Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
WTvNL75dCr.exe

Overview

General Information

Sample name:WTvNL75dCr.exe
renamed because original name is a hash value
Original sample name:94b19d2d17eeb9168cb11f97d532ee65962f70a2c1249f3abfc8625c8c3193f8.exe
Analysis ID:1578193
MD5:41d0bfe78163967efad3c207926add4b
SHA1:c9bc16bc1e3a6ec027a83b1efa0fc4c4a6234bf3
SHA256:94b19d2d17eeb9168cb11f97d532ee65962f70a2c1249f3abfc8625c8c3193f8
Tags:exeuser-JAMESWT_MHT
Infos:

Detection

Python BackDoor
Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected Python BackDoor
AI detected suspicious sample
Opens network shares
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
IP address seen in connection with other malware
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info

Classification

Process Tree

  • System is w10x64
  • WTvNL75dCr.exe (PID: 6552 cmdline: "C:\Users\user\Desktop\WTvNL75dCr.exe" MD5: 41D0BFE78163967EFAD3C207926ADD4B)
    • WTvNL75dCr.exe (PID: 5364 cmdline: "C:\Users\user\Desktop\WTvNL75dCr.exe" MD5: 41D0BFE78163967EFAD3C207926ADD4B)
      • systeminfo.exe (PID: 5764 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)
        • conhost.exe (PID: 1900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WmiPrvSE.exe (PID: 6500 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
      • cmd.exe (PID: 6504 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 4708 cmdline: wmic computersystem get manufacturer MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • WerFault.exe (PID: 6204 cmdline: C:\Windows\system32\WerFault.exe -u -p 5364 -s 968 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000003.2124245565.000001CDFEEB9000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_PythonBackDoor_1Yara detected Python BackDoorJoe Security
    00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_PythonBackDoor_1Yara detected Python BackDoorJoe Security
      Process Memory Space: WTvNL75dCr.exe PID: 5364JoeSecurity_PythonBackDoor_1Yara detected Python BackDoorJoe Security

