7ff788790738 174->192 193 7ff78879535a 174->193 178->182 188 7ff788795318-7ff788795344 call 7ff788789f78 call 7ff78877a100 180->188 189 7ff788795313 call 7ff78879511c 180->189 181->188 182->161 189->188 212 7ff788795380-7ff788795383 192->212 213 7ff788795385-7ff788795397 call 7ff788789f78 192->213 199 7ff78879535c-7ff788795361 call 7ff788789f78 193->199 199->173 212->199 213->169 221 7ff788794ff0-7ff788794ff4 219->221 222 7ff788794fec 219->222 221->219 224 7ff788794ff6-7ff78879501b call 7ff788797ce4 221->224 222->221 230 7ff78879501e-7ff788795022 224->230 232 7ff788795031-7ff788795035 230->232 233 7ff788795024-7ff78879502f 230->233 232->230 233->232 234 7ff788795037-7ff78879503b 233->234 235 7ff7887950bc-7ff7887950c0 234->235 236 7ff78879503d-7ff788795065 call 7ff788797ce4 234->236 238 7ff7887950c2-7ff7887950c4 235->238 239 7ff7887950c7-7ff7887950d4 235->239 244 7ff788795083-7ff788795087 236->244 245 7ff788795067 236->245 238->239 240 7ff7887950ef-7ff7887950fe call 7ff788794820 call 7ff788794810 239->240 241 7ff7887950d6-7ff7887950ec call 7ff788794dbc 239->241 240->118 241->240 244->235 250 7ff788795089-7ff7887950a7 call 7ff788797ce4 244->250 248 7ff78879506a-7ff788795071 245->248 248->244 251 7ff788795073-7ff788795081 248->251 256 7ff7887950b3-7ff7887950ba 250->256 251->244 251->248 256->235 257 7ff7887950a9-7ff7887950ad 256->257 257->235 258 7ff7887950af 257->258 258->256
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF788794EE5
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788794838: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78879484C
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788789F78: HeapFree.KERNEL32(?,?,?,00007FF788791EC2,?,?,?,00007FF788791EFF,?,?,00000000,00007FF7887923C5,?,?,00000000,00007FF7887922F7), ref: 00007FF788789F8E
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788789F78: GetLastError.KERNEL32(?,?,?,00007FF788791EC2,?,?,?,00007FF788791EFF,?,?,00000000,00007FF7887923C5,?,?,00000000,00007FF7887922F7), ref: 00007FF788789F98
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788789F30: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF788789F0F,?,?,?,?,?,00007FF788781A40), ref: 00007FF788789F39
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788789F30: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF788789F0F,?,?,?,?,?,00007FF788781A40), ref: 00007FF788789F5E
                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF788794ED4
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788794898: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7887948AC
                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF78879514A
                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF78879515B
                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF78879516C
                                                                                                                                                                                                                                  • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7887953AC), ref: 00007FF788795193
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                                  • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                  • API String ID: 4070488512-239921721
                                                                                                                                                                                                                                  • Opcode ID: efd6bd86b0a9241ba49c40c51702d4a4216664c1cf6d90fa3e70e8402c69cba8
                                                                                                                                                                                                                                  • Instruction ID: 06864b94738b1f235a632702068a5f04d127175c8542b00ffb86ee308194361a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: efd6bd86b0a9241ba49c40c51702d4a4216664c1cf6d90fa3e70e8402c69cba8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 27D1C122A9829286E724BFB5D8905B9E771FF4C784FE44136EA0D47686DF3CE441C368
                                                                                                                                                                                                                                  Function 00007FF788795DEC Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 301 7ff788795dec-7ff788795e5f call 7ff788795b20 304 7ff788795e61-7ff788795e6a call 7ff788786068 301->304 305 7ff788795e79-7ff788795e83 call 7ff788786e60 301->305 310 7ff788795e6d-7ff788795e74 call 7ff788786088 304->310 311 7ff788795e85-7ff788795e9c call 7ff788786068 call 7ff788786088 305->311 312 7ff788795e9e-7ff788795f07 CreateFileW 305->312 325 7ff7887961ba-7ff7887961da 310->325 311->310 313 7ff788795f84-7ff788795f8f GetFileType 312->313 314 7ff788795f09-7ff788795f0f 312->314 320 7ff788795f91-7ff788795fcc GetLastError call 7ff788785ffc CloseHandle 313->320 321 7ff788795fe2-7ff788795fe9 313->321 317 7ff788795f51-7ff788795f7f GetLastError call 7ff788785ffc 314->317 318 7ff788795f11-7ff788795f15 314->318 317->310 318->317 323 7ff788795f17-7ff788795f4f CreateFileW 318->323 320->310 336 7ff788795fd2-7ff788795fdd call 7ff788786088 320->336 328 7ff788795ff1-7ff788795ff4 321->328 329 7ff788795feb-7ff788795fef 321->329 323->313 323->317 330 7ff788795ff6 328->330 331 7ff788795ffa-7ff78879604f call 7ff788786d78 328->331 329->331 330->331 339 7ff788796051-7ff78879605d call 7ff788795d28 331->339 340 7ff78879606e-7ff78879609f call 7ff7887958a0 331->340 336->310 339->340 346 7ff78879605f 339->346 347 7ff7887960a1-7ff7887960a3 340->347 348 7ff7887960a5-7ff7887960e7 340->348 351 7ff788796061-7ff788796069 call 7ff78878a0f0 346->351 347->351 349 7ff788796109-7ff788796114 348->349 350 7ff7887960e9-7ff7887960ed 348->350 353 7ff7887961b8 349->353 354 7ff78879611a-7ff78879611e 349->354 350->349 352 7ff7887960ef-7ff788796104 350->352 351->325 352->349 353->325 354->353 356 7ff788796124-7ff788796169 CloseHandle CreateFileW 354->356 358 7ff78879616b-7ff788796199 GetLastError call 7ff788785ffc call 7ff788786fa0 356->358 359 7ff78879619e-7ff7887961b3 356->359 358->359 359->353
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1617910340-0
                                                                                                                                                                                                                                  • Opcode ID: 52a4378cdb78c32285671ba8c66096e739a338fe2dbd84037285ee5c330aca07
                                                                                                                                                                                                                                  • Instruction ID: 0a02657588f10ec07e75d1fe71a8dd0d2c3d11126ca9e83330320f104238c341
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 52a4378cdb78c32285671ba8c66096e739a338fe2dbd84037285ee5c330aca07
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0DC1C232B68A4285EB10DFB8C8915ACB771FB48B98FA10325DA2E5B795DF3CE055C314
                                                                                                                                                                                                                                  Function 00007FF78879511C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 743 7ff78879511c-7ff788795151 call 7ff788794828 call 7ff788794830 call 7ff788794898 750 7ff78879528f-7ff7887952fd call 7ff788789f30 call 7ff788790738 743->750 751 7ff788795157-7ff788795162 _get_daylight 743->751 763 7ff7887952ff-7ff788795306 750->763 764 7ff78879530b-7ff78879530e 750->764 751->750 752 7ff788795168-7ff788795173 _get_daylight 751->752 752->750 755 7ff788795179-7ff78879519c call 7ff788789f78 GetTimeZoneInformation 752->755 761 7ff7887951a2-7ff7887951c3 755->761 762 7ff788795264-7ff78879528e call 7ff788794820 call 7ff788794810 call 7ff788794818 755->762 765 7ff7887951c5-7ff7887951cb 761->765 766 7ff7887951ce-7ff7887951d5 761->766 768 7ff78879539b-7ff78879539e 763->768 772 7ff788795310 764->772 773 7ff788795345-7ff788795358 call 7ff78878cc2c 764->773 765->766 769 7ff7887951d7-7ff7887951df 766->769 770 7ff7887951e9 766->770 777 7ff788795313 768->777 778 7ff7887953a4-7ff7887953ac call 7ff788794ea0 768->778 769->770 775 7ff7887951e1-7ff7887951e7 769->775 779 7ff7887951eb-7ff78879525f call 7ff78877b880 * 4 call 7ff788791cfc call 7ff7887953b4 * 2 770->779 772->777 787 7ff788795363-7ff78879537e call 7ff788790738 773->787 788 7ff78879535a 773->788 775->779 784 7ff788795318-7ff788795344 call 7ff788789f78 call 7ff78877a100 777->784 785 7ff788795313 call 7ff78879511c 777->785 778->784 779->762 785->784 804 7ff788795380-7ff788795383 787->804 805 7ff788795385-7ff788795397 call 7ff788789f78 787->805 793 7ff78879535c-7ff788795361 call 7ff788789f78 788->793 793->772 804->793 805->768
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF78879514A
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788794898: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7887948AC
                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF78879515B
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788794838: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78879484C
                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF78879516C
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788794868: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78879487C
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788789F78: HeapFree.KERNEL32(?,?,?,00007FF788791EC2,?,?,?,00007FF788791EFF,?,?,00000000,00007FF7887923C5,?,?,00000000,00007FF7887922F7), ref: 00007FF788789F8E
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788789F78: GetLastError.KERNEL32(?,?,?,00007FF788791EC2,?,?,?,00007FF788791EFF,?,?,00000000,00007FF7887923C5,?,?,00000000,00007FF7887922F7), ref: 00007FF788789F98
                                                                                                                                                                                                                                  • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7887953AC), ref: 00007FF788795193
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                                  • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                  • API String ID: 3458911817-239921721
                                                                                                                                                                                                                                  • Opcode ID: 7e198542f45e47f797bfdedd3dcdeb77a56801e9e6762daf8462a5b391b5a0a3
                                                                                                                                                                                                                                  • Instruction ID: ce6f3861426675179223b125059aecda14246e08625bd5edf74d603a14e756fa
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7e198542f45e47f797bfdedd3dcdeb77a56801e9e6762daf8462a5b391b5a0a3
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C0518B32A9868286E710FFB1E8805A9E771BB5C784FA04136EA4D43796DF3CE440C768
                                                                                                                                                                                                                                  Function 00007FF7887717B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _fread_nolock$_invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                                                                                                                                                                                                                  • API String ID: 3405171723-4158440160
                                                                                                                                                                                                                                  • Opcode ID: 3be0a05a6a146284022477d506af850cce134aaf41d26f3dbf09e76eb624e4ef
                                                                                                                                                                                                                                  • Instruction ID: eb7087569641941b5b3e19d6ed2dc5c073145162d75ce73e6e58eb6693eae9cc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3be0a05a6a146284022477d506af850cce134aaf41d26f3dbf09e76eb624e4ef
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 15517C72A4960286EB54FFA4D490278F3B0FB5CB58BA18135DA0D87399DF3CE441CB68
                                                                                                                                                                                                                                  Function 00007FF7887712B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                  • API String ID: 0-3659356012
                                                                                                                                                                                                                                  • Opcode ID: a47acfe53d5c3275ed8562c98a931b77cdc59a940d9d4ebdee28d468d9ce5435
                                                                                                                                                                                                                                  • Instruction ID: 924fa46cd3ce181b95145d76cc7868bdc15a371cb41df9c70e6dee3ef83b7f9d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a47acfe53d5c3275ed8562c98a931b77cdc59a940d9d4ebdee28d468d9ce5435
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BF418F22B8964281EA14FB91E8416B9E3B0FB487D4FE44432DE4D87B55EF3CE542C328
                                                                                                                                                                                                                                  Function 00007FF788771000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 274COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 427 7ff788771000-7ff7887727b6 call 7ff78877e3e0 call 7ff78877e3d8 call 7ff7887767c0 call 7ff78877a130 call 7ff788784310 call 7ff788784f7c call 7ff788771af0 443 7ff7887727bc-7ff7887727cb call 7ff788772cd0 427->443 444 7ff7887728ca 427->444 443->444 449 7ff7887727d1-7ff7887727e4 call 7ff788772ba0 443->449 446 7ff7887728cf-7ff7887728ef call 7ff78877a100 444->446 449->444 453 7ff7887727ea-7ff7887727fd call 7ff788772c50 449->453 453->444 456 7ff788772803-7ff78877282a call 7ff788775af0 453->456 459 7ff78877286c-7ff788772894 call 7ff7887760f0 call 7ff7887719d0 456->459 460 7ff78877282c-7ff78877283b call 7ff788775af0 456->460 471 7ff78877297d-7ff78877298e 459->471 472 7ff78877289a-7ff7887728b0 call 7ff7887719d0 459->472 460->459 466 7ff78877283d-7ff788772843 460->466 468 7ff788772845-7ff78877284d 466->468 469 7ff78877284f-7ff788772869 call 7ff788784138 call 7ff7887760f0 466->469 468->469 469->459 474 7ff7887729a3-7ff7887729bb call 7ff788776db0 471->474 475 7ff788772990-7ff78877299a call 7ff7887724a0 471->475 484 7ff7887728b2-7ff7887728c5 call 7ff788771c50 472->484 485 7ff7887728f0-7ff7887728f3 472->485 489 7ff7887729bd-7ff7887729c9 call 7ff788771c50 474->489 490 7ff7887729ce-7ff7887729d5 SetDllDirectoryW 474->490 487 7ff7887729db-7ff7887729e8 call 7ff788774fa0 475->487 488 7ff78877299c 475->488 484->444 485->471 486 7ff7887728f9-7ff788772910 call 7ff788772de0 485->486 500 7ff788772917-7ff788772943 call 7ff788776360 486->500 501 7ff788772912-7ff788772915 486->501 498 7ff7887729ea-7ff7887729fa call 7ff788774c40 487->498 499 7ff788772a36-7ff788772a3b call 7ff788774f20 487->499 488->474 489->444 490->487 498->499 513 7ff7887729fc-7ff788772a0b call 7ff7887747a0 498->513 506 7ff788772a40-7ff788772a43 499->506 514 7ff78877296d-7ff78877297b 500->514 515 7ff788772945-7ff78877294d call 7ff78877e60c 500->515 504 7ff788772952-7ff788772968 call 7ff788771c50 501->504 504->444 511 7ff788772a49-7ff788772a56 506->511 512 7ff788772af6-7ff788772afe call 7ff788772330 506->512 516 7ff788772a60-7ff788772a6a 511->516 523 7ff788772b03-7ff788772b05 512->523 527 7ff788772a0d-7ff788772a19 call 7ff788774730 513->527 528 7ff788772a2c-7ff788772a31 call 7ff7887749f0 513->528 514->475 515->504 520 7ff788772a6c-7ff788772a71 516->520 521 7ff788772a73-7ff788772a75 516->521 520->516 520->521 525 7ff788772a77-7ff788772a9a call 7ff788771b30 521->525 526 7ff788772ac1-7ff788772acc call 7ff788772490 call 7ff7887722d0 521->526 523->444 529 7ff788772b0b-7ff788772b42 call 7ff788776080 call 7ff788775af0 call 7ff788774540 523->529 525->444 539 7ff788772aa0-7ff788772aab 525->539 546 7ff788772ad1-7ff788772af1 call 7ff788772480 call 7ff7887749f0 call 7ff788774f20 526->546 527->528 540 7ff788772a1b-7ff788772a2a call 7ff788774df0 527->540 528->499 529->444 552 7ff788772b48-7ff788772b7d call 7ff788772490 call 7ff788776130 call 7ff7887749f0 call 7ff788774f20 529->552 543 7ff788772ab0-7ff788772abf 539->543 540->506 543->526 543->543 546->446 565 7ff788772b87-7ff788772b91 call 7ff788771ab0 552->565 566 7ff788772b7f-7ff788772b82 call 7ff788775df0 552->566 565->446 566->565
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788772CD0: GetModuleFileNameW.KERNEL32(?,00007FF7887727C9,?,?,?,?,?,?), ref: 00007FF788772D01
                                                                                                                                                                                                                                  • SetDllDirectoryW.KERNEL32 ref: 00007FF7887729D5
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788775AF0: GetEnvironmentVariableW.KERNEL32(00007FF788772817,?,?,?,?,?,?), ref: 00007FF788775B2A
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788775AF0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF788775B47
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
                                                                                                                                                                                                                                  • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                                                                                                                                                                                  • API String ID: 2344891160-3602715111
                                                                                                                                                                                                                                  • Opcode ID: 803f2701319f7643a3910e49abf785d1810e6245a7014e2bf220fcd699411652
                                                                                                                                                                                                                                  • Instruction ID: 3fbe6bd7377509fe40c208ccf1ed25806e4ac57aeab84a11bb45177a587d28da
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 803f2701319f7643a3910e49abf785d1810e6245a7014e2bf220fcd699411652
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C9C19621AAC68341FA24BBA195502FDD3B1FF5C784FE44031EA5E4769AEF2CE505C728
                                                                                                                                                                                                                                  Function 00007FF788771050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 570 7ff788771050-7ff7887710ab call 7ff788779990 573 7ff7887710ad-7ff7887710d2 call 7ff788771c50 570->573 574 7ff7887710d3-7ff7887710eb call 7ff78878414c 570->574 579 7ff7887710ed-7ff788771104 call 7ff788771c10 574->579 580 7ff788771109-7ff788771119 call 7ff78878414c 574->580 585 7ff78877126c-7ff7887712a0 call 7ff788779670 call 7ff788784138 * 2 579->585 586 7ff78877111b-7ff788771132 call 7ff788771c10 580->586 587 7ff788771137-7ff788771147 580->587 586->585 588 7ff788771150-7ff78877116d call 7ff78877e95c 587->588 594 7ff788771172-7ff788771175 588->594 596 7ff78877125e 594->596 597 7ff78877117b-7ff788771185 call 7ff78877e6d0 594->597 599 7ff788771264 596->599 597->596 604 7ff78877118b-7ff788771197 597->604 599->585 605 7ff7887711a0-7ff7887711c8 call 7ff788777de0 604->605 608 7ff7887711ca-7ff7887711cd 605->608 609 7ff788771241-7ff78877125c call 7ff788771c50 605->609 611 7ff78877123c 608->611 612 7ff7887711cf-7ff7887711d9 608->612 609->599 611->609 614 7ff7887711db-7ff7887711f0 call 7ff78877f09c 612->614 615 7ff788771203-7ff788771206 612->615 622 7ff7887711fe-7ff788771201 614->622 623 7ff7887711f2-7ff7887711fc call 7ff78877e6d0 614->623 616 7ff788771219-7ff78877121e 615->616 617 7ff788771208-7ff788771216 call 7ff78877aec0 615->617 616->605 621 7ff788771220-7ff788771223 616->621 617->616 625 7ff788771237-7ff78877123a 621->625 626 7ff788771225-7ff788771228 621->626 622->609 623->616 623->622 625->599 626->609 628 7ff78877122a-7ff788771232 626->628 628->588
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                                  • API String ID: 0-1655038675
                                                                                                                                                                                                                                  • Opcode ID: 2b09f6334a8bfda232a9d87c2ffbb95a37d11d00bf3c57212093748cc921ba53
                                                                                                                                                                                                                                  • Instruction ID: 72f63e3cbf160c4b51c14696116fa26c1c6972fe8ef93c15f182e0a28c65607e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2b09f6334a8bfda232a9d87c2ffbb95a37d11d00bf3c57212093748cc921ba53
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2351C422B8964281EA60FB91D8403B9E2B1FB89794FE44131DD4DC7795EF3CE545C728
                                                                                                                                                                                                                                  Function 00007FF78878B08C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 630 7ff78878b08c-7ff78878b0b2 631 7ff78878b0b4-7ff78878b0c8 call 7ff788786068 call 7ff788786088 630->631 632 7ff78878b0cd-7ff78878b0d1 630->632 648 7ff78878b4be 631->648 634 7ff78878b4a7-7ff78878b4b3 call 7ff788786068 call 7ff788786088 632->634 635 7ff78878b0d7-7ff78878b0de 632->635 654 7ff78878b4b9 call 7ff788789f10 634->654 635->634 637 7ff78878b0e4-7ff78878b112 635->637 637->634 640 7ff78878b118-7ff78878b11f 637->640 643 7ff78878b121-7ff78878b133 call 7ff788786068 call 7ff788786088 640->643 644 7ff78878b138-7ff78878b13b 640->644 643->654 646 7ff78878b141-7ff78878b147 644->646 647 7ff78878b4a3-7ff78878b4a5 644->647 646->647 652 7ff78878b14d-7ff78878b150 646->652 651 7ff78878b4c1-7ff78878b4d8 647->651 648->651 652->643 655 7ff78878b152-7ff78878b177 652->655 654->648 658 7ff78878b179-7ff78878b17b 655->658 659 7ff78878b1aa-7ff78878b1b1 655->659 661 7ff78878b1a2-7ff78878b1a8 658->661 662 7ff78878b17d-7ff78878b184 658->662 663 7ff78878b1b3-7ff78878b1db call 7ff78878cc2c call 7ff788789f78 * 2 659->663 664 7ff78878b186-7ff78878b19d call 7ff788786068 call 7ff788786088 call 7ff788789f10 659->664 667 7ff78878b228-7ff78878b23f 661->667 662->661 662->664 691 7ff78878b1f8-7ff78878b223 call 7ff78878b8b4 663->691 692 7ff78878b1dd-7ff78878b1f3 call 7ff788786088 call 7ff788786068 663->692 695 7ff78878b330 664->695 670 7ff78878b241-7ff78878b249 667->670 671 7ff78878b2ba-7ff78878b2c4 call 7ff788792abc 667->671 670->671 672 7ff78878b24b-7ff78878b24d 670->672 683 7ff78878b2ca-7ff78878b2df 671->683 684 7ff78878b34e 671->684 672->671 676 7ff78878b24f-7ff78878b265 672->676 676->671 680 7ff78878b267-7ff78878b273 676->680 680->671 685 7ff78878b275-7ff78878b277 680->685 683->684 689 7ff78878b2e1-7ff78878b2f3 GetConsoleMode 683->689 687 7ff78878b353-7ff78878b373 ReadFile 684->687 685->671 690 7ff78878b279-7ff78878b291 685->690 693 7ff78878b379-7ff78878b381 687->693 694 7ff78878b46d-7ff78878b476 GetLastError 687->694 689->684 696 7ff78878b2f5-7ff78878b2fd 689->696 690->671 700 7ff78878b293-7ff78878b29f 690->700 691->667 692->695 693->694 702 7ff78878b387 693->702 697 7ff78878b493-7ff78878b496 694->697 698 7ff78878b478-7ff78878b48e call 7ff788786088 call 7ff788786068 694->698 699 7ff78878b333-7ff78878b33d call 7ff788789f78 695->699 696->687 704 7ff78878b2ff-7ff78878b321 ReadConsoleW 696->704 708 7ff78878b329-7ff78878b32b call 7ff788785ffc 697->708 709 7ff78878b49c-7ff78878b49e 697->709 698->695 699->651 700->671 707 7ff78878b2a1-7ff78878b2a3 700->707 711 7ff78878b38e-7ff78878b3a3 702->711 713 7ff78878b342-7ff78878b34c 704->713 714 7ff78878b323 GetLastError 704->714 707->671 718 7ff78878b2a5-7ff78878b2b5 707->718 708->695 709->699 711->699 720 7ff78878b3a5-7ff78878b3b0 711->720 713->711 714->708 718->671 723 7ff78878b3b2-7ff78878b3cb call 7ff78878aca4 720->723 724 7ff78878b3d7-7ff78878b3df 720->724 732 7ff78878b3d0-7ff78878b3d2 723->732 725 7ff78878b3e1-7ff78878b3f3 724->725 726 7ff78878b45b-7ff78878b468 call 7ff78878aae4 724->726 729 7ff78878b3f5 725->729 730 7ff78878b44e-7ff78878b456 725->730 726->732 733 7ff78878b3fa-7ff78878b401 729->733 730->699 732->699 735 7ff78878b403-7ff78878b407 733->735 736 7ff78878b43d-7ff78878b448 733->736 737 7ff78878b423 735->737 738 7ff78878b409-7ff78878b410 735->738 736->730 740 7ff78878b429-7ff78878b439 737->740 738->737 739 7ff78878b412-7ff78878b416 738->739 739->737 741 7ff78878b418-7ff78878b421 739->741 740->733 742 7ff78878b43b 740->742 741->740 742->730
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                  • Opcode ID: 6ace3fbad8ddd1cd05ed41dddf3a6c6a2c6962649ba5052cc4813f441b9b9292
                                                                                                                                                                                                                                  • Instruction ID: 26727775064b3454a86e1a6692d31858b7b64182a9cf4bfc5a2243ec0df0a342
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6ace3fbad8ddd1cd05ed41dddf3a6c6a2c6962649ba5052cc4813f441b9b9292
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 46C1E422A8C68A91E720AB9194412BDF771FB89B80FE54135DB5D07791CE7CE849C32C
                                                                                                                                                                                                                                  Function 00007FF78878E95C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4170891091-0
                                                                                                                                                                                                                                  • Opcode ID: 993f4cb53d01987759aa9ab87d439edc94425a62c6450610c4994d1423bcdf7f
                                                                                                                                                                                                                                  • Instruction ID: b54488ba40f4a0db6ba43926e2abd0ed5ce2c76352051eb2e46cec664e08b529
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 993f4cb53d01987759aa9ab87d439edc94425a62c6450610c4994d1423bcdf7f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B151F673F442118AEB14EFA49D85ABCEB71BB0835CFA40135DD1E56AE5DB38A442C718
                                                                                                                                                                                                                                  Function 00007FF78878483C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2780335769-0
                                                                                                                                                                                                                                  • Opcode ID: 81de7022a69b47ce39b5392d1784fece2718e2d2aab2765227a8e407644b98c7
                                                                                                                                                                                                                                  • Instruction ID: f928715efbf7e48fbf7cc5a126852401b7f05119d5e913e2e6cf2fcbc0ca36e9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 81de7022a69b47ce39b5392d1784fece2718e2d2aab2765227a8e407644b98c7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9B518D22A886418AFB20EFB094513BDE3B1BB58B58FA08035DE4967789DF78D441C368
                                                                                                                                                                                                                                  Function 00007FF7887846E8 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1279662727-0
                                                                                                                                                                                                                                  • Opcode ID: 58b178a13046118a9aa3eab3ad0445e857bf873c1952e3e12f7b4cc56e3b75ff
                                                                                                                                                                                                                                  • Instruction ID: f8fb023072568e62fb031e8cf524a16fa3327dc9f5c740ee1d531b3221e4c5e8
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 58b178a13046118a9aa3eab3ad0445e857bf873c1952e3e12f7b4cc56e3b75ff
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2841B622D9878183E750ABA09510379F770FB99764F649334E69C03BD5EFACA5A0C728
                                                                                                                                                                                                                                  Function 00007FF78877A51C Relevance: 4.6, APIs: 3, Instructions: 102COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3058843127-0
                                                                                                                                                                                                                                  • Opcode ID: 0a8c62a57e2cf59f1561fe537eeb51f2220189f8d74725526a3d26dbeb988a7e
                                                                                                                                                                                                                                  • Instruction ID: 9e0de20663d8b4324d398863b5fc90575a000ea3b82c281c8ba5a319650bc2c0
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0a8c62a57e2cf59f1561fe537eeb51f2220189f8d74725526a3d26dbeb988a7e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E1313C21E8924242FA54BBE0D6513B9E3B1BF8E784FE44435EA0D472D7DE2CA445C379
                                                                                                                                                                                                                                  Function 00007FF78877E6FC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                  • Opcode ID: 91f838de0bf1c0634cfb639a0c406c35748c40ae1573d712d08faa75350ec251
                                                                                                                                                                                                                                  • Instruction ID: dfc1145205c0d3efeafa65c0b869f4eea2ea31214b54c46dc0fc40625f13a773
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 91f838de0bf1c0634cfb639a0c406c35748c40ae1573d712d08faa75350ec251
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1151E623B4924146F768BAE5940067AE2A1BF49FA4FA84634DE7C077C5CE3CE401C769
                                                                                                                                                                                                                                  Function 00007FF78878BA48 Relevance: 3.1, APIs: 2, Instructions: 71COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FileHandleType
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3000768030-0
                                                                                                                                                                                                                                  • Opcode ID: 51d66a3ea3a1e5720d3031fa8d01ef1f6d3b4a26eee4bfd04239a76c9c1293a5
                                                                                                                                                                                                                                  • Instruction ID: 158d691e6c616d5f9248dc9c28a949691d4b33f1558042d21019253e4d6b090d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 51d66a3ea3a1e5720d3031fa8d01ef1f6d3b4a26eee4bfd04239a76c9c1293a5
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D831D622A58B4A81D7209B548590178EA70FB4DBB4FB81339DB6E073E4CF38E491D31D
                                                                                                                                                                                                                                  Function 00007FF78878B764 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF78878B750,00000000,?,?,?,00007FF788771023,00007FF78878B859), ref: 00007FF78878B7B0
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,00007FF78878B750,00000000,?,?,?,00007FF788771023,00007FF78878B859), ref: 00007FF78878B7BA
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2976181284-0
                                                                                                                                                                                                                                  • Opcode ID: 7196098b30ecd42809471233c9619b7315c9fb41ce716e28bdee8d0b35162eb6
                                                                                                                                                                                                                                  • Instruction ID: a9f8659f0e787c087dc2e20c81c8ceeadc5d9c5092f520e59c2cb0c1d06f9ce4
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7196098b30ecd42809471233c9619b7315c9fb41ce716e28bdee8d0b35162eb6
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A111C161618B8281DA10AB76A904169E371BB88BF4FA84332EE7D4B7D9CE3CD054C708
                                                                                                                                                                                                                                  Function 00007FF7887849E4 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7887848F9), ref: 00007FF788784A17
                                                                                                                                                                                                                                  • SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7887848F9), ref: 00007FF788784A2D
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1707611234-0
                                                                                                                                                                                                                                  • Opcode ID: 5359c6eadbc125880de5eb3a516e79e0ad43a75e61374d6be107f92d83a7530b
                                                                                                                                                                                                                                  • Instruction ID: 6ed29d5f192712568142e5ad2e7a1abd621d8f948be6302eafdeabe3b60ceada
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5359c6eadbc125880de5eb3a516e79e0ad43a75e61374d6be107f92d83a7530b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7811E33268C64281EB20AB50A40103BF7B0FB887A0FB00235F6AD85AD8EF6CD054DB1C
                                                                                                                                                                                                                                  Function 00007FF78878A188 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(?,?,?,00007FF78878A005,?,?,00000000,00007FF78878A0BA), ref: 00007FF78878A1F6
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF78878A005,?,?,00000000,00007FF78878A0BA), ref: 00007FF78878A200
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 918212764-0
                                                                                                                                                                                                                                  • Opcode ID: 6fe57093fbbb00cdf8389479e1e18e52ea82cce6ea34632ee61e1d7ac301845a
                                                                                                                                                                                                                                  • Instruction ID: cda6a7429926099457180346f8c0caeba85ce1ff2c8733b2bea62d1816014225
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6fe57093fbbb00cdf8389479e1e18e52ea82cce6ea34632ee61e1d7ac301845a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C421C210F5864241FA6077E19A94279E2B1BF8C7A4FA44234DE2E473C5DE6CA444C32E
                                                                                                                                                                                                                                  Function 00007FF78878B4DC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                  • Opcode ID: 3cb10c43647639a768565940e1ce5c449de1869fbc1a92892aa118bde093882e
                                                                                                                                                                                                                                  • Instruction ID: 117d0353dbd16151432f47124aaf57a6f8959f1fea7a12b5e585d3a817b58e69
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3cb10c43647639a768565940e1ce5c449de1869fbc1a92892aa118bde093882e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A141B032A4824587EA24EB99E550279F3B0FB5AB40FB41131D78E836D5DF2CE402C76D
                                                                                                                                                                                                                                  Function 00007FF788776360 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _fread_nolock
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 840049012-0
                                                                                                                                                                                                                                  • Opcode ID: a906f97fa5c1c3e68ea4aaba72e37a718a084612bddaa449cc4850aa5fd8710a
                                                                                                                                                                                                                                  • Instruction ID: 4328651a35dcf3decaf87fe8556f29969863b88e3b72b76e7a3cb7446935a1bc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a906f97fa5c1c3e68ea4aaba72e37a718a084612bddaa449cc4850aa5fd8710a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B4216221B8869245EA14BB9269043BAE661BF49FD8FD84430EE0D0778ADF7CF145C618
                                                                                                                                                                                                                                  Function 00007FF78878AF6C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                  • Opcode ID: 215bf1b77ccde561eed8eea60c34a1d65fc1379a1c4c4c23abd8e86c97fd8e23
                                                                                                                                                                                                                                  • Instruction ID: 5d71915011892b49899071b47912a346a48028abe41f322ca66005d63fac2759
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 215bf1b77ccde561eed8eea60c34a1d65fc1379a1c4c4c23abd8e86c97fd8e23
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B7319E62A5860286E711BB95884437CE670BB88BA4FE10135EA3D073D2DE7CF846D73D
                                                                                                                                                                                                                                  Function 00007FF788785538 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                  • Opcode ID: 25f020cec256df429067bb606d051891f0f83e0bb8faa834007163ccabd97c9c