        Sigma Signatures

        ⊘No Sigma rule has matched

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        AI detected suspicious sample
        Source: Submited SampleIntegrated Neural Analysis Model: Matched 97.8% probability
        Source: WTvNL75dCr.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
        Source: Binary string: C:\Users\qt\work\qt\qtwebglplugin\plugins\platforms\qwebgl.pdb source: qwebgl.dll.0.dr
        Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: WTvNL75dCr.exe, 00000000.00000003.2086427446.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: WTvNL75dCr.exe, 00000000.00000003.2086255553.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: WTvNL75dCr.exe, 00000002.00000002.2529084977.00007FF8A8065000.00000002.00000001.01000000.0000000D.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: WTvNL75dCr.exe, 00000000.00000003.2086819829.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
        Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: WTvNL75dCr.exe, 00000002.00000002.2528529300.00007FF8A7EB2000.00000002.00000001.01000000.00000014.sdmp
        Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: WTvNL75dCr.exe, 00000002.00000002.2534969989.00007FF8B9F74000.00000002.00000001.01000000.00000005.sdmp
        Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: WTvNL75dCr.exe, 00000000.00000003.2071857082.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2534813779.00007FF8B9845000.00000002.00000001.01000000.0000000F.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb%% source: WTvNL75dCr.exe, 00000002.00000002.2532731000.00007FF8B7837000.00000002.00000001.01000000.00000021.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb source: WTvNL75dCr.exe, 00000002.00000002.2532731000.00007FF8B7837000.00000002.00000001.01000000.00000021.sdmp
        Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: WTvNL75dCr.exe, 00000002.00000002.2534528872.00007FF8B8F83000.00000002.00000001.01000000.00000007.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwebp.pdb source: qwebp.dll.0.dr
        Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: WTvNL75dCr.exe, 00000002.00000002.2534266113.00007FF8B8C16000.00000002.00000001.01000000.00000016.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: WTvNL75dCr.exe, 00000000.00000003.2086819829.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: WTvNL75dCr.exe, 00000000.00000003.2086255553.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdbT source: WTvNL75dCr.exe, 00000002.00000002.2529631755.00007FF8A8526000.00000002.00000001.01000000.0000000C.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Gui.pdb source: WTvNL75dCr.exe, 00000002.00000002.2525551903.00007FF8A696A000.00000002.00000001.01000000.0000001E.sdmp
        Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: WTvNL75dCr.exe, 00000002.00000002.2534101163.00007FF8B8B3B000.00000002.00000001.01000000.0000000A.sdmp
        Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: WTvNL75dCr.exe, 00000002.00000002.2534672221.00007FF8B93CD000.00000002.00000001.01000000.00000009.sdmp
        Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: WTvNL75dCr.exe, 00000002.00000002.2533588197.00007FF8B7E59000.00000002.00000001.01000000.00000011.sdmp
        Source: Binary string: D:\a\1\b\bin\amd64\python313.pdb source: WTvNL75dCr.exe, 00000002.00000002.2531335208.00007FF8A8CF8000.00000002.00000001.01000000.00000004.sdmp
        Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: WTvNL75dCr.exe, 00000000.00000003.2070407793.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbBB source: WTvNL75dCr.exe, 00000000.00000003.2087532708.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platformthemes\qxdgdesktopportal.pdb source: WTvNL75dCr.exe, 00000000.00000003.2089984329.000001E134826000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: WTvNL75dCr.exe, 00000002.00000002.2527540692.00007FF8A7717000.00000002.00000001.01000000.0000001A.sdmp
        Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdb source: WTvNL75dCr.exe, 00000000.00000003.2059447292.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2535114680.00007FF8BA4F3000.00000002.00000001.01000000.0000000E.sdmp
        Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: WTvNL75dCr.exe, 00000002.00000002.2528529300.00007FF8A7F4A000.00000002.00000001.01000000.00000014.sdmp
        Source: Binary string: D:\a\1\b\libssl-3.pdbDD source: WTvNL75dCr.exe, 00000002.00000002.2527839730.00007FF8A7AB5000.00000002.00000001.01000000.00000015.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdb source: WTvNL75dCr.exe, 00000002.00000002.2529631755.00007FF8A8526000.00000002.00000001.01000000.0000000C.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: WTvNL75dCr.exe, 00000000.00000003.2087532708.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: WTvNL75dCr.exe, 00000000.00000003.2086561910.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: WTvNL75dCr.exe, 00000000.00000003.2087396572.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: WTvNL75dCr.exe, 00000002.00000002.2534969989.00007FF8B9F74000.00000002.00000001.01000000.00000005.sdmp
        Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: WTvNL75dCr.exe, 00000002.00000002.2528529300.00007FF8A7F4A000.00000002.00000001.01000000.00000014.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: WTvNL75dCr.exe, 00000000.00000003.2086687983.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: WTvNL75dCr.exe, 00000002.00000002.2534391795.00007FF8B8CB3000.00000002.00000001.01000000.00000012.sdmp
        Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: WTvNL75dCr.exe, 00000002.00000002.2534101163.00007FF8B8B3B000.00000002.00000001.01000000.0000000A.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtwebglplugin\plugins\platforms\qwebgl.pdb11 source: qwebgl.dll.0.dr
        Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: WTvNL75dCr.exe, 00000002.00000002.2533825501.00007FF8B8833000.00000002.00000001.01000000.00000017.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: WTvNL75dCr.exe, 00000002.00000002.2526353829.00007FF8A6F6A000.00000002.00000001.01000000.0000001D.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: WTvNL75dCr.exe, 00000002.00000002.2524003212.00007FF8A6284000.00000002.00000001.01000000.00000020.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: WTvNL75dCr.exe, 00000000.00000003.2087745294.000001E134826000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: WTvNL75dCr.exe, 00000002.00000002.2520661063.000001CDFE470000.00000002.00000001.01000000.00000006.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libEGL.pdb source: WTvNL75dCr.exe, 00000000.00000003.2073827268.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: D:\a\1\b\libssl-3.pdb source: WTvNL75dCr.exe, 00000002.00000002.2527839730.00007FF8A7AB5000.00000002.00000001.01000000.00000015.sdmp
        Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: WTvNL75dCr.exe, 00000002.00000002.2533360902.00007FF8B7E2E000.00000002.00000001.01000000.00000013.sdmp
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C0379280 FindFirstFileExW,FindClose,0_2_00007FF7C0379280
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C03783C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF7C03783C0
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C0391874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF7C0391874
        Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Jump to behavior
        Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI65522\Jump to behavior
        Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Jump to behavior
        Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\Jump to behavior
        Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Jump to behavior
        Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\Jump to behavior
        Source: Joe Sandbox ViewIP Address: 104.20.22.46 104.20.22.46
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: global trafficDNS traffic detected: DNS query: nodejs.org
        Source: WTvNL75dCr.exe, 00000002.00000002.2522536288.000001CDFF580000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
        Source: WTvNL75dCr.exe, 00000000.00000002.2541159415.000001E134834000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digi
        Source: WTvNL75dCr.exe, 00000000.00000003.2073827268.000001E134825000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredID
        Source: WTvNL75dCr.exe, 00000000.00000003.2074280481.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2090286321.000001E134834000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087532708.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2064780551.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2073827268.000001E134832000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088263928.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134832000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2068257625.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088623796.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089086885.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2063065806.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087396572.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2060064359.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086819829.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2062204894.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086255553.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066919517.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089517146.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087889157.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066327319.000001E134825000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
        Source: WTvNL75dCr.exe, 00000000.00000003.2074280481.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087532708.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2064780551.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2073827268.000001E134832000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088263928.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2068257625.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088623796.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089086885.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2063065806.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087396572.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2060064359.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086819829.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2062204894.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086255553.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066919517.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089517146.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087889157.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066327319.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086427446.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2067852097.000001E134825000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
        Source: WTvNL75dCr.exe, 00000000.00000003.2074280481.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2090286321.000001E134834000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087532708.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2064780551.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088263928.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134832000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2068257625.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088623796.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089086885.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2063065806.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087396572.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2060064359.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086819829.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2062204894.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086255553.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066919517.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089517146.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087889157.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066327319.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086427446.000001E134825000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
        Source: WTvNL75dCr.exe, 00000000.00000002.2541159415.000001E134834000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
        Source: WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFF068000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
        Source: WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF20A000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
        Source: WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE784000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF151000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF15C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF151000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF15C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlH2n
        Source: WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF20A000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl
        Source: WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE72A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl0
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl
        Source: WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE72A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crlceliab.)
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
        Source: WTvNL75dCr.exe, 00000000.00000002.2541159415.000001E134834000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
        Source: WTvNL75dCr.exe, 00000000.00000003.2074280481.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087532708.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2064780551.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2073827268.000001E134832000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088263928.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2068257625.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088623796.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089086885.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2063065806.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087396572.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2060064359.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086819829.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2062204894.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086255553.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066919517.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089517146.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087889157.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066327319.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086427446.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2067852097.000001E134825000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
        Source: WTvNL75dCr.exe, 00000000.00000003.2074280481.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2090286321.000001E134834000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087532708.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2064780551.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088263928.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134832000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2068257625.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088623796.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089086885.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2063065806.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087396572.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2060064359.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086819829.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2062204894.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086255553.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066919517.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089517146.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087889157.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066327319.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086427446.000001E134825000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
        Source: WTvNL75dCr.exe, 00000000.00000002.2541159415.000001E134834000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
        Source: WTvNL75dCr.exe, 00000000.00000003.2074280481.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087532708.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2064780551.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2073827268.000001E134832000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088263928.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2068257625.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088623796.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089086885.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2063065806.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087396572.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2060064359.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086819829.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2062204894.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086255553.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066919517.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089517146.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087889157.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066327319.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086427446.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2067852097.000001E134825000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
        Source: WTvNL75dCr.exe, 00000000.00000003.2087889157.000001E134826000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl
        Source: WTvNL75dCr.exe, 00000000.00000003.2074280481.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2090286321.000001E134834000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087532708.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2064780551.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088263928.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134832000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2068257625.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088623796.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089086885.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2063065806.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087396572.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2060064359.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086819829.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2062204894.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086255553.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066919517.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089517146.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087889157.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066327319.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086427446.000001E134825000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
        Source: WTvNL75dCr.exe, 00000000.00000003.2074280481.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2090286321.000001E134834000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087532708.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2064780551.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2073827268.000001E134832000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088263928.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134832000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2068257625.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088623796.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089086885.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2063065806.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087396572.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2060064359.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086819829.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2062204894.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086255553.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066919517.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089517146.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087889157.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066327319.000001E134825000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
        Source: WTvNL75dCr.exe, 00000000.00000003.2074280481.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087532708.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2064780551.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2073827268.000001E134832000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088263928.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2068257625.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088623796.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089086885.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2063065806.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087396572.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2060064359.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086819829.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2062204894.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086255553.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066919517.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089517146.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087889157.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066327319.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086427446.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2067852097.000001E134825000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
        Source: WTvNL75dCr.exe, 00000000.00000003.2074280481.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2090286321.000001E134834000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087532708.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2064780551.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088263928.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134832000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2068257625.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088623796.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089086885.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2063065806.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087396572.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2060064359.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086819829.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2062204894.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086255553.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066919517.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089517146.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087889157.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066327319.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086427446.000001E134825000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
        Source: WTvNL75dCr.exe, 00000002.00000002.2522536288.000001CDFF580000.00000004.00001000.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2128829524.000001CDFF143000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
        Source: WTvNL75dCr.exe, 00000002.00000002.2522657283.000001CDFF764000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://goo.gl/zeJZl.
        Source: WTvNL75dCr.exe, 00000002.00000003.2150955752.000001CDFEAFC000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521135425.000001CDFEA60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2128919887.000001CDFEAE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEEDC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
        Source: WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE784000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEEDC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
        Source: WTvNL75dCr.exe, 00000002.00000002.2522536288.000001CDFF668000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
        Source: WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF20A000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es
        Source: WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1E7000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es0
        Source: WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF20A000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.esQ
        Source: WTvNL75dCr.exe, 00000000.00000002.2541159415.000001E134834000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
        Source: WTvNL75dCr.exe, 00000000.00000003.2074280481.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2090286321.000001E134834000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087532708.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2064780551.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2073827268.000001E134832000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088263928.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134832000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2068257625.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088623796.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000002.2541159415.000001E134834000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089086885.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2063065806.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087396572.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2060064359.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086819829.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2062204894.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086255553.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066919517.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089517146.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087889157.000001E134826000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
        Source: WTvNL75dCr.exe, 00000000.00000003.2074280481.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087532708.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2064780551.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2073827268.000001E134832000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088263928.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2068257625.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088623796.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089086885.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2063065806.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087396572.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2060064359.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086819829.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2062204894.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086255553.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066919517.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089517146.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087889157.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066327319.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086427446.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2067852097.000001E134825000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0N
        Source: WTvNL75dCr.exe, 00000000.00000003.2074280481.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2090286321.000001E134834000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087532708.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2064780551.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088263928.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134832000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2068257625.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088623796.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089086885.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2063065806.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087396572.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2060064359.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086819829.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2062204894.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086255553.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066919517.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089517146.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087889157.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066327319.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086427446.000001E134825000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/V
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEFD2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/on
        Source: WTvNL75dCr.exe, 00000002.00000002.2522451816.000001CDFF460000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
        Source: WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1E7000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF20A000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
        Source: WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1E7000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
        Source: WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1E7000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
        Source: WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1E7000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm
        Source: WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1E7000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm0U
        Source: WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1E7000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
        Source: WTvNL75dCr.exe, 00000002.00000002.2525551903.00007FF8A696A000.00000002.00000001.01000000.0000001E.sdmpString found in binary or memory: http://www.aiim.org/pdfa/ns/id/
        Source: WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF20A000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/
        Source: WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF20A000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/J
        Source: WTvNL75dCr.exe, 00000002.00000002.2525551903.00007FF8A696A000.00000002.00000001.01000000.0000001E.sdmpString found in binary or memory: http://www.color.org)
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEEDC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF0C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
        Source: WTvNL75dCr.exe, 00000002.00000003.2131862651.000001CDFF047000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEFD3000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2128829524.000001CDFF143000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
        Source: WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE784000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
        Source: WTvNL75dCr.exe, 00000002.00000002.2521047354.000001CDFE960000.00000004.00001000.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2120090379.000001CDFE801000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2120115800.000001CDFE79A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/howto/mro.html.
        Source: WTvNL75dCr.exe, 00000002.00000002.2520723499.000001CDFE520000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
        Source: WTvNL75dCr.exe, 00000002.00000002.2520723499.000001CDFE520000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
        Source: WTvNL75dCr.exe, 00000002.00000002.2520723499.000001CDFE5A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
        Source: WTvNL75dCr.exe, 00000002.00000002.2520723499.000001CDFE520000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
        Source: WTvNL75dCr.exe, 00000002.00000002.2520723499.000001CDFE5A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
        Source: WTvNL75dCr.exe, 00000002.00000002.2520723499.000001CDFE520000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
        Source: WTvNL75dCr.exe, 00000002.00000002.2520723499.000001CDFE520000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
        Source: WTvNL75dCr.exe, 00000002.00000002.2520723499.000001CDFE520000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
        Source: WTvNL75dCr.exe, 00000002.00000002.2520485125.000001CDFCBF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
        Source: WTvNL75dCr.exe, 00000002.00000002.2522281442.000001CDFF260000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
        Source: WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFF068000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
        Source: WTvNL75dCr.exe, 00000002.00000002.2520485125.000001CDFCBF9000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2121713938.000001CDFE74C000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2120972812.000001CDFE751000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE72A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
        Source: WTvNL75dCr.exe, 00000002.00000002.2519861692.000001CD80004000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
        Source: WTvNL75dCr.exe, 00000002.00000002.2522657283.000001CDFF738000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/psf/requests/pull/6710
        Source: WTvNL75dCr.exe, 00000002.00000002.2520723499.000001CDFE5A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
        Source: WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE72A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
        Source: WTvNL75dCr.exe, 00000002.00000002.2520485125.000001CDFCBF9000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2121713938.000001CDFE74C000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2120972812.000001CDFE751000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE72A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
        Source: WTvNL75dCr.exe, 00000002.00000003.2123474890.000001CDFEBFB000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE784000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86361.
        Source: WTvNL75dCr.exe, 00000002.00000002.2521430878.000001CDFED60000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata/wiki/Development-Methodology
        Source: WTvNL75dCr.exe, 00000002.00000002.2520485125.000001CDFCBF9000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2121713938.000001CDFE74C000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2120972812.000001CDFE751000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE72A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
        Source: WTvNL75dCr.exe, 00000002.00000002.2522281442.000001CDFF260000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEEDC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
        Source: WTvNL75dCr.exe, 00000002.00000002.2522451816.000001CDFF460000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
        Source: WTvNL75dCr.exe, 00000002.00000002.2522451816.000001CDFF460000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
        Source: WTvNL75dCr.exe, 00000002.00000002.2522451816.000001CDFF460000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/32902
        Source: WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFF068000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEFD2000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEFA1000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEFD3000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEFA1000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEFD2000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEFA1000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEFD3000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEFA1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
        Source: WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFF068000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
        Source: WTvNL75dCr.exe, 00000002.00000002.2522536288.000001CDFF580000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2124903132.000001CDFEADD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF151000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEFD2000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2128829524.000001CDFF159000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF15C000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEFD3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
        Source: WTvNL75dCr.exe, 00000002.00000002.2521430878.000001CDFED60000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/dist/v22.11.0/node-v22.11.0-win-x64.zip
        Source: WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFF068000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2522451816.000001CDFF460000.00000004.00001000.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF0C0000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2131862651.000001CDFF0D2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadata
        Source: WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFF068000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEEDC000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF0C0000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2131862651.000001CDFF0D2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/#file-format
        Source: WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFF068000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEEDC000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF0C0000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2131862651.000001CDFF0D2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file
        Source: WTvNL75dCr.exe, 00000002.00000002.2522366037.000001CDFF360000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/specifications/entry-points/
        Source: WTvNL75dCr.exe, 00000002.00000003.2123887945.000001CDFEBB4000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2118089866.000001CDFE721000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521344035.000001CDFEC60000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0205/
        Source: WTvNL75dCr.exe, 00000002.00000002.2531335208.00007FF8A8CF8000.00000002.00000001.01000000.00000004.sdmpString found in binary or memory: https://peps.python.org/pep-0263/
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2522657283.000001CDFF6B0000.00000004.00001000.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2124903132.000001CDFEADD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
        Source: WTvNL75dCr.exe, 00000002.00000002.2522657283.000001CDFF6B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.ioxe
        Source: WTvNL75dCr.exe, 00000002.00000002.2519861692.000001CD80004000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
        Source: WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFF068000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE72A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
        Source: WTvNL75dCr.exe, 00000002.00000003.2125715091.000001CDFEFC0000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEFA1000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2124795678.000001CDFEFA1000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2126398682.000001CDFEFC5000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEFA1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
        Source: WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFF068000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
        Source: WTvNL75dCr.exe, 00000002.00000002.2522366037.000001CDFF360000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
        Source: WTvNL75dCr.exe, 00000002.00000002.2522366037.000001CDFF360000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
        Source: WTvNL75dCr.exe, 00000000.00000003.2074280481.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2090286321.000001E134834000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087532708.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2064780551.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2073827268.000001E134832000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088263928.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134832000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2068257625.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2088623796.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089086885.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2063065806.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087396572.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2060064359.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086819829.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2062204894.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2086255553.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066919517.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2089517146.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2087889157.000001E134826000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000000.00000003.2066327319.000001E134825000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
        Source: WTvNL75dCr.exe, 00000002.00000002.2527900250.00007FF8A7AF0000.00000002.00000001.01000000.00000015.sdmp, WTvNL75dCr.exe, 00000002.00000002.2528911971.00007FF8A7FF4000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://www.openssl.org/H
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2124903132.000001CDFEADD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF151000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEFD2000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2128829524.000001CDFF159000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF15C000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEFD3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
        Source: WTvNL75dCr.exe, 00000002.00000002.2531335208.00007FF8A8CF8000.00000002.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.python.org/psf/license/)
        Source: WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFF068000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEEDC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
        Source: WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF20A000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/
        Source: WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF20A000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/0m
        Source: WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEFD2000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEFA1000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEFD3000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEFA1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
        Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C03969640_2_00007FF7C0396964
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C03789E00_2_00007FF7C03789E0
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C0395C000_2_00007FF7C0395C00
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C03710000_2_00007FF7C0371000
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C03821640_2_00007FF7C0382164
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C03819440_2_00007FF7C0381944
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C03839A40_2_00007FF7C03839A4
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C038DA5C0_2_00007FF7C038DA5C
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C037A2DB0_2_00007FF7C037A2DB
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C0381B500_2_00007FF7C0381B50
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C0393C100_2_00007FF7C0393C10
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C0382C100_2_00007FF7C0382C10
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C037A4740_2_00007FF7C037A474
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C03908C80_2_00007FF7C03908C8
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C03964180_2_00007FF7C0396418
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C037ACAD0_2_00007FF7C037ACAD
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C038E5700_2_00007FF7C038E570
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C0385D300_2_00007FF7C0385D30
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C0381D540_2_00007FF7C0381D54
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C03835A00_2_00007FF7C03835A0
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C0395E7C0_2_00007FF7C0395E7C
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C038DEF00_2_00007FF7C038DEF0
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C0389EA00_2_00007FF7C0389EA0
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C0381F600_2_00007FF7C0381F60
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C03887940_2_00007FF7C0388794
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C03997280_2_00007FF7C0399728
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C03817400_2_00007FF7C0381740
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C03798000_2_00007FF7C0379800
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C03918740_2_00007FF7C0391874
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C03880E40_2_00007FF7C03880E4
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C03940AC0_2_00007FF7C03940AC
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C03908C80_2_00007FF7C03908C8
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: String function: 00007FF7C0372710 appears 52 times
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5364 -s 968
        Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
        Source: python3.dll.0.drStatic PE information: No import functions for PE file found
        Source: WTvNL75dCr.exe, 00000000.00000003.2074280481.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dll4 vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2087532708.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtiff.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2064780551.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Network.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2070407793.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2088263928.000001E134826000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqminimal.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2068257625.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5WebSockets.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2059447292.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140_1.dllT vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2088623796.000001E134826000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqoffscreen.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2071857082.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2089086885.000001E134826000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwebgl.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2063065806.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Gui.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2087396572.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtga.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2060064359.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Core.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2086819829.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqico.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2062204894.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5DBus.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2086255553.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtuiotouchplugin.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2089517146.000001E134826000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwindows.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqsvg.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2087889157.000001E134826000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwebp.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2066327319.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5QmlModels.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2086427446.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqsvgicon.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2067852097.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Svg.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2059192229.000001E134823000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140.dllT vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2090135922.000001E134827000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwindowsvistastyle.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2087745294.000001E134826000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwbmp.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2089984329.000001E134826000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqxdgdesktopportal.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2086970615.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqjpeg.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2065463739.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Qml.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2073827268.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2073827268.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibEGL.dll. vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2086687983.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqicns.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000000.00000003.2086561910.000001E134825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqgif.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exeBinary or memory string: OriginalFilename vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2527708603.00007FF8A771C000.00000002.00000001.01000000.0000001A.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2534723654.00007FF8B93D2000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE784000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameD3D10Warp.dllj% vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2533877464.00007FF8B8836000.00000002.00000001.01000000.00000017.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2525909829.00007FF8A6BE9000.00000002.00000001.01000000.0000001E.sdmpBinary or memory string: OriginalFilenameQt5Gui.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2527900250.00007FF8A7AF0000.00000002.00000001.01000000.00000015.sdmpBinary or memory string: OriginalFilenamelibsslH vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2526552394.00007FF8A7133000.00000002.00000001.01000000.0000001D.sdmpBinary or memory string: OriginalFilenameQt5Widgets.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2530112071.00007FF8A8600000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: OriginalFilenameQt5Core.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2520661063.000001CDFE470000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2534191025.00007FF8B8B43000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2534316808.00007FF8B8C1D000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2535168641.00007FF8BA4F6000.00000002.00000001.01000000.0000000E.sdmpBinary or memory string: OriginalFilenamemsvcp140_1.dllT vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2532807369.00007FF8B7842000.00000002.00000001.01000000.00000021.sdmpBinary or memory string: OriginalFilenameqwindowsvistastyle.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2529245434.00007FF8A809F000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: OriginalFilenamemsvcp140.dllT vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2528911971.00007FF8A7FF4000.00000002.00000001.01000000.00000014.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2534589116.00007FF8B8F8E000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2533505566.00007FF8B7E4A000.00000002.00000001.01000000.00000013.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2533646323.00007FF8B7E63000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2534875770.00007FF8B9849000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2535026937.00007FF8B9F7A000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2524139192.00007FF8A62EB000.00000002.00000001.01000000.00000020.sdmpBinary or memory string: OriginalFilenameqwindows.dll( vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2532591828.00007FF8A8F30000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamepython313.dll. vs WTvNL75dCr.exe
        Source: WTvNL75dCr.exe, 00000002.00000002.2534443568.00007FF8B8CB6000.00000002.00000001.01000000.00000012.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs WTvNL75dCr.exe
        Source: Qt5Core.dll.0.drStatic PE information: Section: .qtmimed ZLIB complexity 0.997458770800317
        Source: classification engineClassification label: mal60.troj.spyw.evad.winEXE@13/142@1/1
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeMutant created: NULL
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1900:120:WilError_03
        Source: C:\Windows\System32\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5364
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6468:120:WilError_03
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522Jump to behavior
        Source: WTvNL75dCr.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
        Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
        Source: WTvNL75dCr.exeString found in binary or memory: <!--StartFragment-->
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile read: C:\Users\user\Desktop\WTvNL75dCr.exeJump to behavior
        Source: unknownProcess created: C:\Users\user\Desktop\WTvNL75dCr.exe "C:\Users\user\Desktop\WTvNL75dCr.exe"
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess created: C:\Users\user\Desktop\WTvNL75dCr.exe "C:\Users\user\Desktop\WTvNL75dCr.exe"
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess created: C:\Windows\System32\systeminfo.exe systeminfo
        Source: C:\Windows\System32\systeminfo.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Windows\System32\systeminfo.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get manufacturer
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5364 -s 968
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess created: C:\Users\user\Desktop\WTvNL75dCr.exe "C:\Users\user\Desktop\WTvNL75dCr.exe"Jump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess created: C:\Windows\System32\systeminfo.exe systeminfoJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get manufacturerJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: version.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: vcruntime140.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: libffi-8.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: qt5core.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: netapi32.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: winmm.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: msvcp140.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: msvcp140_1.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: vcruntime140_1.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: vcruntime140_1.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: libcrypto-3.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: libssl-3.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: mswsock.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: powrprof.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: pdh.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: umpdc.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: wtsapi32.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: qt5widgets.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: qt5gui.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: qt5gui.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: dwmapi.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: d3d11.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: dxgi.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: dxgi.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: d3d9.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: d3d10warp.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: dataexchange.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: dcomp.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: twinapi.appcore.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: dnsapi.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: rasadhlp.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeSection loaded: fwpuclnt.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ntmarta.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: esscli.dllJump to behavior
        Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dllJump to behavior
        Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dllJump to behavior
        Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dllJump to behavior
        Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
        Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dllJump to behavior
        Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dllJump to behavior
        Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dllJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32Jump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess created: C:\Windows\System32\systeminfo.exe systeminfo
        Source: Window RecorderWindow detected: More than 3 window changes detected
        Source: WTvNL75dCr.exeStatic PE information: Image base 0x140000000 > 0x60000000
        Source: WTvNL75dCr.exeStatic file information: File size 38749227 > 1048576
        Source: WTvNL75dCr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
        Source: WTvNL75dCr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
        Source: WTvNL75dCr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
        Source: WTvNL75dCr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
        Source: WTvNL75dCr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
        Source: WTvNL75dCr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
        Source: WTvNL75dCr.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
        Source: WTvNL75dCr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
        Source: Binary string: C:\Users\qt\work\qt\qtwebglplugin\plugins\platforms\qwebgl.pdb source: qwebgl.dll.0.dr
        Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: WTvNL75dCr.exe, 00000000.00000003.2087256531.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: WTvNL75dCr.exe, 00000000.00000003.2086427446.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: WTvNL75dCr.exe, 00000000.00000003.2086255553.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: WTvNL75dCr.exe, 00000002.00000002.2529084977.00007FF8A8065000.00000002.00000001.01000000.0000000D.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: WTvNL75dCr.exe, 00000000.00000003.2086819829.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
        Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: WTvNL75dCr.exe, 00000002.00000002.2528529300.00007FF8A7EB2000.00000002.00000001.01000000.00000014.sdmp
        Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: WTvNL75dCr.exe, 00000002.00000002.2534969989.00007FF8B9F74000.00000002.00000001.01000000.00000005.sdmp
        Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: WTvNL75dCr.exe, 00000000.00000003.2071857082.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2534813779.00007FF8B9845000.00000002.00000001.01000000.0000000F.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb%% source: WTvNL75dCr.exe, 00000002.00000002.2532731000.00007FF8B7837000.00000002.00000001.01000000.00000021.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb source: WTvNL75dCr.exe, 00000002.00000002.2532731000.00007FF8B7837000.00000002.00000001.01000000.00000021.sdmp
        Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: WTvNL75dCr.exe, 00000002.00000002.2534528872.00007FF8B8F83000.00000002.00000001.01000000.00000007.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwebp.pdb source: qwebp.dll.0.dr
        Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: WTvNL75dCr.exe, 00000002.00000002.2534266113.00007FF8B8C16000.00000002.00000001.01000000.00000016.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: WTvNL75dCr.exe, 00000000.00000003.2086819829.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: WTvNL75dCr.exe, 00000000.00000003.2086255553.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdbT source: WTvNL75dCr.exe, 00000002.00000002.2529631755.00007FF8A8526000.00000002.00000001.01000000.0000000C.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Gui.pdb source: WTvNL75dCr.exe, 00000002.00000002.2525551903.00007FF8A696A000.00000002.00000001.01000000.0000001E.sdmp
        Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: WTvNL75dCr.exe, 00000002.00000002.2534101163.00007FF8B8B3B000.00000002.00000001.01000000.0000000A.sdmp
        Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: WTvNL75dCr.exe, 00000002.00000002.2534672221.00007FF8B93CD000.00000002.00000001.01000000.00000009.sdmp
        Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: WTvNL75dCr.exe, 00000002.00000002.2533588197.00007FF8B7E59000.00000002.00000001.01000000.00000011.sdmp
        Source: Binary string: D:\a\1\b\bin\amd64\python313.pdb source: WTvNL75dCr.exe, 00000002.00000002.2531335208.00007FF8A8CF8000.00000002.00000001.01000000.00000004.sdmp
        Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: WTvNL75dCr.exe, 00000000.00000003.2070407793.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbBB source: WTvNL75dCr.exe, 00000000.00000003.2087532708.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platformthemes\qxdgdesktopportal.pdb source: WTvNL75dCr.exe, 00000000.00000003.2089984329.000001E134826000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: WTvNL75dCr.exe, 00000002.00000002.2527540692.00007FF8A7717000.00000002.00000001.01000000.0000001A.sdmp
        Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdb source: WTvNL75dCr.exe, 00000000.00000003.2059447292.000001E134825000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2535114680.00007FF8BA4F3000.00000002.00000001.01000000.0000000E.sdmp
        Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: WTvNL75dCr.exe, 00000002.00000002.2528529300.00007FF8A7F4A000.00000002.00000001.01000000.00000014.sdmp
        Source: Binary string: D:\a\1\b\libssl-3.pdbDD source: WTvNL75dCr.exe, 00000002.00000002.2527839730.00007FF8A7AB5000.00000002.00000001.01000000.00000015.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdb source: WTvNL75dCr.exe, 00000002.00000002.2529631755.00007FF8A8526000.00000002.00000001.01000000.0000000C.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: WTvNL75dCr.exe, 00000000.00000003.2087532708.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: WTvNL75dCr.exe, 00000000.00000003.2086561910.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: WTvNL75dCr.exe, 00000000.00000003.2087396572.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: WTvNL75dCr.exe, 00000002.00000002.2534969989.00007FF8B9F74000.00000002.00000001.01000000.00000005.sdmp
        Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: WTvNL75dCr.exe, 00000002.00000002.2528529300.00007FF8A7F4A000.00000002.00000001.01000000.00000014.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: WTvNL75dCr.exe, 00000000.00000003.2086687983.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: WTvNL75dCr.exe, 00000002.00000002.2534391795.00007FF8B8CB3000.00000002.00000001.01000000.00000012.sdmp
        Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: WTvNL75dCr.exe, 00000002.00000002.2534101163.00007FF8B8B3B000.00000002.00000001.01000000.0000000A.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtwebglplugin\plugins\platforms\qwebgl.pdb11 source: qwebgl.dll.0.dr
        Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: WTvNL75dCr.exe, 00000002.00000002.2533825501.00007FF8B8833000.00000002.00000001.01000000.00000017.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: WTvNL75dCr.exe, 00000002.00000002.2526353829.00007FF8A6F6A000.00000002.00000001.01000000.0000001D.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: WTvNL75dCr.exe, 00000002.00000002.2524003212.00007FF8A6284000.00000002.00000001.01000000.00000020.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: WTvNL75dCr.exe, 00000000.00000003.2087745294.000001E134826000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: WTvNL75dCr.exe, 00000002.00000002.2520661063.000001CDFE470000.00000002.00000001.01000000.00000006.sdmp
        Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libEGL.pdb source: WTvNL75dCr.exe, 00000000.00000003.2073827268.000001E134825000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: D:\a\1\b\libssl-3.pdb source: WTvNL75dCr.exe, 00000002.00000002.2527839730.00007FF8A7AB5000.00000002.00000001.01000000.00000015.sdmp
        Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: WTvNL75dCr.exe, 00000002.00000002.2533360902.00007FF8B7E2E000.00000002.00000001.01000000.00000013.sdmp
        Source: WTvNL75dCr.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
        Source: WTvNL75dCr.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
        Source: WTvNL75dCr.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
        Source: WTvNL75dCr.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
        Source: WTvNL75dCr.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
        Source: VCRUNTIME140.dll.0.drStatic PE information: 0x78BDDED1 [Sat Mar 11 17:01:05 2034 UTC]
        Source: VCRUNTIME140.dll.0.drStatic PE information: section name: fothk
        Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
        Source: VCRUNTIME140.dll0.0.drStatic PE information: section name: _RDATA
        Source: opengl32sw.dll.0.drStatic PE information: section name: _RDATA
        Source: qtuiotouchplugin.dll.0.drStatic PE information: section name: .qtmetad
        Source: qsvgicon.dll.0.drStatic PE information: section name: .qtmetad
        Source: MSVCP140.dll.0.drStatic PE information: section name: .didat
        Source: Qt5Core.dll.0.drStatic PE information: section name: .qtmimed
        Source: libcrypto-3.dll.0.drStatic PE information: section name: .00cfg
        Source: qgif.dll.0.drStatic PE information: section name: .qtmetad
        Source: qicns.dll.0.drStatic PE information: section name: .qtmetad
        Source: qico.dll.0.drStatic PE information: section name: .qtmetad
        Source: qjpeg.dll.0.drStatic PE information: section name: .qtmetad
        Source: qsvg.dll.0.drStatic PE information: section name: .qtmetad
        Source: qtga.dll.0.drStatic PE information: section name: .qtmetad
        Source: qtiff.dll.0.drStatic PE information: section name: .qtmetad
        Source: qwbmp.dll.0.drStatic PE information: section name: .qtmetad
        Source: qwebp.dll.0.drStatic PE information: section name: .qtmetad
        Source: qminimal.dll.0.drStatic PE information: section name: .qtmetad
        Source: libssl-3.dll.0.drStatic PE information: section name: .00cfg
        Source: python313.dll.0.drStatic PE information: section name: PyRuntim
        Source: qoffscreen.dll.0.drStatic PE information: section name: .qtmetad
        Source: qwebgl.dll.0.drStatic PE information: section name: .qtmetad
        Source: qwindows.dll.0.drStatic PE information: section name: .qtmetad
        Source: qxdgdesktopportal.dll.0.drStatic PE information: section name: .qtmetad
        Source: qwindowsvistastyle.dll.0.drStatic PE information: section name: .qtmetad
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Quick.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qico.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5QmlModels.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platforms\qminimal.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\psutil\_psutil_windows.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\sip.cp313-win_amd64.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\opengl32sw.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\VCRUNTIME140.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\_queue.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platforms\qoffscreen.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Svg.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\_ctypes.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qicns.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\_bz2.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\VCRUNTIME140_1.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\QtWidgets.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Widgets.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\libEGL.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\_hashlib.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\_socket.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\select.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platforms\qwebgl.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\QtCore.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qtiff.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5WebSockets.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\VCRUNTIME140_1.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qtga.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qwbmp.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\libGLESv2.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Qml.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qgif.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\_decimal.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qwebp.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\QtGui.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\_wmi.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qsvg.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Network.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\libcrypto-3.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\unicodedata.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\_ssl.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Gui.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\MSVCP140_1.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\python313.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\python3.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Core.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5DBus.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\libffi-8.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\VCRUNTIME140.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\iconengines\qsvgicon.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\_lzma.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qjpeg.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platforms\qwindows.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\MSVCP140.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\charset_normalizer\md.cp313-win_amd64.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\charset_normalizer\md__mypyc.cp313-win_amd64.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\libssl-3.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\d3dcompiler_47.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C03776C0 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,0_2_00007FF7C03776C0
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\systeminfo.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