                                                                                                                                                                                                                                  • Instruction ID: 533fb270f6bbf8043efffe64a09a28e0a2d45165a0f1e528c06f491b29a3a0d9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 25f020cec256df429067bb606d051891f0f83e0bb8faa834007163ccabd97c9c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 77118121A5C68181EB61BF91940067DE2B0BF89B80FE44431EA8C57A86CF7DE841D76C
                                                                                                                                                                                                                                  Function 00007FF7887957DC Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                  • Opcode ID: e860bb9bc84c29a06dccfc010b7eb52daf61d2c250f48aeb7393b4a8ace16f10
                                                                                                                                                                                                                                  • Instruction ID: ed22d38186ef2b1748799f127303453be0194e266f77866bef4aac82fe7c0f66
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e860bb9bc84c29a06dccfc010b7eb52daf61d2c250f48aeb7393b4a8ace16f10
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9F219532A18A8187DB61AF68D880779F6B0FB88B54FA44234EA6D476D5DF3CD401CB14
                                                                                                                                                                                                                                  Function 00007FF78877E97C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                  • Opcode ID: 298f7b2a666c55937c0a4044f00fb88544ba948c427ceaa5fd6043e577695ec0
                                                                                                                                                                                                                                  • Instruction ID: ecebca251f9b4d81c0372b97f25670e93856484d79739193c72677e71f8d6b8d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 298f7b2a666c55937c0a4044f00fb88544ba948c427ceaa5fd6043e577695ec0
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C701C422A8875141EA44FBD29900179F6B5BF9AFE0FA84631DE6C17BD6CE3CE411C718
                                                                                                                                                                                                                                  Function 00007FF788776310 Relevance: 1.5, APIs: 1, Instructions: 20libraryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788776DB0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF788776DEA
                                                                                                                                                                                                                                  • LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7887722DE,?,?,?,?), ref: 00007FF788776333
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ByteCharLibraryLoadMultiWide
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2592636585-0
                                                                                                                                                                                                                                  • Opcode ID: 4f2292e1e78b6b04c2ade65416a023b90951e6264d27b8cd69ba397aaf3470f3
                                                                                                                                                                                                                                  • Instruction ID: e38856b0d16868f1947c2add57924ee6b20d1b949d48ba692cb455c3383969fb
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4f2292e1e78b6b04c2ade65416a023b90951e6264d27b8cd69ba397aaf3470f3
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EDE08621B1854142DE18A7ABA90546AE261FF4CBC0B989035DE0D47759DD2CD491CB08
                                                                                                                                                                                                                                  Function 00007FF78878DEB8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • HeapAlloc.KERNEL32(?,?,00000000,00007FF78878AA16,?,?,?,00007FF788789BD3,?,?,00000000,00007FF788789E6E), ref: 00007FF78878DF0D
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AllocHeap
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4292702814-0
                                                                                                                                                                                                                                  • Opcode ID: 69550027ed8e3bf035e7bef6798a6f7658c1153be72ca181ca789a5114add420
                                                                                                                                                                                                                                  • Instruction ID: fc645b730fe34994f66bba238299955edb4ee4519e712605822a38250d1f6484
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 69550027ed8e3bf035e7bef6798a6f7658c1153be72ca181ca789a5114add420
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 61F04940B8A20341FE597BE259502B4D6B17F9CB40FEC4430C91E87AD2EE2CE482D23C
                                                                                                                                                                                                                                  Function 00007FF78878CC2C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • HeapAlloc.KERNEL32(?,?,?,00007FF78877F1E4,?,?,?,00007FF7887806F6,?,?,?,?,?,00007FF78878275D), ref: 00007FF78878CC6A
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AllocHeap
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4292702814-0
                                                                                                                                                                                                                                  • Opcode ID: b827a7ab023d1767f95784f6f7fefaf86c66ee15463514ccfd07e797832e7771
                                                                                                                                                                                                                                  • Instruction ID: a75b05323a084f7774ed1fef1a3ecc0b89d4364ff10573a73ba577075b87c034
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b827a7ab023d1767f95784f6f7fefaf86c66ee15463514ccfd07e797832e7771
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5BF05E10B9A24640FEA976F15941675D1A1BFCD7A0FA80234D93E852D1DD2CA480D23C

                                                                                                                                                                                                                                  Non-executed Functions

                                                                                                                                                                                                                                  Function 00007FF7887758E0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 139COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetTempPathW.KERNEL32(?,00000000,?,00007FF7887758AD), ref: 00007FF78877597A
                                                                                                                                                                                                                                  • GetCurrentProcessId.KERNEL32(?,00007FF7887758AD), ref: 00007FF788775980
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788775AF0: GetEnvironmentVariableW.KERNEL32(00007FF788772817,?,?,?,?,?,?), ref: 00007FF788775B2A
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788775AF0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF788775B47
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788786818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF788786831
                                                                                                                                                                                                                                  • SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF788775A31
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Environment$Variable$CurrentExpandPathProcessStringsTemp_invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                                                                                                                                                                                  • API String ID: 1556224225-1116378104
                                                                                                                                                                                                                                  • Opcode ID: fb533de90983aa8ed4e0e2c1f6f0f309b68095ef9aabf4d2006ce4ee732b5443
                                                                                                                                                                                                                                  • Instruction ID: 4a444f0c98d4d48383542149edb824feb81c59e29dd1cda1aa9ee3f85523f489
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fb533de90983aa8ed4e0e2c1f6f0f309b68095ef9aabf4d2006ce4ee732b5443
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5A517E10F9D68340FE54B7A2A9552BAD2A17F9DBC0FE54031EC0E4BB96ED6CE501C328
                                                                                                                                                                                                                                  Function 00007FFDFABB18A0 Relevance: 13.9, APIs: 9, Instructions: 425COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Mem_$SubtypeType_$DataFreeFromKindMallocReallocUnicode_
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1742244024-0
                                                                                                                                                                                                                                  • Opcode ID: 5c1050c68e97de161cd6d8c48e9085a3eef7c228c5941944440c3b79a23d7220
                                                                                                                                                                                                                                  • Instruction ID: e0e630557c3d3b35e3991fe346cec0937ec07af0e485409272e066d07a127672
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5c1050c68e97de161cd6d8c48e9085a3eef7c228c5941944440c3b79a23d7220
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0402F372B0C59286E76C8B19E464A7F37A5EF447C8F944177DAAE46ADCEE2DE440C300
                                                                                                                                                                                                                                  Function 00007FFDFABB3058 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 313767242-0
                                                                                                                                                                                                                                  • Opcode ID: d5821aaf4936ad9aa18e348792a4e6496cc638c229f42c96d8f2983ca85ed40f
                                                                                                                                                                                                                                  • Instruction ID: 156dfc5c9751555f783744f5488d2ba62e1c8c624b735db33d8615a62760ac37
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d5821aaf4936ad9aa18e348792a4e6496cc638c229f42c96d8f2983ca85ed40f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EE315E72709B8189EB648F60E8A07EE7364FB84784F84413ADA5E47BD9DF38D548C710
                                                                                                                                                                                                                                  Function 00007FF78877AA2C Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3140674995-0
                                                                                                                                                                                                                                  • Opcode ID: 414c3b7d1a52ef3ba5408d69683659119c26abb58edcf35ad0cee906abb0d3fb
                                                                                                                                                                                                                                  • Instruction ID: 24137f0c12913dfae8f2e654578cd7ce623fcbacafce13cbb3867e3601e403e8
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 414c3b7d1a52ef3ba5408d69683659119c26abb58edcf35ad0cee906abb0d3fb
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 01315072659A8186EB60AFA0E9403EDF371FB88744F94403ADA4D47A98EF3CD548C724
                                                                                                                                                                                                                                  Function 00007FF788789C44 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1239891234-0
                                                                                                                                                                                                                                  • Opcode ID: 5dfb057c3f1a11160ff10646ccc1b52b02cf652cbed9a545e94d4dbf2c44da7d
                                                                                                                                                                                                                                  • Instruction ID: e62e7179dd978e457198ef22bfb4e103cfa90b64f920cd892a8822e1a8c08712
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5dfb057c3f1a11160ff10646ccc1b52b02cf652cbed9a545e94d4dbf2c44da7d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AD315032658B8186E760EB65E8402AEF3B0FB88754FA00135EA9D43B95DF3CC555CB14
                                                                                                                                                                                                                                  Function 00007FF788790A34 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2227656907-0
                                                                                                                                                                                                                                  • Opcode ID: 9f9ca1d73139302c1f8dadc28b774b2f708e59aaaf6a5032caa9291e182b955e
                                                                                                                                                                                                                                  • Instruction ID: d1b8fb5d2b7e7486f4ecc551450bc512768da6211d1d00cfaa1358c09b7a25df
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9f9ca1d73139302c1f8dadc28b774b2f708e59aaaf6a5032caa9291e182b955e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BAB1C822B6869241EA60ABB59C006B9E371FF49BE4FA44131ED5E07BC5DE3CE441C728
                                                                                                                                                                                                                                  Function 00007FF788772F20 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF7887722DE,?,?,?,?), ref: 00007FF788772F36
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF7887722DE,?,?,?,?), ref: 00007FF788772F75
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF7887722DE,?,?,?,?), ref: 00007FF788772F9A
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF7887722DE,?,?,?,?), ref: 00007FF788772FBF
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF7887722DE,?,?,?,?), ref: 00007FF788772FE7
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF7887722DE,?,?,?,?), ref: 00007FF78877300F
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF7887722DE,?,?,?,?), ref: 00007FF788773037
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF7887722DE,?,?,?,?), ref: 00007FF78877305F
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF7887722DE,?,?,?,?), ref: 00007FF788773087
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressProc
                                                                                                                                                                                                                                  • String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
                                                                                                                                                                                                                                  • API String ID: 190572456-3109299426
                                                                                                                                                                                                                                  • Opcode ID: 3d8788b48c699204fb620db4b6681a167f3e5177f9efbc96361098fa63709e71
                                                                                                                                                                                                                                  • Instruction ID: 913835995822e15adc95e55c424f9de91654b743c29c1e3c0a81f3e6e31da0bb
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3d8788b48c699204fb620db4b6681a167f3e5177f9efbc96361098fa63709e71
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 18429264A8EB0391EA15FBA9AD50174E2B1BF0C790BF45175C81E063A8FF7CE548D328
                                                                                                                                                                                                                                  Function 00007FF788774730 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressProc$LibraryLoad
                                                                                                                                                                                                                                  • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                                  • API String ID: 2238633743-1453502826
                                                                                                                                                                                                                                  • Opcode ID: 387b05963c1573a630a89e02a7d3e5c8a0eed87054fdcdadb8995d5c72bb8a89
                                                                                                                                                                                                                                  • Instruction ID: 5faa5308fe38eeb74b5df8f6694ebcc9621f669aadd90b9aa33b9b38797f8b19
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 387b05963c1573a630a89e02a7d3e5c8a0eed87054fdcdadb8995d5c72bb8a89
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 36E1B160A8AB4391FE15FBA8AD50274E3B6BF5C790BF45035C81E06364EF6CE548D368
                                                                                                                                                                                                                                  Function 00007FF788776BF0 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 113COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32 ref: 00007FF788776C2C
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788771CB0: GetLastError.KERNEL32(?,?,00000000,00007FF788776904,?,?,?,?,?,?,?,?,?,?,?,00007FF788771023), ref: 00007FF788771CD7
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ByteCharErrorLastMultiWide