        Malware Analysis System Evasion

        barindex
        Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
        Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Quick.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qico.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5QmlModels.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platforms\qminimal.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\psutil\_psutil_windows.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\sip.cp313-win_amd64.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\opengl32sw.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\_queue.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platforms\qoffscreen.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\_ctypes.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Svg.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qicns.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\_bz2.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\QtWidgets.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\_hashlib.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\libEGL.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\_socket.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\select.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platforms\qwebgl.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\QtCore.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qtiff.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5WebSockets.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qtga.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qwbmp.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\libGLESv2.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Qml.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qgif.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\_decimal.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qwebp.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\_wmi.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\QtGui.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qsvg.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Network.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\unicodedata.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\_ssl.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\python313.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\python3.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5DBus.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\iconengines\qsvgicon.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\_lzma.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platforms\qwindows.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qjpeg.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\charset_normalizer\md.cp313-win_amd64.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\charset_normalizer\md__mypyc.cp313-win_amd64.pydJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\d3dcompiler_47.dllJump to dropped file
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-17411
        Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
        Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer FROM Win32_ComputerSystem
        Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
        Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C0379280 FindFirstFileExW,FindClose,0_2_00007FF7C0379280
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C03783C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF7C03783C0
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C0391874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF7C0391874
        Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Jump to behavior
        Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI65522\Jump to behavior
        Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Jump to behavior
        Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\Jump to behavior
        Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Jump to behavior
        Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\Jump to behavior
        Source: WTvNL75dCr.exe, 00000002.00000002.2521430878.000001CDFED60000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: ffQEMU
        Source: WTvNL75dCr.exe, 00000002.00000003.2126398682.000001CDFEEDC000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEEDC000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2124795678.000001CDFEEFC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWrdS
        Source: WTvNL75dCr.exe, 00000002.00000002.2525828776.00007FF8A6BD8000.00000008.00000001.01000000.0000001E.sdmpBinary or memory string: .?AVQEmulationPaintEngine@@
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess information queried: ProcessInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C037D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF7C037D12C
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C0393480 GetProcessHeap,0_2_00007FF7C0393480
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C037D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF7C037D12C
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C037D30C SetUnhandledExceptionFilter,0_2_00007FF7C037D30C
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C038A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF7C038A614
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C037C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF7C037C8A0
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess created: C:\Users\user\Desktop\WTvNL75dCr.exe "C:\Users\user\Desktop\WTvNL75dCr.exe"Jump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess created: C:\Windows\System32\systeminfo.exe systeminfoJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get manufacturerJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C0399570 cpuid 0_2_00007FF7C0399570
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platforms VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\certifi VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\charset_normalizer VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\_ctypes.pyd VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\_bz2.pyd VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\_lzma.pyd VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\sip.cp313-win_amd64.pyd VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\_socket.pyd VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\_hashlib.pyd VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\_queue.pyd VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\charset_normalizer VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\charset_normalizer VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\charset_normalizer VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\charset_normalizer VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\charset_normalizer\md__mypyc.cp313-win_amd64.pyd VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\certifi VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\psutil VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\psutil VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\psutil\_psutil_windows.pyd VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\QtWidgets.pyd VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\QtGui.pyd VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platforms\qminimal.dll VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platforms\qoffscreen.dll VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\Desktop\WTvNL75dCr.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65522 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C037D010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF7C037D010
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeCode function: 0_2_00007FF7C0395C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF7C0395C00

        Stealing of Sensitive Information

        barindex
        Yara detected Python BackDoor
        Source: Yara matchFile source: 00000002.00000003.2124245565.000001CDFEEB9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: WTvNL75dCr.exe PID: 5364, type: MEMORYSTR
        Opens network shares
        Source: C:\Users\user\Desktop\WTvNL75dCr.exeFile opened: \\Mac\shared\projects\loader\src\dropper\src\tmp\_main.pyJump to behavior

        Remote Access Functionality

        barindex
        Yara detected Python BackDoor
        Source: Yara matchFile source: 00000002.00000003.2124245565.000001CDFEEB9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: WTvNL75dCr.exe PID: 5364, type: MEMORYSTR

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid Accounts131
        Windows Management Instrumentation        		1
        DLL Side-Loading        		11
        Process Injection        		12
        Virtualization/Sandbox Evasion        		OS Credential Dumping1
        Network Share Discovery        		Remote Services1
        Archive Collected Data        		12
        Encrypted Channel        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault Accounts2
        Command and Scripting Interpreter        		Boot or Logon Initialization Scripts1
        DLL Side-Loading        		11
        Process Injection        		LSASS Memory2
        System Time Discovery        		Remote Desktop ProtocolData from Removable Media1
        Non-Application Layer Protocol        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain Accounts1
        Native API        		Logon Script (Windows)Logon Script (Windows)1
        Deobfuscate/Decode Files or Information        		Security Account Manager141
        Security Software Discovery        		SMB/Windows Admin SharesData from Network Shared Drive2
        Application Layer Protocol        		Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
        Obfuscated Files or Information        		NTDS12
        Virtualization/Sandbox Evasion        		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
        Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
        Software Packing        		LSA Secrets1
        Process Discovery        		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
        Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
        Timestomp        		Cached Domain Credentials2
        File and Directory Discovery        		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
        DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
        DLL Side-Loading        		DCSync44
        System Information Discovery        		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1578193 Sample: WTvNL75dCr.exe Startdate: 19/12/2024 Architecture: WINDOWS Score: 60 39 nodejs.org 2->39 45 Yara detected Python BackDoor 2->45 47 AI detected suspicious sample 2->47 9 WTvNL75dCr.exe 153 2->9         started        signatures3 process4 file5 31 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 9->31 dropped 33 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 9->33 dropped 35 C:\Users\user\AppData\Local\...\python313.dll, PE32+ 9->35 dropped 37 57 other files (none is malicious) 9->37 dropped 12 WTvNL75dCr.exe 9->12         started        process6 dnsIp7 41 nodejs.org 104.20.22.46, 443, 49705 CLOUDFLARENETUS United States 12->41 49 Opens network shares 12->49 16 systeminfo.exe 2 1 12->16         started        19 cmd.exe 1 12->19         started        21 WerFault.exe 19 16 12->21         started        signatures8 process9 signatures10 43 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 16->43 23 WmiPrvSE.exe 16->23         started        25 conhost.exe 16->25         started        27 WMIC.exe 1 19->27         started        29 conhost.exe 19->29         started        process11