                                                                                                                                                                                                                                  • String ID: Failed to decode wchar_t from UTF-8$Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$WideCharToMultiByte$win32_utils_from_utf8$win32_wcs_to_mbs
                                                                                                                                                                                                                                  • API String ID: 203985260-1562484376
                                                                                                                                                                                                                                  • Opcode ID: 4738581143a7505b28abcd57c7c993806daa07168fe16da415c29e9b13c2df9d
                                                                                                                                                                                                                                  • Instruction ID: 3e9ec167223b084d9fbdef6e345a8913fed002b5f5cc04939055fd96b46d528e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4738581143a7505b28abcd57c7c993806daa07168fe16da415c29e9b13c2df9d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F1415421A8CA4342EA20BBA5AC40179E6B1BF9CBD0FE44135D94D477A9EF3CE505C728
                                                                                                                                                                                                                                  Function 00007FFDFABB48C4 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 94COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Unicode_$CompareString$With$DeallocErr_Ready
                                                                                                                                                                                                                                  • String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
                                                                                                                                                                                                                                  • API String ID: 1067165228-3528878251
                                                                                                                                                                                                                                  • Opcode ID: 84b6ee6fd32b1749266b3b3277a0080e416e3c06d1c571da1b6b520214c44c91
                                                                                                                                                                                                                                  • Instruction ID: f4b8257e3cccc7a434c5c30d08cde1048d2ad8fe6871d9155de43ae16422a1e6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 84b6ee6fd32b1749266b3b3277a0080e416e3c06d1c571da1b6b520214c44c91
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CE412E21B0CA4799EB5C8B11A864A3B63A4BF45BC4FC445B6CDAF477E9DF2CE4449301
                                                                                                                                                                                                                                  Function 00007FF788771440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                                  • API String ID: 0-666925554
                                                                                                                                                                                                                                  • Opcode ID: a0af457b7bbfc407ccfbc1c94cd0b20c2703364556a7e62a8338bbd4754aee84
                                                                                                                                                                                                                                  • Instruction ID: 1855476c67a55dd3937e9d22cd5a8be8b49de755e683e19bfd8f7f3a96632b78
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a0af457b7bbfc407ccfbc1c94cd0b20c2703364556a7e62a8338bbd4754aee84
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6751A761B8864281EA10FBA1A9406B9E3B0BF4ABD4FE44431DE1D87795EF3CE545C338
                                                                                                                                                                                                                                  Function 00007FF788776A60 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
                                                                                                                                                                                                                                  • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                                                                                                  • API String ID: 4998090-2855260032
                                                                                                                                                                                                                                  • Opcode ID: e3ae2089cc123d46b594be8ff950cb64da25cc15db14cd9a57b660644dd56c7b
                                                                                                                                                                                                                                  • Instruction ID: ee80df555ee3b25f34cffd7df380571d715919db5325a7bc084b8b6ff0cc9a40
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e3ae2089cc123d46b594be8ff950cb64da25cc15db14cd9a57b660644dd56c7b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E941A63165C64282E710BFA5E8456AAF371FB89794FE00231EA5E476D8DF3CE408C714
                                                                                                                                                                                                                                  Function 00007FFDFABB24D0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 73COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Module_$Dealloc$ObjectObject_$Capsule_ConstantFromMallocMem_SpecStringTrackTypeType_
                                                                                                                                                                                                                                  • String ID: 14.0.0$_ucnhash_CAPI$ucd_3_2_0$unidata_version
                                                                                                                                                                                                                                  • API String ID: 288921926-1430584071
                                                                                                                                                                                                                                  • Opcode ID: 093a6e99f6c7ac6b9da6a92ec34a7c46fe80505c17f2a94d6c5583e06f8421e3
                                                                                                                                                                                                                                  • Instruction ID: 616944dafb33cd1aad7c0cf3e06212e264d3220bfb03b46541c18999dff9372b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 093a6e99f6c7ac6b9da6a92ec34a7c46fe80505c17f2a94d6c5583e06f8421e3
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8B213C71F1CA0381FB5D9B25A87497A2298AF49BD0FC852B3C92F067DDDE2CE0019711
                                                                                                                                                                                                                                  Function 00007FFDFABB1090 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 150COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CompareStringUnicode_With$Mem_$FreeMallocSubtypeType_
                                                                                                                                                                                                                                  • String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
                                                                                                                                                                                                                                  • API String ID: 1723213316-3528878251
                                                                                                                                                                                                                                  • Opcode ID: 810bdfc32914a6b9f3e7d28e4da211caf2deacae3ab60a26b15fea2458299ecb
                                                                                                                                                                                                                                  • Instruction ID: e97be931db55d980192e88a5968cf2c3bbbc9e0669c806c7a2051e5ac3f506ce
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 810bdfc32914a6b9f3e7d28e4da211caf2deacae3ab60a26b15fea2458299ecb
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5D517E61B1C65281FB6C8B16B834E7B5654AF42BC8F9451B3DD7E47BDACE2CE4019700
                                                                                                                                                                                                                                  Function 00007FFDFABB45FC Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 62COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Arg_Unicode_$ArgumentCheckDigitErr_PositionalReadyString
                                                                                                                                                                                                                                  • String ID: a unicode character$argument 1$digit$not a digit
                                                                                                                                                                                                                                  • API String ID: 3305933226-4278345224
                                                                                                                                                                                                                                  • Opcode ID: 3217a924504a57fe459749e66487c061ed53d5ecb5f468087b61bf9f04998d2c
                                                                                                                                                                                                                                  • Instruction ID: fd38afac0566f66175ce8b2b535b94be5a53ad3ed979c0b70ab441cf24458f48
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3217a924504a57fe459749e66487c061ed53d5ecb5f468087b61bf9f04998d2c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B0210A21B0CA4691EB589B21E86497A6364FB84BC4F8445B2C92F476EDDF2CE455D300
                                                                                                                                                                                                                                  Function 00007FFDFABB2730 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 349153199-0
                                                                                                                                                                                                                                  • Opcode ID: 5ae4ae1fad975d5487a8dd9099fd26104a61e4c8513e68d9fc499fd676c40ec1
                                                                                                                                                                                                                                  • Instruction ID: 3af8d7f7ae9ee2903057d24753c8bcf160a0a2eada30b02485c94ab6b98a98e1
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5ae4ae1fad975d5487a8dd9099fd26104a61e4c8513e68d9fc499fd676c40ec1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0381CD20F1C2434AF75CAB269871ABB2690AF857C0FC485B7D96D477DEDE2CE8458700
                                                                                                                                                                                                                                  Function 00007FFDFABB1000 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 61COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Unicode_$Arg_$ArgumentCompareReadyStringWith$CheckPositionalSubtypeType_
                                                                                                                                                                                                                                  • String ID: argument 1$argument 2$normalize$str
                                                                                                                                                                                                                                  • API String ID: 3621440800-1320425463
                                                                                                                                                                                                                                  • Opcode ID: 94348148c340fa5468beab9ef1746397c69e42e894d14843631ab3fa4ea44381
                                                                                                                                                                                                                                  • Instruction ID: ce2d9029bbb0ef7198bb3235422512611df6e3f08e451ba2067f28031785302e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 94348148c340fa5468beab9ef1746397c69e42e894d14843631ab3fa4ea44381
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 99216171B1C68291E7588B15E8649BA2350EF44BD8FD942B3D97E476ECCF2CE446D300
                                                                                                                                                                                                                                  Function 00007FFDFABB47D8 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 58COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Arg_$ArgumentReadyUnicode_$CheckPositional
                                                                                                                                                                                                                                  • String ID: argument 1$argument 2$is_normalized$str
                                                                                                                                                                                                                                  • API String ID: 396090033-184702317
                                                                                                                                                                                                                                  • Opcode ID: 083d934e8de19c9f3ecc87de63ad9be438488cb32d0c3822875fb99c87d5c9cf
                                                                                                                                                                                                                                  • Instruction ID: 92c4cdc99320730714943b4ccc5dbeba03e595681f00fa1985705e05927ac232
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 083d934e8de19c9f3ecc87de63ad9be438488cb32d0c3822875fb99c87d5c9cf
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C6219421B0CBC695E7588B15E860A7A2750BF44BD8FD442B2D97E476ECCF2CD44AC300
                                                                                                                                                                                                                                  Function 00007FF788776670 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(WideCharToMultiByte,00007FF788771CE4,?,?,00000000,00007FF788776904), ref: 00007FF788776697
                                                                                                                                                                                                                                  • FormatMessageW.KERNEL32 ref: 00007FF7887766C6
                                                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32 ref: 00007FF78877671C
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788771CB0: GetLastError.KERNEL32(?,?,00000000,00007FF788776904,?,?,?,?,?,?,?,?,?,?,?,00007FF788771023), ref: 00007FF788771CD7
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorLast$ByteCharFormatMessageMultiWide
                                                                                                                                                                                                                                  • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                                                                                                                                  • API String ID: 2383786077-2573406579
                                                                                                                                                                                                                                  • Opcode ID: ee4750cad08e904e569e44cd6da303e01fcfffc44399732fd87d74f29f2688a4
                                                                                                                                                                                                                                  • Instruction ID: 5a3c580bd022a9cb0aa229dc47822488d61b71263ee1cb79edd71fa83302ddba
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ee4750cad08e904e569e44cd6da303e01fcfffc44399732fd87d74f29f2688a4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8121A471A48A4281FB60BBA4EC54376E775FB8D384FE40034D54D826A8EF3CE104C728
                                                                                                                                                                                                                                  Function 00007FF78877F5C8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID: f$f$p$p$f
                                                                                                                                                                                                                                  • API String ID: 3215553584-1325933183
                                                                                                                                                                                                                                  • Opcode ID: 5b8d5396a44c552a0cc4e48ad8092be8cf806d396b8c8f6251230df5f0eb9214
                                                                                                                                                                                                                                  • Instruction ID: 8f2851315a8d050e86bf585d362265128d8e5f721060da5d17948e364bb2335d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5b8d5396a44c552a0cc4e48ad8092be8cf806d396b8c8f6251230df5f0eb9214
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5D12B422E4C24B85FB207AA4D2547BAF2B1FF58754FE44032D699466D4DF3CE480DB29
                                                                                                                                                                                                                                  Function 00007FF788776130 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90processsynchronizationCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                                                                                                                                                                                  • String ID: CreateProcessW$Error creating child process!