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        WTvNL75dCr.exe6%VirustotalBrowse
        WTvNL75dCr.exe0%ReversingLabs

        Dropped Files

        SourceDetectionScannerLabelLink
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\MSVCP140.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\MSVCP140_1.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Core.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5DBus.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Gui.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Network.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Qml.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5QmlModels.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Quick.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Svg.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5WebSockets.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Widgets.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\VCRUNTIME140.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\VCRUNTIME140_1.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\d3dcompiler_47.dll3%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\libEGL.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\libGLESv2.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\opengl32sw.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qgif.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qicns.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qico.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qjpeg.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qsvg.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qtga.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qtiff.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qwbmp.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qwebp.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platforms\qminimal.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platforms\qoffscreen.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platforms\qwebgl.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platforms\qwindows.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\QtCore.pyd0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\QtGui.pyd0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\QtWidgets.pyd0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\sip.cp313-win_amd64.pyd0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\VCRUNTIME140.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\VCRUNTIME140_1.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\_bz2.pyd0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\_ctypes.pyd0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\_decimal.pyd0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\_hashlib.pyd0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\_lzma.pyd0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\_queue.pyd0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\_socket.pyd0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\_ssl.pyd0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\_wmi.pyd0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\charset_normalizer\md.cp313-win_amd64.pyd0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\charset_normalizer\md__mypyc.cp313-win_amd64.pyd0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\libcrypto-3.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\libffi-8.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\libssl-3.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\psutil\_psutil_windows.pyd0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\python3.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\python313.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\_MEI65522\select.pyd0%ReversingLabs

        Unpacked PE Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        http://repository.swisssign.com/on0%Avira URL Cloudsafe
        http://ocsp.accv.esQ0%Avira URL Cloudsafe
        https://requests.readthedocs.ioxe0%Avira URL Cloudsafe
        http://repository.swisssign.com/V0%Avira URL Cloudsafe

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        nodejs.org
        		104.20.22.46
        		truefalse
          		high

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          https://github.com/giampaolo/psutil/issues/875.WTvNL75dCr.exe, 00000002.00000002.2519861692.000001CD80004000.00000004.00001000.00020000.00000000.sdmpfalse
            		high
            https://nodejs.org/dist/v22.11.0/node-v22.11.0-win-x64.zipWTvNL75dCr.exe, 00000002.00000002.2521430878.000001CDFED60000.00000004.00001000.00020000.00000000.sdmpfalse
              		high
              https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#WTvNL75dCr.exe, 00000002.00000002.2520485125.000001CDFCBF9000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2121713938.000001CDFE74C000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2120972812.000001CDFE751000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE72A000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-fileWTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFF068000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEEDC000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF0C0000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2131862651.000001CDFF0D2000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  http://goo.gl/zeJZl.WTvNL75dCr.exe, 00000002.00000002.2522657283.000001CDFF764000.00000004.00001000.00020000.00000000.sdmpfalse
                    		high
                    https://tools.ietf.org/html/rfc2388#section-4.4WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFF068000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE72A000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      http://crl.securetrust.com/STCA.crlceliab.)WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE784000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://packaging.python.org/en/latest/specifications/entry-points/#file-formatWTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFF068000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEEDC000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF0C0000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2131862651.000001CDFF0D2000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963WTvNL75dCr.exe, 00000002.00000002.2522281442.000001CDFF260000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              http://cacerts.digiWTvNL75dCr.exe, 00000000.00000002.2541159415.000001E134834000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://peps.python.org/pep-0205/WTvNL75dCr.exe, 00000002.00000003.2123887945.000001CDFEBB4000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2118089866.000001CDFE721000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521344035.000001CDFEC60000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		high
                                  http://crl.dhimyotis.com/certignarootca.crlWTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF20A000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    http://curl.haxx.se/rfc/cookie_spec.htmlWTvNL75dCr.exe, 00000002.00000002.2522536288.000001CDFF580000.00000004.00001000.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2128829524.000001CDFF143000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      http://ocsp.accv.esWTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF20A000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        http://repository.swisssign.com/VWTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filenameWTvNL75dCr.exe, 00000002.00000002.2520723499.000001CDFE520000.00000004.00001000.00020000.00000000.sdmpfalse
                                          		high
                                          https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyWTvNL75dCr.exe, 00000002.00000002.2522366037.000001CDFF360000.00000004.00001000.00020000.00000000.sdmpfalse
                                            		high
                                            https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688WTvNL75dCr.exe, 00000002.00000002.2520723499.000001CDFE5A4000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		high
                                              https://httpbin.org/getWTvNL75dCr.exe, 00000002.00000002.2522536288.000001CDFF580000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		high
                                                https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_codeWTvNL75dCr.exe, 00000002.00000002.2520723499.000001CDFE520000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://wwww.certigna.fr/autorites/0mWTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF20A000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerWTvNL75dCr.exe, 00000002.00000002.2520485125.000001CDFCBF9000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2121713938.000001CDFE74C000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2120972812.000001CDFE751000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE72A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://github.com/python/cpython/issues/86361.WTvNL75dCr.exe, 00000002.00000003.2123474890.000001CDFEBFB000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE784000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://mail.python.org/pipermail/python-dev/2012-June/120787.html.WTvNL75dCr.exe, 00000002.00000002.2522536288.000001CDFF668000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://httpbin.org/WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://wwww.certigna.fr/autorites/WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF20A000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_moduleWTvNL75dCr.exe, 00000002.00000002.2520723499.000001CDFE520000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_cachesWTvNL75dCr.exe, 00000002.00000002.2520723499.000001CDFE520000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://www.color.org)WTvNL75dCr.exe, 00000002.00000002.2525551903.00007FF8A696A000.00000002.00000001.01000000.0000001E.sdmpfalse
                                                                    		high
                                                                    http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE784000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEEDC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_syWTvNL75dCr.exe, 00000002.00000002.2520485125.000001CDFCBF9000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2121713938.000001CDFE74C000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2120972812.000001CDFE751000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE72A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadataWTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFF068000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2522451816.000001CDFF460000.00000004.00001000.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF0C0000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2131862651.000001CDFF0D2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://crl.securetrust.com/STCA.crlWTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://wwwsearch.sf.net/):WTvNL75dCr.exe, 00000002.00000003.2131862651.000001CDFF047000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEFD3000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2128829524.000001CDFF143000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://github.com/python/importlib_metadata/wiki/Development-MethodologyWTvNL75dCr.exe, 00000002.00000002.2521430878.000001CDFED60000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1E7000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF20A000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://www.accv.es/legislacion_c.htmWTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1E7000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://tools.ietf.org/html/rfc6125#section-6.4.3WTvNL75dCr.exe, 00000002.00000002.2522451816.000001CDFF460000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://crl.xrampsecurity.com/XGCA.crl0WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://www.cert.fnmt.es/dpcs/WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF20A000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://google.com/mailWTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEFD2000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEFA1000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEFD3000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEFA1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://packaging.python.org/specifications/entry-points/WTvNL75dCr.exe, 00000002.00000002.2522366037.000001CDFF360000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://www.accv.es00WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1E7000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://www.python.org/psf/license/)WTvNL75dCr.exe, 00000002.00000002.2531335208.00007FF8A8CF8000.00000002.00000001.01000000.00000004.sdmpfalse
                                                                                                  		high
                                                                                                  https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pyWTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE72A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://foss.heptapod.net/pypy/pypy/-/issues/3539WTvNL75dCr.exe, 00000002.00000002.2522281442.000001CDFF260000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEEDC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://google.com/WTvNL75dCr.exe, 00000002.00000003.2150955752.000001CDFEAFC000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521135425.000001CDFEA60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2128919887.000001CDFEAE3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://repository.swisssign.com/onWTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEFD2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          • Avira URL Cloud: safe
                                                                                                          		unknown
                                                                                                          https://mahler:8092/site-updates.pyWTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF151000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEFD2000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2128829524.000001CDFF159000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF15C000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEFD3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://crl.securetrust.com/SGCA.crlWTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://.../back.jpegWTvNL75dCr.exe, 00000002.00000002.2522536288.000001CDFF580000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://tools.ietf.org/html/rfc7231#section-4.3.6)WTvNL75dCr.exe, 00000002.00000003.2125715091.000001CDFEFC0000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEFA1000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2124795678.000001CDFEFA1000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2126398682.000001CDFEFC5000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEFA1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://httpbin.org/postWTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2124903132.000001CDFEADD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_sourceWTvNL75dCr.exe, 00000002.00000002.2520723499.000001CDFE5A4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://github.com/Ousret/charset_normalizerWTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFF068000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://www.firmaprofesional.com/cps0WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_specWTvNL75dCr.exe, 00000002.00000002.2520723499.000001CDFE520000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://github.com/urllib3/urllib3/issues/2920WTvNL75dCr.exe, 00000002.00000002.2522451816.000001CDFF460000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://crl.securetrust.com/SGCA.crl0WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE72A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_dataWTvNL75dCr.exe, 00000002.00000002.2520485125.000001CDFCBF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://yahoo.com/WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEFD2000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEFA1000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEFD3000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEFA1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    http://crl.securetrust.com/STCA.crl0WTvNL75dCr.exe, 00000002.00000002.2520919607.000001CDFE72A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEEDC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://html.spec.whatwg.org/multipage/WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFF068000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          http://www.quovadisglobal.com/cps0WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF0C0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crlWTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1E7000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsWTvNL75dCr.exe, 00000002.00000002.2522366037.000001CDFF360000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1E7000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://www.rfc-editor.org/rfc/rfc8259#section-8.1WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFF068000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEEDC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    http://ocsp.accv.esQWTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF20A000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                                    		unknown
                                                                                                                                                    https://requests.readthedocs.ioWTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2522657283.000001CDFF6B0000.00000004.00001000.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2124903132.000001CDFEADD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      http://repository.swisssign.com/WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        http://crl.xrampsecurity.com/XGCA.crlWTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://www.python.orgWTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2124903132.000001CDFEADD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFF068000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              http://www.accv.es/legislacion_c.htm0UWTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1E7000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                http://www.aiim.org/pdfa/ns/id/WTvNL75dCr.exe, 00000002.00000002.2525551903.00007FF8A696A000.00000002.00000001.01000000.0000001E.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  http://ocsp.accv.es0WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF1E7000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://www.python.org/WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF151000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEFD2000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2128829524.000001CDFF159000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF15C000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEFD3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://json.orgWTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://docs.python.org/3/howto/mro.html.WTvNL75dCr.exe, 00000002.00000002.2521047354.000001CDFE960000.00000004.00001000.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2120090379.000001CDFE801000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2120115800.000001CDFE79A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_packageWTvNL75dCr.exe, 00000002.00000002.2520723499.000001CDFE520000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://twitter.com/WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFF068000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://stackoverflow.com/questions/4457745#4457745.WTvNL75dCr.exe, 00000002.00000002.2519861692.000001CD80004000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://requests.readthedocs.ioxeWTvNL75dCr.exe, 00000002.00000002.2522657283.000001CDFF6B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                                                                		unknown
                                                                                                                                                                                http://www.quovadisglobal.com/cpsWTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_moduleWTvNL75dCr.exe, 00000002.00000002.2520723499.000001CDFE5A4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://google.com/WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFF068000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEFD2000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEFA1000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEFD3000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEFA1000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://google.com/mail/WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF03A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        http://www.cert.fnmt.es/dpcs/JWTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF20A000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          http://google.com/mail/WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000003.2130250263.000001CDFEEDC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://github.com/urllib3/urllib3/issues/32902WTvNL75dCr.exe, 00000002.00000002.2522451816.000001CDFF460000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              https://github.com/urllib3/urllib3/issues/3290WTvNL75dCr.exe, 00000002.00000002.2522451816.000001CDFF460000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                https://www.openssl.org/HWTvNL75dCr.exe, 00000002.00000002.2527900250.00007FF8A7AF0000.00000002.00000001.01000000.00000015.sdmp, WTvNL75dCr.exe, 00000002.00000002.2528911971.00007FF8A7FF4000.00000002.00000001.01000000.00000014.sdmpfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  http://crl.certigna.fr/certignarootca.crl01WTvNL75dCr.exe, 00000002.00000003.2150042807.000001CDFF20A000.00000004.00000020.00020000.00000000.sdmp, WTvNL75dCr.exe, 00000002.00000002.2521541963.000001CDFF1AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		high
                                                                                                                                                                                                    https://peps.python.org/pep-0263/WTvNL75dCr.exe, 00000002.00000002.2531335208.00007FF8A8CF8000.00000002.00000001.01000000.00000004.sdmpfalse
                                                                                                                                                                                                      		high
                                                                                                                                                                                                      https://github.com/psf/requests/pull/6710WTvNL75dCr.exe, 00000002.00000002.2522657283.000001CDFF738000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        		high

                                                                                                                                                                                                        World Map of Contacted IPs

                                                                                                                                                                                                        • No. of IPs < 25%
                                                                                                                                                                                                        • 25% < No. of IPs < 50%
                                                                                                                                                                                                        • 50% < No. of IPs < 75%
                                                                                                                                                                                                        • 75% < No. of IPs

                                                                                                                                                                                                        Public IPs

                                                                                                                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                        104.20.22.46
                                                                                                                                                                                                        		nodejs.orgUnited States
                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse

                                                                                                                                                                                                        General Information

                                                                                                                                                                                                        Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                        Analysis ID:1578193
                                                                                                                                                                                                        Start date and time:2024-12-19 12:09:14 +01:00
                                                                                                                                                                                                        Joe Sandbox product:CloudBasic
                                                                                                                                                                                                        Overall analysis duration:0h 9m 6s
                                                                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                                                                        Report type:full
                                                                                                                                                                                                        Cookbook file name:default.jbs
                                                                                                                                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                        Number of analysed new started processes analysed:15
                                                                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                                                                        Number of injected processes analysed:0
                                                                                                                                                                                                        Technologies:
                                                                                                                                                                                                        • HCA enabled
                                                                                                                                                                                                        • EGA enabled
                                                                                                                                                                                                        • AMSI enabled
                                                                                                                                                                                                        Analysis Mode:default
                                                                                                                                                                                                        Analysis stop reason:Timeout
                                                                                                                                                                                                        Sample name:WTvNL75dCr.exe
                                                                                                                                                                                                        renamed because original name is a hash value
                                                                                                                                                                                                        Original Sample Name:94b19d2d17eeb9168cb11f97d532ee65962f70a2c1249f3abfc8625c8c3193f8.exe
                                                                                                                                                                                                        Detection:MAL
                                                                                                                                                                                                        Classification:mal60.troj.spyw.evad.winEXE@13/142@1/1
                                                                                                                                                                                                        EGA Information:
                                                                                                                                                                                                        • Successful, ratio: 50%
                                                                                                                                                                                                        HCA Information:
                                                                                                                                                                                                        • Successful, ratio: 74%
                                                                                                                                                                                                        • Number of executed functions: 37
                                                                                                                                                                                                        • Number of non-executed functions: 73
                                                                                                                                                                                                        Cookbook Comments:
                                                                                                                                                                                                        • Found application associated with file extension: .exe

                                                                                                                                                                                                        Warnings

                                                                                                                                                                                                        • Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                                                                                                                                                                                                        • Excluded IPs from analysis (whitelisted): 20.42.73.29, 13.107.246.63, 4.175.87.197, 40.126.53.18
                                                                                                                                                                                                        • Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                        • Execution Graph export aborted for target WTvNL75dCr.exe, PID 5364 because there are no executed function
                                                                                                                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.