                                                                                                                                                                                                                                  • API String ID: 2895956056-3524285272
                                                                                                                                                                                                                                  • Opcode ID: d5693698e4819ce5d510509d5cda6c943b390b1bcdb6e918232fd1435297541c
                                                                                                                                                                                                                                  • Instruction ID: f599b94f4519b6d03e401a2790c35ba37adc728b3685c66de57a10705988ca84
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d5693698e4819ce5d510509d5cda6c943b390b1bcdb6e918232fd1435297541c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C9411531A4878281DA20ABA4F9552AAF374FF99360FA00335E6AD47BD5DF7CD044CB54
                                                                                                                                                                                                                                  Function 00007FF78877CF90 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                                  • String ID: csm$csm$csm
                                                                                                                                                                                                                                  • API String ID: 849930591-393685449
                                                                                                                                                                                                                                  • Opcode ID: c9717f7599358984fa081211ebe6d8e8a7f2fe77f13a54a703b9fcdffbee59eb
                                                                                                                                                                                                                                  • Instruction ID: c28d6b4b293eb74c2f05b7dc09d09e14019d3df69625319a5514488678528c99
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c9717f7599358984fa081211ebe6d8e8a7f2fe77f13a54a703b9fcdffbee59eb
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BCE18032A4874186EB20BBA5D4402ADFBB0FB8C788F600135EE4D57B5ACF38E491C754
                                                                                                                                                                                                                                  Function 00007FFDFABB16E0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 129COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Unicode_$Arg_ArgumentFromReadyStringSubtypeType_
                                                                                                                                                                                                                                  • String ID: a unicode character$argument$category
                                                                                                                                                                                                                                  • API String ID: 2803103377-2068800536
                                                                                                                                                                                                                                  • Opcode ID: a6d96ab8f4d74e2785bc45c139f4dad4c1c002ec39197cd78705e508cfcb3221
                                                                                                                                                                                                                                  • Instruction ID: 54cd00f53750e833e4faa4435157a25fd9e7d3e93dcc473faca14fe2a66b4715
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a6d96ab8f4d74e2785bc45c139f4dad4c1c002ec39197cd78705e508cfcb3221
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2F51D661B08A4646EB5C8B09E860A7A67A1FF44BC8F944176DAAE477DCDF3CE845C300
                                                                                                                                                                                                                                  Function 00007FF78878DF30 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(?,00000000,?,00007FF78878E2CA,?,?,0000014E9A17DE18,00007FF78878A383,?,?,?,00007FF78878A27A,?,?,?,00007FF7887854E2), ref: 00007FF78878E0AC
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00000000,?,00007FF78878E2CA,?,?,0000014E9A17DE18,00007FF78878A383,?,?,?,00007FF78878A27A,?,?,?,00007FF7887854E2), ref: 00007FF78878E0B8
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                                  • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                  • API String ID: 3013587201-537541572
                                                                                                                                                                                                                                  • Opcode ID: 5d4014bca18f9f9ee9ee76f308e7221266f6712ab36b1d3e30b229e2872ef72f
                                                                                                                                                                                                                                  • Instruction ID: def85f34f1569cf54f57e9704a062d9b221cb8462026d10972336e748f34f483
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5d4014bca18f9f9ee9ee76f308e7221266f6712ab36b1d3e30b229e2872ef72f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2A410622B5A60241FA11AB969900575E3B1BF0CB90FB84535DD2D87784EF3DE445C32C
                                                                                                                                                                                                                                  Function 00007FFDFABB1590 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 112COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Unicode_$Arg_ArgumentFromReadyStringSubtypeType_
                                                                                                                                                                                                                                  • String ID: a unicode character$argument$bidirectional
                                                                                                                                                                                                                                  • API String ID: 2803103377-2110215792
                                                                                                                                                                                                                                  • Opcode ID: 36da06cb25986c62c4c3f8f899b6a59008b4eccd6e6682e03f445f584b43c37d
                                                                                                                                                                                                                                  • Instruction ID: e381aa195192377b4b6be73927af8bed287ea687e6b49b5d281f9df854123b0b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 36da06cb25986c62c4c3f8f899b6a59008b4eccd6e6682e03f445f584b43c37d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1B41D061B1C64282EB5C8B15E870A7B23A1EF44BC8F984176DA6F436DCEF2DE8459300
                                                                                                                                                                                                                                  Function 00007FF7887767C0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 103COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF788771023), ref: 00007FF78877685F
                                                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF788771023), ref: 00007FF7887768AF
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ByteCharMultiWide
                                                                                                                                                                                                                                  • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                                                  • API String ID: 626452242-27947307
                                                                                                                                                                                                                                  • Opcode ID: 6005c3c3b021663ea81aa36166b0848140842be883a1b4f62739566592ce7020
                                                                                                                                                                                                                                  • Instruction ID: 24810c703084adfed3a6f65ec866fe3a002c6ad13f0d294aab2f5ce7c0a7301a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6005c3c3b021663ea81aa36166b0848140842be883a1b4f62739566592ce7020
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CA419532A4CB8286E660FF95B840169F7B5FB98790FA44135DA8D43B98EF3CE055C718
                                                                                                                                                                                                                                  Function 00007FFDFABB4494 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 87COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FromStringUnicode_$S_snprintfSizeSubtypeType_memcpy
                                                                                                                                                                                                                                  • String ID: $%04X
                                                                                                                                                                                                                                  • API String ID: 762632776-4013080060
                                                                                                                                                                                                                                  • Opcode ID: efaac3812b1e45b0806d1ffd24ca6100d0016fb643bf3bb04f79384b0d54b902
                                                                                                                                                                                                                                  • Instruction ID: 5c49871a8299f8ba8cf20f41e87b360a3825b1d21330f8b71b91e0e41d03b82d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: efaac3812b1e45b0806d1ffd24ca6100d0016fb643bf3bb04f79384b0d54b902
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7431A372B08A8141EB698B14E824BBA63A1FF45BD4F880376DA7E476D9DF3CE5458300
                                                                                                                                                                                                                                  Function 00007FF788776EC0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00007FF788772D35,?,?,?,?,?,?), ref: 00007FF788776F01
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788771CB0: GetLastError.KERNEL32(?,?,00000000,00007FF788776904,?,?,?,?,?,?,?,?,?,?,?,00007FF788771023), ref: 00007FF788771CD7
                                                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00007FF788772D35,?,?,?,?,?,?), ref: 00007FF788776F75
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                                                                                                                                  • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                                                  • API String ID: 1717984340-27947307
                                                                                                                                                                                                                                  • Opcode ID: d869b65ad41923ea885775a182ffbbb4fa8a6a55f9429b012359a23964d7bd56
                                                                                                                                                                                                                                  • Instruction ID: dcc9b6c30be8843f9ed0c5b9e3fbf10f69d17c5f8952b1ef46833169396a101f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d869b65ad41923ea885775a182ffbbb4fa8a6a55f9429b012359a23964d7bd56
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1E217E21A48B4285EB20FBA5AC40179F775BB88B90BE44135DA4D837A9EF3CF504C328
                                                                                                                                                                                                                                  Function 00007FFDFABB4A40 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Arg_ArgumentErr_FromLongLong_OccurredReadyUnicode_
                                                                                                                                                                                                                                  • String ID: a unicode character$argument$mirrored
                                                                                                                                                                                                                                  • API String ID: 3097524968-4001128513
                                                                                                                                                                                                                                  • Opcode ID: 77cb7ad6de355ad8668d3817cb236b2b5105f7e73bd8a590f5e838a9add7c01f
                                                                                                                                                                                                                                  • Instruction ID: 4baa5c5a860b9ed478e46e7909f0d711a5306076665fe2199ac6595f2b66d903
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 77cb7ad6de355ad8668d3817cb236b2b5105f7e73bd8a590f5e838a9add7c01f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2A018820B0C68345EB5C9B25A86097A2354BF48BD4FC412B2D93E466DDDF3CD4848304
                                                                                                                                                                                                                                  Function 00007FFDFABB41C4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Arg_ArgumentErr_FromLongLong_OccurredReadyUnicode_
                                                                                                                                                                                                                                  • String ID: a unicode character$argument$combining
                                                                                                                                                                                                                                  • API String ID: 3097524968-4202047184
                                                                                                                                                                                                                                  • Opcode ID: 6ee8f634c8bf377dd992d2f0ff6affb9e81d614e22d3a0a0852f92623d6c53f6
                                                                                                                                                                                                                                  • Instruction ID: c36f39a75cfc2a919dfe77dfe94090884ed5934dadd01fba81dbb4ef2ca7853e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6ee8f634c8bf377dd992d2f0ff6affb9e81d614e22d3a0a0852f92623d6c53f6
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2001A124F1C64346EB5C9F60A860A7A2290BF49BD8FC402B2D93E472EDDF3CE4849300
                                                                                                                                                                                                                                  Function 00007FF7887893C4 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID: f$p$p
                                                                                                                                                                                                                                  • API String ID: 3215553584-1995029353
                                                                                                                                                                                                                                  • Opcode ID: d478605e8072a694eb9a9d804e4987f1596106984b5661be3eee2fb972e34d58
                                                                                                                                                                                                                                  • Instruction ID: 9b0306b815dcc7409587b52278638256297dd88d97b281521e8b2f03bb4746ec
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d478605e8072a694eb9a9d804e4987f1596106984b5661be3eee2fb972e34d58
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 89129F22E4C14386FB20BA95D0543B9F6B1FB98754FE84035E69A466C4DB3CED81DB2C
                                                                                                                                                                                                                                  Function 00007FFDFABB11D0 Relevance: 10.8, APIs: 7, Instructions: 321COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Mem_$MallocSubtypeType_$DeallocErr_FreeMemory
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4139299733-0
                                                                                                                                                                                                                                  • Opcode ID: 28f3761f3b9b36c355cab414f80724fd73af126df89ae3bbe0a4b4c216283ad1
                                                                                                                                                                                                                                  • Instruction ID: 54c15cf228e57353012031e31852e334e60418e310898f9558e547e5ddb78e03
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 28f3761f3b9b36c355cab414f80724fd73af126df89ae3bbe0a4b4c216283ad1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 60D1DE72B1C95281EB288B15A464DBE67A5FF447C8F9401B3DA6E46AC9EF7CE841C700
                                                                                                                                                                                                                                  Function 00007FF788776FB0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 98COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ByteCharMultiWide
                                                                                                                                                                                                                                  • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                                                  • API String ID: 626452242-876015163
                                                                                                                                                                                                                                  • Opcode ID: 15182e71835fbe62ed04ed96ffee69818c29c72be0e860e28e8d56ff05f5ea04
                                                                                                                                                                                                                                  • Instruction ID: 06cde90cff2c4d1447dee610560de93a2437f03f0bda5d5ca113a46256985e1f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 15182e71835fbe62ed04ed96ffee69818c29c72be0e860e28e8d56ff05f5ea04
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7A419332A49B4282E620FF65A840279F6B5FB88B90FA44135DE5D47BA4EF3CD452C718
                                                                                                                                                                                                                                  Function 00007FF7887755E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788776DB0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF788776DEA
                                                                                                                                                                                                                                  • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF78877592F,?,00000000,?,TokenIntegrityLevel), ref: 00007FF78877563F
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF78877569A
                                                                                                                                                                                                                                  • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF788775653
                                                                                                                                                                                                                                  • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF788775616
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ByteCharEnvironmentExpandMultiStringsWide
                                                                                                                                                                                                                                  • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                                                                                                                                                                                                                  • API String ID: 2001182103-3498232454
                                                                                                                                                                                                                                  • Opcode ID: a1120828b3476f260000b83a15022e52e527ac597b894c2c5ce775141fa959ef
                                                                                                                                                                                                                                  • Instruction ID: 3e7b51f66d8a52a856cf089d5deca7b5f1c8de558caadfb189daabd1c4612fa2
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a1120828b3476f260000b83a15022e52e527ac597b894c2c5ce775141fa959ef
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 49319551B597C280FA20B7A599553BAD2B1BF9D7C0FE40035DA0E82786FE2CE104C72C
                                                                                                                                                                                                                                  Function 00007FF78877C248 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • LoadLibraryExW.KERNEL32(?,?,?,00007FF78877C4FA,?,?,?,00007FF78877C1EC,?,?,00000001,00007FF78877BE09), ref: 00007FF78877C2CD
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF78877C4FA,?,?,?,00007FF78877C1EC,?,?,00000001,00007FF78877BE09), ref: 00007FF78877C2DB
                                                                                                                                                                                                                                  • LoadLibraryExW.KERNEL32(?,?,?,00007FF78877C4FA,?,?,?,00007FF78877C1EC,?,?,00000001,00007FF78877BE09), ref: 00007FF78877C305
                                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(?,?,?,00007FF78877C4FA,?,?,?,00007FF78877C1EC,?,?,00000001,00007FF78877BE09), ref: 00007FF78877C34B
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,?,00007FF78877C4FA,?,?,?,00007FF78877C1EC,?,?,00000001,00007FF78877BE09), ref: 00007FF78877C357
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                                  • String ID: api-ms-
                                                                                                                                                                                                                                  • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                                  • Opcode ID: 9ce77a0163c425c367fd7c26c9c82fe5a817cd2dfec158d19dd861a4531b58f3
                                                                                                                                                                                                                                  • Instruction ID: 7d0fa3547cb09baad6612aa326fab9f70292af7ffad437a53786d2714bdf0c0a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9ce77a0163c425c367fd7c26c9c82fe5a817cd2dfec158d19dd861a4531b58f3
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5831C621B4A64281EE51BB96A800579E3B4FF4DBA0FA90535DD2D46340EF3CE444C729
                                                                                                                                                                                                                                  Function 00007FF788776DB0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF788776DEA
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788771CB0: GetLastError.KERNEL32(?,?,00000000,00007FF788776904,?,?,?,?,?,?,?,?,?,?,?,00007FF788771023), ref: 00007FF788771CD7
                                                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF788776E70
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                                                                                                                                  • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                                                  • API String ID: 1717984340-876015163
                                                                                                                                                                                                                                  • Opcode ID: 7f54e5da8ee4cb54e1cd0e604769d215f15cea2374718bc11fd99751b49c0007
                                                                                                                                                                                                                                  • Instruction ID: 02f16c72fc895eebc0123a64903ebce6081ae419d4db6dfa5eaffd404900e1e1
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7f54e5da8ee4cb54e1cd0e604769d215f15cea2374718bc11fd99751b49c0007
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1E216521B48A4242EF50EB69F800165E771FB8D7C4FA84135DB5C83B69EF2CE551C718
                                                                                                                                                                                                                                  Function 00007FF78878A780 Relevance: 10.6, APIs: 7, Instructions: 62COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF7887924B3,?,?,?,00007FF78878CCEC,?,?,00000000,00007FF78878386F,?,?,?,00007FF788789473), ref: 00007FF78878A78F
                                                                                                                                                                                                                                  • FlsGetValue.KERNEL32(?,?,?,00007FF7887924B3,?,?,?,00007FF78878CCEC,?,?,00000000,00007FF78878386F,?,?,?,00007FF788789473), ref: 00007FF78878A7A4
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF7887924B3,?,?,?,00007FF78878CCEC,?,?,00000000,00007FF78878386F,?,?,?,00007FF788789473), ref: 00007FF78878A7C5
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF7887924B3,?,?,?,00007FF78878CCEC,?,?,00000000,00007FF78878386F,?,?,?,00007FF788789473), ref: 00007FF78878A7F2
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF7887924B3,?,?,?,00007FF78878CCEC,?,?,00000000,00007FF78878386F,?,?,?,00007FF788789473), ref: 00007FF78878A803
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF7887924B3,?,?,?,00007FF78878CCEC,?,?,00000000,00007FF78878386F,?,?,?,00007FF788789473), ref: 00007FF78878A814
                                                                                                                                                                                                                                  • SetLastError.KERNEL32(?,?,?,00007FF7887924B3,?,?,?,00007FF78878CCEC,?,?,00000000,00007FF78878386F,?,?,?,00007FF788789473), ref: 00007FF78878A82F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Value$ErrorLast
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2506987500-0
                                                                                                                                                                                                                                  • Opcode ID: 78cf2455f8789f49a255dc6ffb64301edc27073bb37ec47cc96fd54928eaf598
                                                                                                                                                                                                                                  • Instruction ID: 465359d6503f8b812241494b0ba2586e8ce8030f315bb2a72b11d2243adc4c6e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 78cf2455f8789f49a255dc6ffb64301edc27073bb37ec47cc96fd54928eaf598
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 36217C20E8864242FA5973E1A681139E5727F4C7B0FB84734E93E47AC6DE2CA441C22E
                                                                                                                                                                                                                                  Function 00007FFDFABB4B3C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
                                                                                                                                                                                                                                  • String ID: a unicode character$argument 1$name
                                                                                                                                                                                                                                  • API String ID: 3545102714-4190364640
                                                                                                                                                                                                                                  • Opcode ID: 98823aa8ffd1578c5263bbca0bedab94c0d76701b0ad0a7228cb953a239c43b9
                                                                                                                                                                                                                                  • Instruction ID: 1ba266d973b49cba775639227d1e7a2d69fd118ec538f4be13adf0f7a34cbbc6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 98823aa8ffd1578c5263bbca0bedab94c0d76701b0ad0a7228cb953a239c43b9
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E1216F31B08A82C5EB689F11E560AAA7364FB44BC8F8441B2DB6D477ADCF3DE445C300
                                                                                                                                                                                                                                  Function 00007FFDFABB42B8 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
                                                                                                                                                                                                                                  • String ID: a unicode character$argument 1$decimal
                                                                                                                                                                                                                                  • API String ID: 3545102714-2474051849
                                                                                                                                                                                                                                  • Opcode ID: f4a4db4005ce5b44fbbedd951a978a9de4f901ebc22dc2e68f9535657243f817
                                                                                                                                                                                                                                  • Instruction ID: 33e185a75b7650641149e01446101f773812ec6ad6a5cb33755e2769023247fc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f4a4db4005ce5b44fbbedd951a978a9de4f901ebc22dc2e68f9535657243f817
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AF214D31B1CA8296EB589B11E4619AA6364FB44BC4FD841B2DA6D437EDCF38E555C300
                                                                                                                                                                                                                                  Function 00007FFDFABB4C8C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
                                                                                                                                                                                                                                  • String ID: a unicode character$argument 1$numeric
                                                                                                                                                                                                                                  • API String ID: 3545102714-2385192657
                                                                                                                                                                                                                                  • Opcode ID: 9cf334a25039c3b0788d85340cb18b310c84a749129293f830eaee71995b6e63
                                                                                                                                                                                                                                  • Instruction ID: 112d979c9d67770f314375f25e852b81271ee692735cac381ece0c4516d7e616
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9cf334a25039c3b0788d85340cb18b310c84a749129293f830eaee71995b6e63
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 85214F31B08A8685EB589B11E46096A6364FB44BC4F9841B2DE6D477ADCF3CE955C700
                                                                                                                                                                                                                                  Function 00007FF7887970EC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                                  • String ID: CONOUT$
                                                                                                                                                                                                                                  • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                                  • Opcode ID: 900c1da012dee1dfb60ea43974335527b3f6c3b56b4e810762f126343bdfd55c
                                                                                                                                                                                                                                  • Instruction ID: d9e2e8ee1ddc546faafdb15665962540908f3207f7e4d17dd3b816a11a57151f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 900c1da012dee1dfb60ea43974335527b3f6c3b56b4e810762f126343bdfd55c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D3118121A58A4186E350AB96FC54329E6B1FB8CBE4FA40234DA5D87794EF3CD414C758
                                                                                                                                                                                                                                  Function 00007FF78878A8F8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF788786091,?,?,?,?,00007FF78878DF1F,?,?,00000000,00007FF78878AA16,?,?,?), ref: 00007FF78878A907
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF788786091,?,?,?,?,00007FF78878DF1F,?,?,00000000,00007FF78878AA16,?,?,?), ref: 00007FF78878A93D
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF788786091,?,?,?,?,00007FF78878DF1F,?,?,00000000,00007FF78878AA16,?,?,?), ref: 00007FF78878A96A
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF788786091,?,?,?,?,00007FF78878DF1F,?,?,00000000,00007FF78878AA16,?,?,?), ref: 00007FF78878A97B
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF788786091,?,?,?,?,00007FF78878DF1F,?,?,00000000,00007FF78878AA16,?,?,?), ref: 00007FF78878A98C
                                                                                                                                                                                                                                  • SetLastError.KERNEL32(?,?,?,00007FF788786091,?,?,?,?,00007FF78878DF1F,?,?,00000000,00007FF78878AA16,?,?,?), ref: 00007FF78878A9A7
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Value$ErrorLast
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2506987500-0
                                                                                                                                                                                                                                  • Opcode ID: 62dca5d10fd8524d44a9ca6b61b614a098d57abd4030ec328ef3c17f7e173edc
                                                                                                                                                                                                                                  • Instruction ID: c7bfc034d2d1e443546d06a38e6091769e2780f86998b3f186822ee22af76330
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 62dca5d10fd8524d44a9ca6b61b614a098d57abd4030ec328ef3c17f7e173edc
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4C11CD20B8C64242FA5477E29641139E2727F8D7B0FB54734EC6E477D6DE2CA481C22E
                                                                                                                                                                                                                                  Function 00007FF78877BC08 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                                  • String ID: csm$f
                                                                                                                                                                                                                                  • API String ID: 2395640692-629598281
                                                                                                                                                                                                                                  • Opcode ID: e4cc0f9b1589dd73a5d4f416534ce71b9b3e94dd2aede877d85d93aa73312820
                                                                                                                                                                                                                                  • Instruction ID: f10410b5a174d2badf3fbd176be22ab00f217c3a141b926cc93428790ca97633
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e4cc0f9b1589dd73a5d4f416534ce71b9b3e94dd2aede877d85d93aa73312820
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B451C132A496028AEB14FF65E404A79F7B5FB48B88FA08531DB5E47748DF39E841C718
                                                                                                                                                                                                                                  Function 00007FFDFABB4D54 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DoubleErr_Float_FromNumericStringSubtypeType_Unicode_