                                                                                                                                                                                                        Simulations

                                                                                                                                                                                                        Behavior and APIs

                                                                                                                                                                                                        TimeTypeDescription
                                                                                                                                                                                                        06:10:16API Interceptor1x Sleep call for process: WTvNL75dCr.exe modified
                                                                                                                                                                                                        06:10:17API Interceptor1x Sleep call for process: WMIC.exe modified
                                                                                                                                                                                                        06:10:52API Interceptor1x Sleep call for process: WerFault.exe modified

                                                                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                                                                        IPs

                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                        104.20.22.46wmdqEYgW2i.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                                                                          Bootstrapper.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            download.ps1Get hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                              y3x8pjQ1Ci.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                download.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  download.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    download.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      check.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        sDKRz09zM7.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                                                                                                                                          kwlYObMOSn.exeGet hashmaliciousXWormBrowse

                                                                                                                                                                                                                            Domains

                                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                            nodejs.orgwmdqEYgW2i.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                                                                                            • 104.20.22.46
                                                                                                                                                                                                                            Bootstrapper.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            • 104.20.22.46
                                                                                                                                                                                                                            https://f29cc861.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exeGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                            • 104.20.23.46
                                                                                                                                                                                                                            download.ps1Get hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                            • 104.20.22.46
                                                                                                                                                                                                                            y3x8pjQ1Ci.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            • 104.20.22.46
                                                                                                                                                                                                                            y3x8pjQ1Ci.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            • 104.20.23.46
                                                                                                                                                                                                                            download.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            • 104.20.22.46
                                                                                                                                                                                                                            download.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            • 104.20.22.46
                                                                                                                                                                                                                            download.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            • 104.20.22.46

                                                                                                                                                                                                                            ASNs

                                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                            CLOUDFLARENETUShttps://github.com/starise/win11-virtual-desktop-extension/releases/download/1.1.0/VirtualDesktopExtension-1.1.0.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            • 1.1.1.1
                                                                                                                                                                                                                            https://e.trustifi.com/#/fff2a1/305619/6dc30e/bb62bb/581844/11c063/a3c1ce/c0ba4d/e8666a/ef542d/85972d/627493/9a11d6/1f4096/1d247f/838c7e/cd63d6/82c9fe/baf706/264690/9188a6/a54400/a45112/68deb9/a1d612/148c70/62dcf5/9cb4f7/9713c0/de2350/884a31/c8623a/2f5546/ab6255/63291e/390e78/6b371c/add804/d4bbed/01f0b4/6023ca/9b7c0b/b0881b/bd8fbb/380790/942e2d/c30675/2c79c4/594b5b/fa5dac/c17e29/ec9861/3d4f90/8d1dd9/15a5f1/e3d291/035383/58ff7f/dcf654/c36a6d/ac2219/0a7478/f49f04/50db6b/1c0640/509cd9/d5eb23/7e01e4/b5bcef/2cfb1e/1cd263/f68c45/7325e0/8e5d9b/dacf2c/074706/a0f040/11bf65/f8b4f7/b49b4f/da74f6/285aa9/b249dd/d9b9c7/1a738e/07e7fa/7ea43f/a69f97/422641/436e51/504e86Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                            • 104.17.25.14
                                                                                                                                                                                                                            NieuwBetalingsbevestigingvoor vanas.eu.htmGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                            • 104.17.25.14
                                                                                                                                                                                                                            https://init-area.fr/ABGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            • 104.17.25.14
                                                                                                                                                                                                                            https://registry.paratext.orgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            • 104.26.6.135
                                                                                                                                                                                                                            DHL_231437894819.bat.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                            • 104.26.13.205
                                                                                                                                                                                                                            4089137200.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                            • 172.67.74.152
                                                                                                                                                                                                                            Overheaped237.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                                                                                                            • 104.21.67.152
                                                                                                                                                                                                                            HUSDGHCE23ED.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                                                                                            • 172.67.177.134
                                                                                                                                                                                                                            file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                            • 172.67.179.109

                                                                                                                                                                                                                            JA3 Fingerprints

                                                                                                                                                                                                                            ⊘No context

                                                                                                                                                                                                                            Dropped Files

                                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\MSVCP140.dllFileScanner.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              MacAttack.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                download.ps1Get hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                  y3x8pjQ1Ci.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                    y3x8pjQ1Ci.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      download.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                        download.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                          download.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                            download.ps1Get hashmaliciousUnknownBrowse

                                                                                                                                                                                                                                              Created / dropped Files

                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_WTvNL75dCr.exe_9e582b949571b490dfc358bda39d6d65633a8_e366b6b7_48ce193a-dbc1-4b49-91df-76a09c442083\Report.wer

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):65536
                                                                                                                                                                                                                                              Entropy (8bit):1.3574617847340964
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:192:0W7lIw3490KloA7joRXbEURBhV96nXwNdwqo59Sn3Mo1uSwnGJYedmjVIjv1SnYs:3D34+KloA7jM3wn43RzuiFdY4lO8cl
                                                                                                                                                                                                                                              MD5:B45C7F977F04F319711FEFED251F6A5C
                                                                                                                                                                                                                                              SHA1:2A7458525FC69AE30BB7625A2BDB3D0FC9409999
                                                                                                                                                                                                                                              SHA-256:9904194999642FC6D80F37D7D164A1187F3CF6F04F5663D7E2F5EE80E1457A91
                                                                                                                                                                                                                                              SHA-512:E69329A2FBC24A3672EA85032BE30C9CEA0F1AC1086497136F739A73A36615E50BB1A7DD1B9A3848A486A2A0B9D79C2868EC3720799FD5373015B86A3C1CB491
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                                                              Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.0.8.0.2.2.2.3.5.2.8.3.6.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.0.8.0.2.2.2.8.5.2.8.3.8.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.8.c.e.1.9.3.a.-.d.b.c.1.-.4.b.4.9.-.9.1.d.f.-.7.6.a.0.9.c.4.4.2.0.8.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.9.1.a.4.d.0.4.-.b.7.6.5.-.4.7.f.b.-.8.b.f.c.-.2.4.5.4.d.8.1.d.1.0.d.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.W.T.v.N.L.7.5.d.C.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.f.4.-.0.0.0.1.-.0.0.1.4.-.e.3.9.4.-.e.f.9.2.0.6.5.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.4.8.8.d.c.1.c.a.2.6.8.6.b.4.8.f.b.5.2.1.a.0.c.7.2.4.7.f.e.0.8.0.0.0.0.f.f.f.f.!.0.0.0.0.8.a.8.d.f.5.9.b.5.9.9.4.9.d.a.5.d.6.1.3.b.d.e.8.f.a.a.d.d.d.a.0.2.5.0.9.b.7.6.7.!.W.T.v.N.L.7.5.d.C.r...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.2././.1.6.:.1.2.

                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER7300.tmp.dmp

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                                              File Type:Mini DuMP crash report, 15 streams, Thu Dec 19 11:10:22 2024, 0x1205a4 type
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):135204
                                                                                                                                                                                                                                              Entropy (8bit):2.0172694998358662
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:384:VCs3fkRurHkVC3PGY5AcM1+9Fen29tZLcz6foWdpP0iAgqBdF2io:Ys3AurEiPAQ9FI2RCyldpPOg0/Lo
                                                                                                                                                                                                                                              MD5:3BA0F57C043B4C1E25B538D7A53AF7DB
                                                                                                                                                                                                                                              SHA1:2E3C2592A7F00777945B238B1692315DE80E8C91
                                                                                                                                                                                                                                              SHA-256:1E3B48BA2340CC5337EEE66A72D9DD54689AA4D1185538B71788557AF3FBCA01
                                                                                                                                                                                                                                              SHA-512:79B4AACB57990727E6013076D132EBEA737F85B0840C58C1358E774C2B0ABD655FBD6B53B1430AC879D90F4842DADF4BA00249F30F80694358E191890633B277
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                                                              Preview:MDMP..a..... .........cg............$............%..8.......$....-......D....\..........`.......8...........T............%...............-.........../..............................................................................eJ......p0......Lw......................T.............cg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER743A.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):9624
                                                                                                                                                                                                                                              Entropy (8bit):3.7068814737679703
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:192:R6l7wVeJdj52m6Y9yUlZgmfLyDpDP89bUxQfn7R8m:R6lXJh5f6YYUlZgmfLyWUmfn7
                                                                                                                                                                                                                                              MD5:E067BAD8A7E9A096D6AE685D72212F8B
                                                                                                                                                                                                                                              SHA1:EA57B6443ABD10D36AF80FF930EA80A119228DD7
                                                                                                                                                                                                                                              SHA-256:7E258E23F8BCA602DF93155897694D13891EE4D6654A57FFFA6CF78A72B273D3
                                                                                                                                                                                                                                              SHA-512:0E648EF22AA0FB8CBF3FBBDD7C8110A5A64BAB9D18C1B4002B5AD0506923AF5D22042768CEA706F1AD5F643B5E8CA328062BFCC9E2BF6E6E682FBF0C6C1D8CD9
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.3.6.4.<./.P.i.