                                                                                                                                                                                                                                  • String ID: not a numeric character
                                                                                                                                                                                                                                  • API String ID: 1034370217-2058156748
                                                                                                                                                                                                                                  • Opcode ID: ae5864331190d99266549655542a2a8f2e04feb98f737cbb9499cc14618bbe38
                                                                                                                                                                                                                                  • Instruction ID: 3c682c6da40152badf7283cd0361cdbb51616b27fc847bbef0f6d152d30d6ddf
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ae5864331190d99266549655542a2a8f2e04feb98f737cbb9499cc14618bbe38
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 16118125B0C94681EB5D8B25E43093F63A5BF44BC4F9581B2C93F466EDDF2CECA58201
                                                                                                                                                                                                                                  Function 00007FFDFABB4380 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DecimalDigitErr_FromLongLong_StringSubtypeType_Unicode_
                                                                                                                                                                                                                                  • String ID: not a decimal
                                                                                                                                                                                                                                  • API String ID: 3750391552-3590249192
                                                                                                                                                                                                                                  • Opcode ID: 456184b784fa7efc8fe9d8897fb77cbbb081413c450d27b41a848b68105fcfc3
                                                                                                                                                                                                                                  • Instruction ID: e8acc1b18e6d0a839e629c29ee3532673d027a845f04630d641320a0e410d8bd
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 456184b784fa7efc8fe9d8897fb77cbbb081413c450d27b41a848b68105fcfc3
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B4115121B1DA4281EB5D8B16E47493F63A5BF44BC4F8945B2C92F466EDDF2CE8558300
                                                                                                                                                                                                                                  Function 00007FFDFABB46E4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Arg_ArgumentReadyUnicode_
                                                                                                                                                                                                                                  • String ID: a unicode character$argument$east_asian_width
                                                                                                                                                                                                                                  • API String ID: 1875788646-3913127203
                                                                                                                                                                                                                                  • Opcode ID: e1dea5a4efee597cabc79f5f4f9b1c361292688d97fad454cab5bbac9e71014d
                                                                                                                                                                                                                                  • Instruction ID: 351418f28386f64f67f463ffea46e7ba47e534b1b897b999968cb78ca63c682c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e1dea5a4efee597cabc79f5f4f9b1c361292688d97fad454cab5bbac9e71014d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D101A720B08A8345EB589B22E9609761350FF46BD4F8451B2D97E062DEDF3CD445C300
                                                                                                                                                                                                                                  Function 00007FFDFABB4418 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Arg_ArgumentReadyUnicode_
                                                                                                                                                                                                                                  • String ID: a unicode character$argument$decomposition
                                                                                                                                                                                                                                  • API String ID: 1875788646-2471543666
                                                                                                                                                                                                                                  • Opcode ID: ac2962689f343f1b3e1879047209e348276c37b5dff3c3435d3d8175ead54011
                                                                                                                                                                                                                                  • Instruction ID: 1d75a43af396bb6e99092bb9ba22303058abf1a78f7f4aefdfab77570fc3c370
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ac2962689f343f1b3e1879047209e348276c37b5dff3c3435d3d8175ead54011
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3801AD21B0CA8391EB588B11E860ABA2360BF44BD4F8411B2D97F062DDDF3CD4A98300
                                                                                                                                                                                                                                  Function 00007FFDFABB2620 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Mem_$Capsule_Err_FreeMallocMemory
                                                                                                                                                                                                                                  • String ID: unicodedata._ucnhash_CAPI
                                                                                                                                                                                                                                  • API String ID: 3673501854-3989975041
                                                                                                                                                                                                                                  • Opcode ID: 1ac5af153bf2bbb2bda3b9d9d9136918d1f6bd182a880703478f12c765018ae7
                                                                                                                                                                                                                                  • Instruction ID: 15265c0af4fc5fcb57fae80ffcf42da681839a73949e19b82573a9992cdf8de7
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1ac5af153bf2bbb2bda3b9d9d9136918d1f6bd182a880703478f12c765018ae7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 84F01960B0DB4295EB498B11A86097A62A8BF18BC4FC411B3C86F067EDEE3CE044D310
                                                                                                                                                                                                                                  Function 00007FF788788A40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                  • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                  • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                  • Opcode ID: 78a1a69aac29132cf000f84d0d5f993c26bceca4d1e4e1c3cfa2e89eec15c9a9
                                                                                                                                                                                                                                  • Instruction ID: c666a9d5e2b908501de8cdee70fa68fcf1dc633d4b262388b87e498d82d4d311
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 78a1a69aac29132cf000f84d0d5f993c26bceca4d1e4e1c3cfa2e89eec15c9a9
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4DF04421649B0241FA206BA5EC45339D370BF4D761FA40635CA6E451E4DF3CD448D328
                                                                                                                                                                                                                                  Function 00007FF788798824 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _set_statfp
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1156100317-0
                                                                                                                                                                                                                                  • Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                                                                                                                                  • Instruction ID: 59b09443ab64ea3fe7550b559d5a8a6516030b4a9c9b812a8b228bbe47d896bf
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D8118222EE8A0341F67431B8DC85775D1627F5C364EAA0638E97E4A7D7CE3CA840C138
                                                                                                                                                                                                                                  Function 00007FF78878A9C0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • FlsGetValue.KERNEL32(?,?,?,00007FF788789BD3,?,?,00000000,00007FF788789E6E,?,?,?,?,?,00007FF788781A40), ref: 00007FF78878A9DF
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF788789BD3,?,?,00000000,00007FF788789E6E,?,?,?,?,?,00007FF788781A40), ref: 00007FF78878A9FE
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF788789BD3,?,?,00000000,00007FF788789E6E,?,?,?,?,?,00007FF788781A40), ref: 00007FF78878AA26
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF788789BD3,?,?,00000000,00007FF788789E6E,?,?,?,?,?,00007FF788781A40), ref: 00007FF78878AA37
                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF788789BD3,?,?,00000000,00007FF788789E6E,?,?,?,?,?,00007FF788781A40), ref: 00007FF78878AA48
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Value
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3702945584-0
                                                                                                                                                                                                                                  • Opcode ID: 358dba81be253043741c53dc9c404725d40e2bf31f5f8457cfbf7a8f66644627
                                                                                                                                                                                                                                  • Instruction ID: 802f2c5a33544dfaa7e8056ae98faaab89a9d532ac85a79af9f93c9419a1500d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 358dba81be253043741c53dc9c404725d40e2bf31f5f8457cfbf7a8f66644627
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 99113D11A8864241FA58B3E59681279E5627F4C7F0FA44334E83E47AD6DE2CE841C62E
                                                                                                                                                                                                                                  Function 00007FF78878F218 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                                  • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                                  • Opcode ID: fa9c2c0b9e0b51f4f192ae3b8b8b95ed4a793ff286fdede4dba764f85164dfb1
                                                                                                                                                                                                                                  • Instruction ID: f0684abdd02a4338f954b7ef4c13df6dce0a2f628c8803bf8d87a9d48dd659a9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fa9c2c0b9e0b51f4f192ae3b8b8b95ed4a793ff286fdede4dba764f85164dfb1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B381A272E8820285F7A47EA5C154278F6B0BF19B84FF58032DA0DD7A95CB2DE941D32D
                                                                                                                                                                                                                                  Function 00007FF78877D468 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                                  • String ID: MOC$RCC
                                                                                                                                                                                                                                  • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                                  • Opcode ID: f09742bcba9082defbae069630545238114b431a0e4fd7be58dd8469a5d7fef1
                                                                                                                                                                                                                                  • Instruction ID: ad112efbc37ef7d317ca95eb9a5265a97a9f9feed28a38ccb94fae0fec48a5b3
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f09742bcba9082defbae069630545238114b431a0e4fd7be58dd8469a5d7fef1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FF618972A08A858AE710EFA5D4403ADBBB0FB49B8CF644235EE4D13B99DF38E055C714
                                                                                                                                                                                                                                  Function 00007FF78877D7C4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                                                  • String ID: csm$csm
                                                                                                                                                                                                                                  • API String ID: 3896166516-3733052814
                                                                                                                                                                                                                                  • Opcode ID: a3990994d2fbb822c09bdc2a35b5fa2b647080e9aebb1a5b00e12dffe7bfe986
                                                                                                                                                                                                                                  • Instruction ID: 8156a7135d11b3983da4b8bb41441f8a6c55bf052b7976a82c4b763eaea7ec2d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a3990994d2fbb822c09bdc2a35b5fa2b647080e9aebb1a5b00e12dffe7bfe986
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7351A53294824286EB64BF519584378FBB0FB99B94FA44135DA9C47BDACF3CE450CB18
                                                                                                                                                                                                                                  Function 00007FFDFABB1EF0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • PyErr_SetString.PYTHON311(?,?,?,?,?,00007FFDFABB1EDC), ref: 00007FFDFABB3B6F
                                                                                                                                                                                                                                    • Part of subcall function 00007FFDFABB1FD0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFABB2008
                                                                                                                                                                                                                                    • Part of subcall function 00007FFDFABB1FD0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFABB2026
                                                                                                                                                                                                                                  • PyErr_Format.PYTHON311 ref: 00007FFDFABB1F53
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Err_strncmp$FormatString
                                                                                                                                                                                                                                  • String ID: name too long$undefined character name '%s'
                                                                                                                                                                                                                                  • API String ID: 3882229318-4056717002
                                                                                                                                                                                                                                  • Opcode ID: 8b8c9c862c8556266a26c0415d30d38fd4fd6db163ae40366dde064f1277ed55
                                                                                                                                                                                                                                  • Instruction ID: f017468a5964b05c92da4308cd7b607cbdcda71715d31e2f78f86f7c39374e6f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8b8c9c862c8556266a26c0415d30d38fd4fd6db163ae40366dde064f1277ed55
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C7112175B18947C1EB088B18E4A4AB56364FB88788FC405B2CA2E472E9DF7DE14AC701
                                                                                                                                                                                                                                  Function 00007FF788772CD0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(?,00007FF7887727C9,?,?,?,?,?,?), ref: 00007FF788772D01
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788771CB0: GetLastError.KERNEL32(?,?,00000000,00007FF788776904,?,?,?,?,?,?,?,?,?,?,?,00007FF788771023), ref: 00007FF788771CD7
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                                                  • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                                                                                                                                  • API String ID: 2776309574-1977442011
                                                                                                                                                                                                                                  • Opcode ID: 7987a5ce4ff3c8cba7d8c38c60f2d05ca27952d1a3ea66f3204455115dc1ef10
                                                                                                                                                                                                                                  • Instruction ID: b1af1a631ab846f22043f40529ccae9c8aee66a3160260051db749d422291f88
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7987a5ce4ff3c8cba7d8c38c60f2d05ca27952d1a3ea66f3204455115dc1ef10
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 11018420BAD64245FA61B7A0D8153F5D2B1BF5C3C0FE00031D84E8A296EE5CE104C738