                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER746A.tmp.xml

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):4760
                                                                                                                                                                                                                                              Entropy (8bit):4.456445052009271
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:48:cvIwWl8zsVJg771I9mdKOWpW8VYDPYm8M4JAWDFjYyq8vBW5znndzrznqd:uIjfvI7pA7VWSJZuW45rndXznqd
                                                                                                                                                                                                                                              MD5:37F06F2C0B23895C1C7CBA7C8031E9A0
                                                                                                                                                                                                                                              SHA1:ACB424FF6D5B6EEE3997A09A3114F19C8924892E
                                                                                                                                                                                                                                              SHA-256:0A03A59247BF5F268D1F76E16B4A7176700DC26A3F9580BBA5B870E78E13D6DF
                                                                                                                                                                                                                                              SHA-512:EED8028F300E714A0111507ECA99303889A325A9F92A349450956E848B8544F7F00A9D43F653187A35F9DAF6312F27309EC23CCA1131E8DD35DBF1F49AA48A2C
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="638053" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\MSVCP140.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):590112
                                                                                                                                                                                                                                              Entropy (8bit):6.461874649448891
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:12288:xI88L4Wu4+oJ+xc39ax5Ms4ETs3rxSvYcRkdQEKZm+jWodEEVh51:xD89rxZfQEKZm+jWodEEP5
                                                                                                                                                                                                                                              MD5:01B946A2EDC5CC166DE018DBB754B69C
                                                                                                                                                                                                                                              SHA1:DBE09B7B9AB2D1A61EF63395111D2EB9B04F0A46
                                                                                                                                                                                                                                              SHA-256:88F55D86B50B0A7E55E71AD2D8F7552146BA26E927230DAF2E26AD3A971973C5
                                                                                                                                                                                                                                              SHA-512:65DC3F32FAF30E62DFDECB72775DF870AF4C3A32A0BF576ED1AAAE4B16AC6897B62B19E01DC2BF46F46FBE3F475C061F79CBE987EDA583FEE1817070779860E5
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Joe Sandbox View:
                                                                                                                                                                                                                                              • Filename: FileScanner.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                              • Filename: MacAttack.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                              • Filename: download.ps1, Detection: malicious, Browse
                                                                                                                                                                                                                                              • Filename: y3x8pjQ1Ci.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                              • Filename: y3x8pjQ1Ci.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                              • Filename: download.ps1, Detection: malicious, Browse
                                                                                                                                                                                                                                              • Filename: download.ps1, Detection: malicious, Browse
                                                                                                                                                                                                                                              • Filename: download.ps1, Detection: malicious, Browse
                                                                                                                                                                                                                                              • Filename: download.ps1, Detection: malicious, Browse
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........LS..-=..-=..-=.....-=..U...-=..-<.k-=.gB<..-=.gB9..-=.gB>..-=.gB8.=-=.gB=..-=.gB..-=.gB?..-=.Rich.-=.........PE..d.....t^.........." .....@..........."...............................................z....`A.........................................j..h....D..,...............L;...... A......(...@...8...............................0............P.......f..@....................text...,>.......@.................. ..`.rdata..r....P.......D..............@..@.data....:...`..."...N..............@....pdata..L;.......<...p..............@..@.didat..h...........................@....rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\MSVCP140_1.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):31728
                                                                                                                                                                                                                                              Entropy (8bit):6.499754548353504
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:384:rOY/H1SbuIqnX8ndnWc95gW3C8c+pBj0HRN7bULkcyHRN7rxTO6iuQl9xiv:yYIBqnMdxxWd4urv
                                                                                                                                                                                                                                              MD5:0FE6D52EB94C848FE258DC0EC9FF4C11
                                                                                                                                                                                                                                              SHA1:95CC74C64AB80785F3893D61A73B8A958D24DA29
                                                                                                                                                                                                                                              SHA-256:446C48C1224C289BD3080087FE15D6759416D64F4136ADDF30086ABD5415D83F
                                                                                                                                                                                                                                              SHA-512:C39A134210E314627B0F2072F4FFC9B2CE060D44D3365D11D8C1FE908B3B9403EBDD6F33E67D556BD052338D0ED3D5F16B54D628E8290FD3A155F55D36019A86
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.{.zl..zl..zl......xl..s...~l.....}l.....xl..zl..Ql......l.....il.....{l.....{l.....{l..Richzl..................PE..d.....t^.........." .........$......p.....................................................`A........................................p>..L....?..x....p.......`..X....:...A......p...P3..8............................3..0............0..@............................text............................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..X....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..p............8..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Core.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):6023664
                                                                                                                                                                                                                                              Entropy (8bit):6.768988071491288
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
                                                                                                                                                                                                                                              MD5:817520432A42EFA345B2D97F5C24510E
                                                                                                                                                                                                                                              SHA1:FEA7B9C61569D7E76AF5EFFD726B7FF6147961E5
                                                                                                                                                                                                                                              SHA-256:8D2FF4CE9096DDCCC4F4CD62C2E41FC854CFD1B0D6E8D296645A7F5FD4AE565A
                                                                                                                                                                                                                                              SHA-512:8673B26EC5421FCE8E23ADF720DE5690673BB4CE6116CB44EBCC61BBBEF12C0AD286DFD675EDBED5D8D000EFD7609C81AAE4533180CF4EC9CD5316E7028F7441
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......D.............................UJ......................................................W.....,..................r....................Rich............PE..d...;._.........." ..........-.......-......................................`\.....x.\...`...........................................L..O....T...... \.......U.. ....[......0\..%..,.H.T.....................H.(.....H.0............./.H............................text............................... ..`.rdata..F7%.../..8%.................@..@.data...x....PT..\...6T.............@....pdata... ....U.."....T.............@..@.qtmimed.....0W.......V.............@..P.rsrc........ \.......[.............@..@.reloc...%...0\..&....[.............@..B........................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5DBus.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):436720
                                                                                                                                                                                                                                              Entropy (8bit):6.392610185061176
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:6144:ZLvnUJ17UTGOkWHUe/W9TgYMDu96ixMZQ8IlXbKgp8aIDeN:KP7cGOGegTwu96ixMZQtlrPN
                                                                                                                                                                                                                                              MD5:0E8FF02D971B61B5D2DD1AC4DF01AE4A
                                                                                                                                                                                                                                              SHA1:638F0B46730884FA036900649F69F3021557E2FE
                                                                                                                                                                                                                                              SHA-256:1AA70B106A10C86946E23CAA9FC752DC16E29FBE803BBA1F1AB30D1C63EE852A
                                                                                                                                                                                                                                              SHA-512:7BA616EDE66B16D9F8B2A56C3117DB49A74D59D0D32EAA6958DE57EAC78F14B1C7F2DBBA9EAE4D77937399CF14D44535531BAF6F9DB16F357F8712DFAAE4346A
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D..*..*..*.....*...+..*.../..*.......*...)..*...+..*.O.+..*..+...*.O./..*.O.*..*.O....*.....*.O.(..*.Rich.*.........................PE..d...]._.........." .....\...<.......\..............................................K.....`..........................................h..to...................`...Q..............4.......T.......................(...`...0............p...............................text...yZ.......\.................. ..`.rdata..0....p.......`..............@..@.data...X....@......."..............@....pdata...Q...`...R...2..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Gui.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):7008240
                                                                                                                                                                                                                                              Entropy (8bit):6.674290383197779
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
                                                                                                                                                                                                                                              MD5:47307A1E2E9987AB422F09771D590FF1
                                                                                                                                                                                                                                              SHA1:0DFC3A947E56C749A75F921F4A850A3DCBF04248
                                                                                                                                                                                                                                              SHA-256:5E7D2D41B8B92A880E83B8CC0CA173F5DA61218604186196787EE1600956BE1E
                                                                                                                                                                                                                                              SHA-512:21B1C133334C7CA7BBBE4F00A689C580FF80005749DA1AA453CCEB293F1AD99F459CA954F54E93B249D406AEA038AD3D44D667899B73014F884AFDBD9C461C14
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......QH^~.)0-.)0-.)0-.Q.-.)0-...-.)0-.F4,.)0-.F3,.)0-.F5,.)0-.F1,.)0-.Y1,.)0-.B5,.)0-.B1,.)0-.)1-m,0-.Y4,.)0-.Y5,|(0-.Y0,.)0-.Y.-.)0-.).-.)0-.Y2,.)0-Rich.)0-................PE..d....._.........." ......?...+.....X.?.......................................k.....R.k...`.........................................pKK.....d.e.|....`k.......g.......j......pk..6....F.T................... .F.(.....F.0.............?.p+...........................text...2.?.......?................. ..`.rdata...z&...?..|&...?.............@..@.data....o... f.......f.............@....pdata........g.......f.............@..@.rsrc........`k.......j.............@..@.reloc...6...pk..8....j.............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Network.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):1340400
                                                                                                                                                                                                                                              Entropy (8bit):6.41486755163134
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:24576:eXPn73RXox1U9M0m+1ffSDY565RzHUY1iaRy95hdGehEM:+7hXU1U95m4ff9A5RviaRy9NGI
                                                                                                                                                                                                                                              MD5:3569693D5BAE82854DE1D88F86C33184
                                                                                                                                                                                                                                              SHA1:1A6084ACFD2AA4D32CEDFB7D9023F60EB14E1771
                                                                                                                                                                                                                                              SHA-256:4EF341AE9302E793878020F0740B09B0F31CB380408A697F75C69FDBD20FC7A1
                                                                                                                                                                                                                                              SHA-512:E5EFF4A79E1BDAE28A6CA0DA116245A9919023560750FC4A087CDCD0AB969C2F0EEEC63BBEC2CD5222D6824A01DD27D2A8E6684A48202EA733F9BB2FAB048B32
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........Yt..7'..7'..7'...'..7'..3&..7'}.3&..7'}.4&..7'}.2&..7'}.6&..7'..6&..7'0.6&..7'..6'c.7'0.2&2.7'0.7&..7'0..'..7'...'..7'0.5&..7'Rich..7'........................PE..d....._.........." .................................................................c....`......................................... ....n..,...h....................X..........,.......T...................p...(...@...0............................................text...C........................... ..`.rdata...g.......h..................@..@.data...XN...@...2... ..............@....pdata...............R..............@..@.rsrc................>..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Qml.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):3591664
                                                                                                                                                                                                                                              Entropy (8bit):6.333693598000157
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:98304:iPnt09+kVh2NrSdSG779LLLS/o/L4YqoY0Xba+mRRH2T:iPnt2ZVhT
                                                                                                                                                                                                                                              MD5:D055566B5168D7B1D4E307C41CE47C4B
                                                                                                                                                                                                                                              SHA1:043C0056E9951DA79EC94A66A784972532DC18EF
                                                                                                                                                                                                                                              SHA-256:30035484C81590976627F8FACE9507CAA8581A7DC7630CCCF6A8D6DE65CAB707
                                                                                                                                                                                                                                              SHA-512:4F12D17AA8A3008CAA3DDD0E41D3ED713A24F9B5A465EE93B2E4BECCF876D5BDF0259AA0D2DD77AD61BB59DC871F78937FFBE4D0F60638014E8EA8A27CAF228D
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.4...Z...Z...Z......Z..^...Z..Y...Z.._...Z..[...Z...[...Z...[...Z...[...Z..._...Z...Z...Z.......Z......Z...X...Z.Rich..Z.........PE..d......_.........." .....^$..........O$.......................................7.....}.7...`...........................................,......2.......6.......4. .....6.......6..J....).T.....................).(...p.).0............p$..%...........................text....\$......^$................. ..`.rdata......p$......b$.............@..@.data.........3..n....2.............@....pdata.. .....4......l4.............@..@.rsrc.........6......`6.............@..@.reloc...J....6..L...f6.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5QmlModels.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):438768
                                                                                                                                                                                                                                              Entropy (8bit):6.312090336793804
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:6144:k1tE6lq982HdyuEZ5gw+VHDZjZ0yOWm7Vdcm4GyasLCZCu6vdQp:k1tEuq9Hdyuo5gwguyOtVIup
                                                                                                                                                                                                                                              MD5:2030C4177B499E6118BE5B9E5761FCE1
                                                                                                                                                                                                                                              SHA1:050D0E67C4AA890C80F46CF615431004F2F4F8FC
                                                                                                                                                                                                                                              SHA-256:51E4E5A5E91F78774C44F69B599FAE4735277EF2918F7061778615CB5C4F6E81
                                                                                                                                                                                                                                              SHA-512:488F7D5D9D8DEEE9BBB9D63DAE346E46EFEB62456279F388B323777999B597C2D5AEA0EE379BDF94C9CBCFD3367D344FB6B5E90AC40BE2CE95EFA5BBDD363BCC
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..<...<...<...5.H.4...(...>.......*.......4.......8.......8......9...<...g....../......=....$.=...<.L.=......=...Rich<...................PE..d...M.._.........." .....(...r......d+..............................................MF....`.........................................0E...^..0................`.. F..................H...T.......................(.......0............@...............................text...N&.......(.................. ..`.rdata.......@.......,..............@..@.data...x/...0...(..................@....pdata.. F...`...H...>..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Quick.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):4148720
                                                                                                                                                                                                                                              Entropy (8bit):6.462183686222023
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:49152:EcDwCQsvkBD+ClI3IAVLA7Tr15SokomoqxQhT2bAssCFEUGX5ig:E7CKPsA3p0Z/QV/sS3Ag
                                                                                                                                                                                                                                              MD5:65F59CFC0C1C060CE20D3B9CEFFBAF46
                                                                                                                                                                                                                                              SHA1:CFD56D77506CD8C0671CA559D659DAB39E4AD3C2
                                                                                                                                                                                                                                              SHA-256:C81AD3C1111544064B1830C6F1AEF3C1FD13B401546AB3B852D697C0F4D854B3
                                                                                                                                                                                                                                              SHA-512:D6F6DC19F1A0495026CBA765B5A2414B6AF0DBFC37B5ACEED1CD0AE37B3B0F574B759A176D75B01EDD74C6CE9A3642D3D29A3FD7F166B53A41C8978F562B4B50
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!Fvge'.4e'.4e'.4l_.4i'.4.H.5m'.4.H.5a'.4.H.5|'.4.H.5c'.4.W.5o'.4qL.5`'.4e'.4.,.4.W.5.'.4.W.5d'.4.W.4d'.4e'.4d'.4.W.5d'.4Riche'.4........................PE..d......_.........." ......%..B......L.$.......................................?.......?...`.........................................0)2.P.....8.T.....>.......<..^...2?.......?.py......T.......................(.......0............ %..\...........................text.....%.......%................. ..`.rdata....... %.......%.............@..@.data....I...@;..2... ;.............@....pdata...^....<..`...R<.............@..@.rsrc.........>.......>.............@..@.reloc..py....?..z....>.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Svg.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):330736
                                                                                                                                                                                                                                              Entropy (8bit):6.381828869454302
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR
                                                                                                                                                                                                                                              MD5:03761F923E52A7269A6E3A7452F6BE93
                                                                                                                                                                                                                                              SHA1:2CE53C424336BCC8047E10FA79CE9BCE14059C50
                                                                                                                                                                                                                                              SHA-256:7348CFC6444438B8845FB3F59381227325D40CA2187D463E82FC7B8E93E38DB5
                                                                                                                                                                                                                                              SHA-512:DE0FF8EBFFC62AF279E239722E6EEDD0B46BC213E21D0A687572BFB92AE1A1E4219322233224CA8B7211FFEF52D26CB9FE171D175D2390E3B3E6710BBDA010CB
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............_._._..*_._,.^._..^._,.^._,.^._,.^._a.^._._=.._a.^._a.^._a.F_._.._._a.^._Rich._................PE..d......_.........." .........................................................@.......^....`.................................................((....... ...........0...........0..H...xL..T....................N..(....L..0............................................text............................... ..`.rdata..p...........................@..@.data...8...........................@....pdata...0.......2..................@..@.rsrc........ ......................@..@.reloc..H....0......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5WebSockets.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):149488
                                                                                                                                                                                                                                              Entropy (8bit):6.116105454277536
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3072:4sSkET6pEXb3loojg1Q2sorWvZXF2sorrLA7cG27Qhvvc:4sSd6pwzloDbsnX0sCrc7ct7QVc
                                                                                                                                                                                                                                              MD5:A016545F963548E0F37885E07EF945C7
                                                                                                                                                                                                                                              SHA1:CBE499E53AB0BD2DA21018F4E2092E33560C846F
                                                                                                                                                                                                                                              SHA-256:6B56F77DA6F17880A42D2F9D2EC8B426248F7AB2196A0F55D37ADE39E3878BC6
                                                                                                                                                                                                                                              SHA-512:47A3C965593B97392F8995C7B80394E5368D735D4C77F610AFD61367FFE7658A0E83A0DBD19962C4FA864D94F245A9185A915010AFA23467F999C833982654C2
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'`.CF.KCF.KCF.KJ>.KGF.K.).JAF.KW-.JAF.K.).JVF.K.).JKF.K.).J@F.K.6.JFF.KCF.K.G.K.6.JPF.K.6.JBF.K.6.KBF.KCF.KBF.K.6.JBF.KRichCF.K........................PE..d......_.........." .....$..........t(.......................................p.......5....`............................................."..l........P.......0.......,.......`..L...hw..T....................x..(....w..0............@...............................text....".......$.................. ..`.rdata..z....@.......(..............@..@.data...x...........................@....pdata.......0......................@..@.rsrc........P......."..............@..@.reloc..L....`.......(..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\Qt5Widgets.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):5498352
                                                                                                                                                                                                                                              Entropy (8bit):6.619117060971844
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
                                                                                                                                                                                                                                              MD5:4CD1F8FDCD617932DB131C3688845EA8
                                                                                                                                                                                                                                              SHA1:B090ED884B07D2D98747141AEFD25590B8B254F9
                                                                                                                                                                                                                                              SHA-256:3788C669D4B645E5A576DE9FC77FCA776BF516D43C89143DC2CA28291BA14358
                                                                                                                                                                                                                                              SHA-512:7D47D2661BF8FAC937F0D168036652B7CFE0D749B571D9773A5446C512C58EE6BB081FEC817181A90F4543EBC2367C7F8881FF7F80908AA48A7F6BB261F1D199
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x..................I.......I.......I.......I...........................................9.................................Rich............PE..d....._.........." ......3..P .......3.......................................T......MT...`.........................................0.D.P^....L.h....pS......0P..8....S.......S.d.....?.T...................`.?.(...0.?.0.............3.._...........................text.....3.......3................. ..`.rdata..8.....3.......3.............@..@.data.........O......dO.............@....pdata...8...0P..:....O.............@..@.rsrc........pS......4S.............@..@.reloc..d.....S......:S.............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\VCRUNTIME140.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):101872
                                                                                                                                                                                                                                              Entropy (8bit):6.5661918084228725
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:RCKWZGuEK0mOLSTxoPl9GIcuZrxi4hXX9oix8H+NCIecbGShwZul:RFWY1WxgGStJ8H2CIecbG36
                                                                                                                                                                                                                                              MD5:971DBBE854FC6AB78C095607DFAD7B5C
                                                                                                                                                                                                                                              SHA1:1731FB947CD85F9017A95FDA1DC5E3B0F6B42CA2
                                                                                                                                                                                                                                              SHA-256:5E197A086B6A7711BAA09AFE4EA7C68F0E777B2FF33F1DF25A21F375B7D9693A
                                                                                                                                                                                                                                              SHA-512:B966AAB9C0D9459FADA3E5E96998292D6874A7078924EA2C171F0A1A50B0784C24CC408D00852BEC48D6A01E67E41D017684631176D3E90151EC692161F1814D
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w.............t:..............................................................Rich....................PE..d.....t^.........." .........^.......................................................e....`A.........................................0..4....9.......p.......P.......L...A..............8........................... ...0............................................text...2........................... ..`.rdata...?.......@..................@..@.data...0....@.......4..............@....pdata.......P.......8..............@..@_RDATA.......`.......D..............@..@.rsrc........p.......F..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\VCRUNTIME140_1.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):44528
                                                                                                                                                                                                                                              Entropy (8bit):6.627837381503075
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:384:Aim/NRETi8kykt25HwviU5fJUiP2551xWmbTqOA7SXf+Ny85xM8ATJWr3KWoC8cS:0Ie8kySL2iPQxdvjAevcMESW5lxJG
                                                                                                                                                                                                                                              MD5:6BC084255A5E9EB8DF2BCD75B4CD0777
                                                                                                                                                                                                                                              SHA1:CF071AD4E512CD934028F005CABE06384A3954B6
                                                                                                                                                                                                                                              SHA-256:1F0F5F2CE671E0F68CF96176721DF0E5E6F527C8CA9CFA98AA875B5A3816D460
                                                                                                                                                                                                                                              SHA-512:B822538494D13BDA947655AF791FED4DAA811F20C4B63A45246C8F3BEFA3EC37FF1AA79246C89174FE35D76FFB636FA228AFA4BDA0BD6D2C41D01228B151FD89
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ .S.A...A...A..0.m..A..O....A...9...A...A...A..O....A..O....A..O....A..O....A..O.}..A..O....A..Rich.A..................PE..d.....t^.........." .....:...4......pA...............................................Z....`A.........................................j......|k..x....................l...A......8....b..8...........................@b..0............P..X............................text....9.......:.................. ..`.rdata... ...P..."...>..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..8............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\d3dcompiler_47.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):4173928
                                                                                                                                                                                                                                              Entropy (8bit):6.329102290474506
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:49152:8BfmqCtLI4erBYysLjG/A8McPyCD6hw16JVTW7B3EgvVlQ3LAYmyNOvGJse+aWyb:8eZevVKACOvWYQF
                                                                                                                                                                                                                                              MD5:B0AE3AA9DD1EBD60BDF51CB94834CD04
                                                                                                                                                                                                                                              SHA1:EE2F5726AC140FB42D17ABA033D678AFAF8C39C1
                                                                                                                                                                                                                                              SHA-256:E994847E01A6F1E4CBDC5A864616AC262F67EE4F14DB194984661A8D927AB7F4
                                                                                                                                                                                                                                              SHA-512:756EBF4FA49029D4343D1BDB86EA71B2D49E20ADA6370FD7582515455635C73D37AD0DBDEEF456A10AB353A12412BA827CA4D70080743C86C3B42FA0A3152AA3
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G..(.a.{.a.{.a.{..m{5a.{..l{.a.{.m{.a.{.o{.a.{.a.{.a.{.i{.a.{.l{.a.{.h{.a.{.q{.a.{.k{.a.{.n{.a.{Rich.a.{........................PE..d......R.........." ......;.........`.8......................................@@......a@...`...........................................;.u...P.>.d.....?.@.....=......t?.h<... ?..{..................................@a................>.P............................text.....;.......;................. ..`.data...h.....;.......;.............@....pdata........=......n<.............@..@.idata..@.....>......B>.............@..@.rsrc...@.....?......\>.............@..@.reloc....... ?......b>.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\libEGL.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):25072
                                                                                                                                                                                                                                              Entropy (8bit):5.961464514165753
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:384:KEyYvsyDQrjwgut4Maw+XZndDGg7Dgf2hU:RvszjwgocwOhdDGEUf2hU
                                                                                                                                                                                                                                              MD5:BB00EF1DD81296AF10FDFA673B4D1397
                                                                                                                                                                                                                                              SHA1:773FFCF4A231B963BAAC36CBEF68079C09B62837
                                                                                                                                                                                                                                              SHA-256:32092DE077FD57B6EF355705EC46C6D21F6D72FBE3D3A5DD628F2A29185A96FA
                                                                                                                                                                                                                                              SHA-512:C87C0868C04852B63A7399AFE4E568CD9A65B7B7D5FD63030ABEA649AAC5E9F2293AB5BE2B2CE56A57F2B4B1992AE730150A293ADA53637FC5CD7BE0A727CBD4