                                                                                                                                                                                                                                  Function 00007FF78878BBD0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2718003287-0
                                                                                                                                                                                                                                  • Opcode ID: 47f9f7c1e3185106a498671fedee26090088e719dd8e44b73d57f810765c87d4
                                                                                                                                                                                                                                  • Instruction ID: 38458e930b701bc0b968b256e6657084bfda7250781033b11bd36e2ea6650285
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 47f9f7c1e3185106a498671fedee26090088e719dd8e44b73d57f810765c87d4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 81D1E072B18A8589E710DFA5D4402ACF7B5FB487D8BA04236CF5E97B99DE38D006C718
                                                                                                                                                                                                                                  Function 00007FF78878C590 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF78878C57B), ref: 00007FF78878C6AC
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF78878C57B), ref: 00007FF78878C737
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 953036326-0
                                                                                                                                                                                                                                  • Opcode ID: 1ee269c4fb3492fdab786e16ea0be33da994e1b3a3006f3c14cd8905a42bf150
                                                                                                                                                                                                                                  • Instruction ID: b7c63c867f519763324ee69e5fb5e301f308c2d8ef9c5d930bb629a3fe96844c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1ee269c4fb3492fdab786e16ea0be33da994e1b3a3006f3c14cd8905a42bf150
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B891A632F5865285F790AFA5948027DEBB0BB98B88FA44139DE0E57A84DF3CD441C72C
                                                                                                                                                                                                                                  Function 00007FFDFABB1FD0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 173stringCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: strncmp
                                                                                                                                                                                                                                  • String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
                                                                                                                                                                                                                                  • API String ID: 1114863663-87138338
                                                                                                                                                                                                                                  • Opcode ID: 315690625b96ec968e0fd3bff09a411a7d33ab15bbea3d9f0de0a272eac0e1aa
                                                                                                                                                                                                                                  • Instruction ID: 2abcf0ba178413608c336c953fa78d00530a7d25c15f7b455bbcd9b9dfe66452
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 315690625b96ec968e0fd3bff09a411a7d33ab15bbea3d9f0de0a272eac0e1aa
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7861E432B1864246E7688A19E820ABB7652FB807D0FC44276EA6D47ADDDF3CD501D700
                                                                                                                                                                                                                                  Function 00007FFDFA9ABC74 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913785207.00007FFDFA421000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FFDFA420000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913742250.00007FFDFA420000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914321964.00007FFDFA9C7000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914515560.00007FFDFAB4D000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914551642.00007FFDFAB53000.00000008.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914590656.00007FFDFAB55000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914626915.00007FFDFAB57000.00000008.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914676005.00007FFDFAB5C000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914728512.00007FFDFAB60000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfa420000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2933794660-0
                                                                                                                                                                                                                                  • Opcode ID: 94c9acafe10be122d2f397f1e5ea694c59c3688944f7c31b8d4002f49b5f86db
                                                                                                                                                                                                                                  • Instruction ID: 7c3ef1e7affff556deb2efcf76252a8f396c2c196ae9746f523b7a5a4007a340
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 94c9acafe10be122d2f397f1e5ea694c59c3688944f7c31b8d4002f49b5f86db
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E4113322B14F028AEB04CF61E8546B833B4F719758F840E31EA7D867A8EF78D154C340
                                                                                                                                                                                                                                  Function 00007FFDFABB2C0C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2933794660-0
                                                                                                                                                                                                                                  • Opcode ID: 82f0f9c915ca38b27df9a13535bd7a8d6766dc117c9a79f3edaf6f20f04facae
                                                                                                                                                                                                                                  • Instruction ID: f338031b719f15389a566370f575bd24c0a517ee6bc992bff48d930f044a221f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 82f0f9c915ca38b27df9a13535bd7a8d6766dc117c9a79f3edaf6f20f04facae
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 25115236B18F0589EB00CF60E8646B933A4FB59758F840E31DA6D477A8DF7CD1998380
                                                                                                                                                                                                                                  Function 00007FF788794DBC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID: ?
                                                                                                                                                                                                                                  • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                                  • Opcode ID: 7a76fc5472fa01dafaf21516cddcde8ab34b2c46cd3e7f8dd598f321934e5d52
                                                                                                                                                                                                                                  • Instruction ID: 7539351b4ab64d9876b8dcda744cf2b9b933c6fb9fc82d9e17eb1da383ecea6f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7a76fc5472fa01dafaf21516cddcde8ab34b2c46cd3e7f8dd598f321934e5d52
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 20411E32AA828241FB64ABB59841379D670FF88BA4F744235EE5C07AD5DF3CD481C718
                                                                                                                                                                                                                                  Function 00007FF788787FD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _invalid_parameter_noinfo.LIBCMT ref: 00007FF788788002
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788789F78: HeapFree.KERNEL32(?,?,?,00007FF788791EC2,?,?,?,00007FF788791EFF,?,?,00000000,00007FF7887923C5,?,?,00000000,00007FF7887922F7), ref: 00007FF788789F8E
                                                                                                                                                                                                                                    • Part of subcall function 00007FF788789F78: GetLastError.KERNEL32(?,?,?,00007FF788791EC2,?,?,?,00007FF788791EFF,?,?,00000000,00007FF7887923C5,?,?,00000000,00007FF7887922F7), ref: 00007FF788789F98
                                                                                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF78877A485), ref: 00007FF788788020
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                                  • String ID: C:\Users\user\Desktop\54Oa5PcvK1.exe
                                                                                                                                                                                                                                  • API String ID: 3580290477-651273546
                                                                                                                                                                                                                                  • Opcode ID: 83176ff4db4dd0536c3ddf35c800fe3e17928d2d4ec44ff73abd72510ae6e28f
                                                                                                                                                                                                                                  • Instruction ID: 1483f088819f5974ab432a7c47e80e1c4356b374feab3c595140be73758f7dfc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 83176ff4db4dd0536c3ddf35c800fe3e17928d2d4ec44ff73abd72510ae6e28f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 83416132A8864285F714AF61D8411B9F3B5FF487D4BA44035EA4E47B95DF3DE441C328
                                                                                                                                                                                                                                  Function 00007FF78878C268 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                  • String ID: U
                                                                                                                                                                                                                                  • API String ID: 442123175-4171548499
                                                                                                                                                                                                                                  • Opcode ID: 3868b3aae24abb70b6c7ced641cfa87b6d54125405e373b4c87f7bfc476be08b
                                                                                                                                                                                                                                  • Instruction ID: bcb166d6383145293a162039711eae07cfbb0c43253169c4642e0515b071c31b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3868b3aae24abb70b6c7ced641cfa87b6d54125405e373b4c87f7bfc476be08b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2741C722B18A4185EB60EFA5E8443AAF770FB98794FA44031EE4D87B98DF3CD441D758
                                                                                                                                                                                                                                  Function 00007FF78878E588 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentDirectory
                                                                                                                                                                                                                                  • String ID: :
                                                                                                                                                                                                                                  • API String ID: 1611563598-336475711
                                                                                                                                                                                                                                  • Opcode ID: 69729114f07132f4e5c02582f69e799d97905c52b16ff4e3b4ac21f165a3e13d
                                                                                                                                                                                                                                  • Instruction ID: 86500980749a7816713edb6f60d477c2796ef1b2fc5f1327337b21982cc93d38
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 69729114f07132f4e5c02582f69e799d97905c52b16ff4e3b4ac21f165a3e13d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9B21CE63B4828181EB20AB51D44426EF3B2FB88B84FE58035DA8D43285DF7CE945CB69
                                                                                                                                                                                                                                  Function 00007FF78877E310 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1913154019.00007FF788771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF788770000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913115625.00007FF788770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913206046.00007FF78879A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887AD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887B0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913250192.00007FF7887BC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1913360795.00007FF7887BE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ff788770000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                                  • String ID: csm
                                                                                                                                                                                                                                  • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                                  • Opcode ID: ee4cd62d6736e0f26efa3482034fbaa09f2706f16dc7c85cfdea4997af4e44da
                                                                                                                                                                                                                                  • Instruction ID: ea91264fd502427c9ef1cd79e84088bbe0f759e19e62bcf86cfd2f365a4b2b34
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ee4cd62d6736e0f26efa3482034fbaa09f2706f16dc7c85cfdea4997af4e44da
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 17113A32648B4182EB209F25F940269F7B4FB88B84F684231EE8D07768DF3CD551CB04
                                                                                                                                                                                                                                  Function 00007FFDFABB4C04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: String$Err_FromUnicode_
                                                                                                                                                                                                                                  • String ID: no such name
                                                                                                                                                                                                                                  • API String ID: 3678473424-4211486178
                                                                                                                                                                                                                                  • Opcode ID: 3cee85899810c21b61c883871248d1595a37fae7423a3e6c68c232458049210f
                                                                                                                                                                                                                                  • Instruction ID: 2f78aaf6e7d50b2fa2bbc26c1fbdf9805c23790cde1325f5ab9b02681461f62c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3cee85899810c21b61c883871248d1595a37fae7423a3e6c68c232458049210f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 84016D75B1CA4291EB659B11E831BBA6364BF98B84F800072DE6E467E9DF2CE1059600
                                                                                                                                                                                                                                  Function 00007FFDFABB25B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _PyObject_GC_New.PYTHON311(?,?,00000000,00007FFDFABB2533), ref: 00007FFDFABB25B6
                                                                                                                                                                                                                                  • PyObject_GC_Track.PYTHON311(?,?,00000000,00007FFDFABB2533), ref: 00007FFDFABB25E8
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000002.00000002.1914858610.00007FFDFABB1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFABB0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914813035.00007FFDFABB0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFABB5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC12000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC5E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC61000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFAC66000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1914898478.00007FFDFACC0000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915209099.00007FFDFACC3000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000002.00000002.1915272815.00007FFDFACC5000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_2_2_7ffdfabb0000_54Oa5PcvK1.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Object_$Track
                                                                                                                                                                                                                                  • String ID: 3.2.0
                                                                                                                                                                                                                                  • API String ID: 16854473-1786766648
                                                                                                                                                                                                                                  • Opcode ID: 767dd7ab98994f43239e4e329e749c2ad7475791c86a6fb4d160e6b955e6c056
                                                                                                                                                                                                                                  • Instruction ID: a05a7b89d2e8f77ec76d9ecc8952251df4b852e223b5625aacaa34d6d6bc15f6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 767dd7ab98994f43239e4e329e749c2ad7475791c86a6fb4d160e6b955e6c056
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B8E0ED24B09B0695EB198B11A86046A22A8BF08784BC402B6CD6E023A8EF3CE165D240