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...Xv@.Xv@.Xv@. .@.Xv@.7wA.Xv@.3wA.Xv@.7sA.Xv@.7rA.Xv@.7uA.Xv@W(wA.Xv@.Xw@.Xv@W(sA.Xv@W(vA.Xv@W(.@.Xv@.X.@.Xv@W(tA.Xv@Rich.Xv@........PE..d...#._.........." .........0......................................................Z.....`.........................................`9.......B..d.......H....p.......F.......... ....3..T............................4..0............0...............................text............................... ..`.rdata..r#...0...$..................@..@.data........`.......:..............@....pdata.......p.......<..............@..@.rsrc...H............>..............@..@.reloc.. ............D..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\libGLESv2.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):3385328
                                                                                                                                                                                                                                              Entropy (8bit):6.382356347494905
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:49152:sU0O89Onk/cNTgO/WSLqfTPnK+9eaOiY95ZEQryD1pPG3L:MaHUKt3L
                                                                                                                                                                                                                                              MD5:2247EE4356666335DF7D72129AF8D600
                                                                                                                                                                                                                                              SHA1:F0131C1A67FC17C0E8DCC4A4CA38C9F1780E7182
                                                                                                                                                                                                                                              SHA-256:50FAD5605B3D57627848B3B84A744DFB6A045609B8236B04124F2234676758D8
                                                                                                                                                                                                                                              SHA-512:67F2A7BF169C7B9A516689CF1B16446CA50E57F099B9B742CCB1ABB2DCDE8867F8F6305AD8842CD96194687FC314715AE04C1942B0E0A4F51B592B028C5B16D3
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............t..t..t....t.A.p..t.A.w..t.A.q..t.A.u..t.u..t..u..t...q..t...t..t......t.....t...v..t.Rich..t.........PE..d....._.........." ......&.........L.&.......................................3.......3...`..........................................0..]....0.......3.P.....1.L.....3.......3..;...},.T...................P.,.(... ~,.0.............'..............................text...o.&.......&................. ..`.rdata........'.......&.............@..@.data.........1.......0.............@....pdata..L.....1.......1.............@..@.rsrc...P.....3......J3.............@..@.reloc...;....3..<...P3.............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\bin\opengl32sw.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):20923392
                                                                                                                                                                                                                                              Entropy (8bit):6.255903817217008
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:393216:LIckHor5uLnn83wAP5hxOZEa7/LzRuDFqILn5LgcKyZyQXt+8M:yEZbv
                                                                                                                                                                                                                                              MD5:7DBC97BFEE0C7AC89DA8D0C770C977B6
                                                                                                                                                                                                                                              SHA1:A064C8D8967AAA4ADA29BD9FEFBE40405360412C
                                                                                                                                                                                                                                              SHA-256:963641A718F9CAE2705D5299EAE9B7444E84E72AB3BEF96A691510DD05FA1DA4
                                                                                                                                                                                                                                              SHA-512:286997501E1F5CE236C041DCB1A225B4E01C0F7C523C18E9835507A15C0AC53C4D50F74F94822125A7851FE2CB2FB72F84311A2259A5A50DCE6F56BA05D1D7E8
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.@..............'.......'.......'..[...........|.-.....|.+.*...|.*.<....'......../.....q.*.....q.+....q.&.^...q.......q.,.....Rich............PE..d....._W.........." .....(....b.....|&....................................... E...........`.........................................0.1.t.....1...............9.`n............C..k.. . .T..................... .(..... ..............@...............................text...T&.......(.................. ..`.rdata..XvO..@...xO..,..............@..@.data....;....1.......1.............@....pdata..`n....9..p...D3.............@..@.gfids.......pC.......=.............@..@.tls..........C.......=.............@..._RDATA........C.......=.............@..@.reloc...k....C..l....=.............@..B................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):68080
                                                                                                                                                                                                                                              Entropy (8bit):6.207162014262433
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:mQ4IT53ign4CbtlO705xWL3frA5rlhgQJ7tapgUff:mLIT53Hbtk70OLs3hg0Cz
                                                                                                                                                                                                                                              MD5:750A31DE7840B5EED8BA14C1BD84D348
                                                                                                                                                                                                                                              SHA1:D345D13B0C303B7094D1C438E49F0046791DE7F6
                                                                                                                                                                                                                                              SHA-256:A9BFFB0F3CD69CD775C328C916E46440FE80D99119FAEBC350C7EC51E3E57C41
                                                                                                                                                                                                                                              SHA-512:5C0A68ED27A9F1BBFF104942152E475C94BB64B03CE252EAAC1A6770E24DC4156CE4ADE99EBCD92662801262DED892C33F84C605AD84472B45A83C4883D5E767
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............h..h..h...s.h..]...h.....h..]...h..]...h..]...h......h..h..&h......h......h......h......h..Rich.h..................PE..d...X._.........." .........b......$........................................@......{v....`......................................... ................ ..X....................0......H...T......................(.......0............................................text............................... ..`.rdata...E.......F..................@..@.data...............................@....pdata..............................@..@.qtmetadi...........................@..P.rsrc...X.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):41968
                                                                                                                                                                                                                                              Entropy (8bit):6.0993566622860635
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:768:VPs5g31JfDgej5JZmA0ZsEEC6lmn+4FdDGimUf2hr:VkC31ee7ZmA+sEEC6lmn+4FOUfc
                                                                                                                                                                                                                                              MD5:313F89994F3FEA8F67A48EE13359F4BA
                                                                                                                                                                                                                                              SHA1:8C7D4509A0CAA1164CC9415F44735B885A2F3270
                                                                                                                                                                                                                                              SHA-256:42DDE60BEFCF1D9F96B8366A9988626B97D7D0D829EBEA32F756D6ECD9EA99A8
                                                                                                                                                                                                                                              SHA-512:06E5026F5DB929F242104A503F0D501A9C1DC92973DD0E91D2DAF5B277D190082DE8D37ACE7EDF643C70AA98BB3D670DEFE04CE89B483DA4F34E629F8ED5FECF
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n.:*..i*..i*..i#.Ei...i...h(..i>..h(..i...h8..i...h-..i...h(..i...h-..i*..i...i...h(..i...h+..i..)i+..i...h+..iRich*..i........................PE..d......_.........." .....@...F.......F..............................................C.....`..........................................g..x...hh..........H...........................xX..T....................Z..(....X..0............P...............................text....>.......@.................. ..`.rdata...3...P...4...D..............@..@.data................x..............@....pdata...............z..............@..@.qtmetadj...........................@..P.rsrc...H...........................@..@.reloc..............................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qgif.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):39408
                                                                                                                                                                                                                                              Entropy (8bit):6.0316011626259405
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:768:ygk2hM0GskFtvPCjEIxh8eDzFyPddeeGvnhotdDGPUf2he:yN2a05kfPOEMaeDzFkddeFnhotOUfh
                                                                                                                                                                                                                                              MD5:52FD90E34FE8DED8E197B532BD622EF7
                                                                                                                                                                                                                                              SHA1:834E280E00BAE48A9E509A7DC909BEA3169BDCE2
                                                                                                                                                                                                                                              SHA-256:36174DD4C5F37C5F065C7A26E0AC65C4C3A41FDC0416882AF856A23A5D03BB9D
                                                                                                                                                                                                                                              SHA-512:EF3FB3770808B3690C11A18316B0C1C56C80198C1B1910E8AA198DF8281BA4E13DC9A6179BB93A379AD849304F6BB934F23E6BBD3D258B274CC31856DE0FC12B
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R...3..3..3..KA.3..o\..3..X..3..o\..3..o\..3..o\..3.."C..3..3...3.."C..3.."C..3.."C-.3.."C..3..Rich.3..........PE..d...H._.........." .....@...B.......E...............................................^....`..........................................f..t....f..........@............~..............HW..T....................X..(....W..0............P...............................text...k?.......@.................. ..`.rdata..&)...P...*...D..............@..@.data...(............n..............@....pdata...............p..............@..@.qtmetads............v..............@..P.rsrc...@............x..............@..@.reloc...............|..............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qicns.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):45040
                                                                                                                                                                                                                                              Entropy (8bit):6.016125225197622
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:768:vEip0IlhxTDxut3dnm8IyAmQQ3ydJouEAkNypTAO0tfC3apmsdDG9Uf2hU:vxvXxgVIyA23ydJlEATpTAO0tfCKpms/
                                                                                                                                                                                                                                              MD5:AD84AF4D585643FF94BFA6DE672B3284
                                                                                                                                                                                                                                              SHA1:5D2DF51028FBEB7F6B52C02ADD702BC3FA781E08
                                                                                                                                                                                                                                              SHA-256:F4A229A082D16F80016F366156A2B951550F1E9DF6D4177323BBEDD92A429909
                                                                                                                                                                                                                                              SHA-512:B68D83A4A1928EB3390DEB9340CB27B8A3EB221C2E0BE86211EF318B4DD34B37531CA347C73CCE79A640C5B06FBD325E10F8C37E0CEE2581F22ABFBFF5CC0D55
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................a....Q........Q......Q......Q......................................Rich...........PE..d......_.........." .....B...N.......G...............................................&....`.............................................t...$...........@...........................xp..T....................r..(....p..0............`...............................text....@.......B.................. ..`.rdata...9...`...:...F..............@..@.data...............................@....pdata..............................@..@.qtmetadx...........................@..P.rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qico.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):38384
                                                                                                                                                                                                                                              Entropy (8bit):5.957072398645384
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:768:zBXBEfQiAzC9Oh5AS7a3Z5OGrTDeV9mp7nnsWdDGgYUf2hi/:8JAzuOhy3zOGrTDeV9mp7nnsWjYUfz
                                                                                                                                                                                                                                              MD5:A9ABD4329CA364D4F430EDDCB471BE59
                                                                                                                                                                                                                                              SHA1:C00A629419509929507A05AEBB706562C837E337
                                                                                                                                                                                                                                              SHA-256:1982A635DB9652304131C9C6FF9A693E70241600D2EF22B354962AA37997DE0B
                                                                                                                                                                                                                                              SHA-512:004EA8AE07C1A18B0B461A069409E4061D90401C8555DD23DBF164A08E96732F7126305134BFAF8B65B0406315F218E05B5F0F00BEDB840FB993D648CE996756
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u.G...G...G...N...C......E...S...E......R......O......D.......B...G...........D.......F.......F.......F...RichG...................PE..d...H._.........." .....4...H.......9....................................................`..........................................h..t...th..........@............z..............(X..T....................Y..(....X..0............P..8............................text....2.......4.................. ..`.rdata..B/...P...0...8..............@..@.data...h............h..............@....pdata...............l..............@..@.qtmetad.............r..............@..P.rsrc...@............t..............@..@.reloc...............x..............@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qjpeg.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):421360
                                                                                                                                                                                                                                              Entropy (8bit):5.7491063936821405
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:6144:USgOWz1eW38u9tyh6fpGUasBKTrsXWwMmH1l3JM5hn0uEfB4:USPQTnastBRB4
                                                                                                                                                                                                                                              MD5:16ABCCEB70BA20E73858E8F1912C05CD
                                                                                                                                                                                                                                              SHA1:4B3A32B166AB5BBBEE229790FDAE9CBC84F936BA
                                                                                                                                                                                                                                              SHA-256:FB4E980CB5FAFA8A4CD4239329AED93F7C32ED939C94B61FB2DF657F3C6AD158
                                                                                                                                                                                                                                              SHA-512:3E5C83967BF31C9B7F1720059DD51AA4338E518B076B0461541C781B076135E9CB9CBCEB13A8EC9217104517FBCC356BDD3FFACA7956D1C939E43988151F6273
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Iv"...L...L...L..o....L..xM...L..|M...L.......L..xI...L..xH...L..xO...L..gM...L...M...L..gH.?.L..gI...L..gL...L..g....L..gN...L.Rich..L.........PE..d...o._.........." .....b...........i...............................................g....`.............................................t...............@....`.......R..............h...T.......................(.......0...............@............................text....`.......b.................. ..`.rdata..J............f..............@..@.data...8....P.......(..............@....pdata.......`... ...*..............@..@.qtmetad.............J..............@..P.rsrc...@............L..............@..@.reloc...............P..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qsvg.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):32240
                                                                                                                                                                                                                                              Entropy (8bit):5.978149408776758
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:768:uOVKDlJJVlTuLiMtsKVG7TSdDG9Uf2h4e:hVgJVlTuL/tsKVG7TSQUfre
                                                                                                                                                                                                                                              MD5:C0DE135782FA0235A0EA8E97898EAF2A
                                                                                                                                                                                                                                              SHA1:FCF5FD99239BF4E0B17B128B0EBEC144C7A17DE2
                                                                                                                                                                                                                                              SHA-256:B3498F0A10AC4CB42CF7213DB4944A34594FF36C78C50A0F249C9085D1B1FF39
                                                                                                                                                                                                                                              SHA-512:7BD5F90CCAB3CF50C55EAF14F7EF21E05D3C893FA7AC9846C6CA98D6E6D177263AC5EB8A85A34501BCFCA0DA7F0B6C39769726F4090FCA2231EE64869B81CF0B
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x>...P...P...P..a...P.&vQ...P..rQ...P.&vU...P.&vT...P.&vS...P.kiQ...P...Q.n.P.kiU...P.kiP...P.ki....P.kiR...P.Rich..P.........PE..d......_.........." .....$...B......D)....................................................`.........................................PU..t....U..........@............b...............G..T....................I..(...PH..0............@..(............................text....".......$.................. ..`.rdata...+...@...,...(..............@..@.data...8....p.......T..............@....pdata...............V..............@..@.qtmetad.............Z..............@..P.rsrc...@............\..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qtga.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):31728
                                                                                                                                                                                                                                              Entropy (8bit):5.865766652452823
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:768:1lGALluUEAQATWQ79Z2Y8Ar+dDG2vUf2hF:TZl/EH8WQ794Y8Ar+hvUfm
                                                                                                                                                                                                                                              MD5:A913276FA25D2E6FD999940454C23093
                                                                                                                                                                                                                                              SHA1:785B7BC7110218EC0E659C0E5ACE9520AA451615
                                                                                                                                                                                                                                              SHA-256:5B641DEC81AEC1CF7AC0CCE9FC067BB642FBD32DA138A36E3BDAC3BB5B36C37A
                                                                                                                                                                                                                                              SHA-512:CEBE48E6E6C5CDF8FC339560751813B8DE11D2471A3DAB7D648DF5B313D85735889D4E704E8EEC0AD1084AB43BE0EBDFBACD038AEAC46D7A951EFB3A7CE838EB
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F ._'N._'N._'N.V_.Y'N..HO.]'N.KLO.]'N..HK.M'N..HJ.W'N..HM.\'N..WO.Z'N._'O.4'N..WK.\'N..WN.^'N..W..^'N..WL.^'N.Rich_'N.........................PE..d......_.........." ....."...@.......'..............................................7.....`..........................................W..t...dX..........@.......`....`..............(I..T....................J..(....I..0............@..h............................text...[!.......".................. ..`.rdata...)...@...*...&..............@..@.data........p.......P..............@....pdata..`............T..............@..@.qtmetadu............X..............@..P.rsrc...@............Z..............@..@.reloc...............^..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qtiff.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):390128
                                                                                                                                                                                                                                              Entropy (8bit):5.724665470266677
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:6144:V0jqHiFBaRe0GPAKwP15e7xrEEEEEEN024Rx/3tkYiHUASQbs/l7OanYoOgyV:0qqwP15bx/q7/yyV
                                                                                                                                                                                                                                              MD5:9C0ACF12D3D25384868DCD81C787F382
                                                                                                                                                                                                                                              SHA1:C6E877ABA3FB3D2F21D86BE300E753E23BB0B74E
                                                                                                                                                                                                                                              SHA-256:825174429CED6B3DAB18115DBC6C9DA07BF5248C86EC1BD5C0DCAECA93B4C22D
                                                                                                                                                                                                                                              SHA-512:45594FA3C5D7C4F26325927BB8D51B0B88E162E3F5E7B7F39A5D72437606383E9FDC8F83A77F814E45AFF254914514AE52C1D840A6C7B98767F362ED3F4FC5BD
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................E....q............q......q......q......<.............<......<......<......<.)....<......Rich....................PE..d......_.........." .....(..........D-.......................................0............`.............................................t...4...........@........%........... ..(....d..T................... f..(....d..0............@..0............................text....&.......(.................. ..`.rdata...v...@...x...,..............@..@.data...(...........................@....pdata...%.......&..................@..@.qtmetad............................@..P.rsrc...@...........................@..@.reloc..(.... ......................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qwbmp.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):30192
                                                                                                                                                                                                                                              Entropy (8bit):5.938644231596902
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:768:EfEM3S46JE2X/xBZ76pC5J6GdDGZUf2h4:63S3JE2PHZ76pC5J6GEUfn
                                                                                                                                                                                                                                              MD5:68919381E3C64E956D05863339F5C68C
                                                                                                                                                                                                                                              SHA1:CE0A2AD1F1A46B61CB298CEC5AA0B25FF2C12992
                                                                                                                                                                                                                                              SHA-256:0F05969FB926A62A338782B32446EA3E28E4BFBFFC0DBD25ED303FAB3404ABAC
                                                                                                                                                                                                                                              SHA-512:6222A3818157F6BCD793291A6C0380EF8C6B93ECEA2E0C9A767D9D9163461B541AFAF8C6B21C5A020F01C95C6EE9B2B74B358BA18DA120F520E87E24B20836AA
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]...<.I.<.I.<.I.D%I.<.I.S.H.<.I.W.H.<.I.S.H.<.I.S.H.<.I.S.H.<.IYL.H.<.I.<.I.<.IYL.H.<.IYL.H.<.IYLII.<.IYL.H.<.IRich.<.I........PE..d......_.........." ..... ...8.......'....................................................`......................................... D..t....D..........@....p..T....Z...............6..T...................p8..(...@7..0............0..p............................text............ .................. ..`.rdata..d&...0...(...$..............@..@.data........`.......L..............@....pdata..T....p.......N..............@..@.qtmetad~............R..............@..P.rsrc...@............T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\imageformats\qwebp.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):510448
                                                                                                                                                                                                                                              Entropy (8bit):6.605517748735854
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:12288:bPTjgdqdsvh+LrLrLrL5/y4DVHAsqx3hXS+oPZQqRaYG:jT5sMLrLrLrL5q4dAsaOFo
                                                                                                                                                                                                                                              MD5:308E4565C3C5646F9ABD77885B07358E
                                                                                                                                                                                                                                              SHA1:71CB8047A9EF0CDB3EE27428726CACD063BB95B7
                                                                                                                                                                                                                                              SHA-256:6E37ACD0D357871F92B7FDE7206C904C734CAA02F94544DF646957DF8C4987AF
                                                                                                                                                                                                                                              SHA-512:FFAEECFAE097D5E9D1186522BD8D29C95CE48B87583624EB6D0D52BD19E36DB2860A557E19F0A05847458605A9A540C2A9899D53D36A6B7FD5BF0AD86AF88124
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................a....s........s......s......s....>.........>......>.....>....>......>....Rich...................PE..d......_.........." .....B..........tH.......................................0......`q....`..........................................W..t....W..........@.......0H........... ......h...T.......................(.......0............`...............................text...[@.......B.................. ..`.rdata..J....`.......F..............@..@.data....'...........X..............@....pdata..0H.......J...\..............@..@.qtmetadv...........................@..P.rsrc...@...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platforms\qminimal.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):844784
                                                                                                                                                                                                                                              Entropy (8bit):6.625808732261156
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:12288:y6MhioHKQ1ra8HT+bkMY8zKI4kwU7dFOTTYfEWmTxbwTlWc:BMhioHKQp+bkjAjwGdFSZtbwBd
                                                                                                                                                                                                                                              MD5:2F6D88F8EC3047DEAF174002228219AB
                                                                                                                                                                                                                                              SHA1:EB7242BB0FE74EA78A17D39C76310A7CDD1603A8
                                                                                                                                                                                                                                              SHA-256:05D1E7364DD2A672DF3CA44DD6FD85BED3D3DC239DCFE29BFB464F10B4DAA628
                                                                                                                                                                                                                                              SHA-512:0A895BA11C81AF14B5BD1A04A450D6DCCA531063307C9EF076E9C47BD15F4438837C5D425CAEE2150F3259691F971D6EE61154748D06D29E4E77DA3110053B54
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#\..B2..B2..B2..:...B2..-3..B2.F....B2..-7..B2..-6..B2..-1..B2..)6..B2.^23..B2..)3..B2..B3.@2.^26..B2.^27..B2.^22..B2.^2...B2.^20..B2.Rich.B2.........PE..d...N._.........." ......................................................... ............`......................................... ...x.......@.......H....`..H.......................T.......................(.......0...............(............................text...;........................... ..`.rdata...C.......D..................@..@.data...H....@......."..............@....pdata..H....`.......0..............@..@.qtmetad............................@..P.rsrc...H...........................@..@.reloc..............................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platforms\qoffscreen.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):754672
                                                                                                                                                                                                                                              Entropy (8bit):6.6323155845799695
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:12288:/HpBmyVIRZ3Tck83vEgex5aebusGMIlhLfEWmpCJkl:/HpB63TckUcLaHMITAZmW
                                                                                                                                                                                                                                              MD5:6407499918557594916C6AB1FFEF1E99
                                                                                                                                                                                                                                              SHA1:5A57C6B3FFD51FC5688D5A28436AD2C2E70D3976
                                                                                                                                                                                                                                              SHA-256:54097626FAAE718A4BC8E436C85B4DED8F8FB7051B2B9563A29AEE4ED5C32B7B
                                                                                                                                                                                                                                              SHA-512:8E8ABB563A508E7E75241B9720A0E7AE9C1A59DD23788C74E4ED32A028721F56546792D6CCA326F3D6AA0A62FDEDC63BF41B8B74187215CD3B26439F40233F4D
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m..T..KT..KT..K]t7K@..K.c.JV..K@g.JV..K.cKU..K.c.JA..K.c.J\..K.c.JP..K.|.JQ..KT..K...K.|.Js..K.|.JS..K.|.JU..K.|[KU..K.|.JU..KRichT..K........PE..d...R._.........." ................L.....................................................`.............................................x...8...........H....... s...h..........p.......T................... ...(.......0...............@............................text............................... ..`.rdata..............................@..@.data...............................@....pdata.. s.......t..................@..@.qtmetad.............T..............@..P.rsrc...H............V..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platforms\qwebgl.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):482288
                                                                                                                                                                                                                                              Entropy (8bit):6.152380961313931
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:6144:WO/vyK+DtyaHlIMDhg5WEOvAwKB2VaaHeqRw/yVfYu4UnCA6DEjeYchcD+1Zy2:bKtHOWg5OvAwK0NYu4AShcD+1U2
                                                                                                                                                                                                                                              MD5:1EDCB08C16D30516483A4CBB7D81E062
                                                                                                                                                                                                                                              SHA1:4760915F1B90194760100304B8469A3B2E97E2BC
                                                                                                                                                                                                                                              SHA-256:9C3B2FA2383EEED92BB5810BDCF893AE30FA654A30B453AB2E49A95E1CCF1631
                                                                                                                                                                                                                                              SHA-512:0A923495210B2DC6EB1ACEDAF76D57B07D72D56108FD718BD0368D2C2E78AE7AC848B90D90C8393320A3D800A38E87796965AFD84DA8C1DF6C6B244D533F0F39
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........gM..#...#...#..~....#.ei&...#.ei'...#.ei ...#..m'...#.ei"...#.(v"...#..m"...#..."...#.(v&...#.(v#...#.(v...#.(v!...#.Rich..#.................PE..d......_.........." .....R...........;....................................................`..........................................m..t...Dn..T.......@....@...=...@..............0...T.......................(.......0............p..(............................text...{Q.......R.................. ..`.rdata..:....p.......V..............@..@.data...H....0......................@....pdata...=...@...>..................@..@.qtmetadz............2..............@..P.rsrc...@............4..............@..@.reloc...............8..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platforms\qwindows.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):1477104
                                                                                                                                                                                                                                              Entropy (8bit):6.575113537540671
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:24576:4mCSPJrAbXEEuV9Hw2SoYFo3HdxjEgqJkLdLu5qpmZuhg/A2b:nPlIEEuV9Hw2SFFWHdWZsdmqja/A2b
                                                                                                                                                                                                                                              MD5:4931FCD0E86C4D4F83128DC74E01EAAD
                                                                                                                                                                                                                                              SHA1:AC1D0242D36896D4DDA53B95812F11692E87D8DF
                                                                                                                                                                                                                                              SHA-256:3333BA244C97264E3BD19DB5953EFA80A6E47AACED9D337AC3287EC718162B85
                                                                                                                                                                                                                                              SHA-512:0396BCCDA43856950AFE4E7B16E0F95D4D48B87473DC90CF029E6DDFD0777E1192C307CFE424EAE6FB61C1B479F0BA1EF1E4269A69C843311A37252CF817D84D
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i...-...-...-...$.%.9.....q.,......8......%......)......+...9......9..,......)..........9..8...-..........d......,.....I.,......,...Rich-...........PE..d....._.........." .....,...h......4+..............................................n.....`.............................................x...(...........H............n..........X....r..T...................Pt..(... s..0............@...5...........................text..._+.......,.................. ..`.rdata.......@.......0..............@..@.data....m...@...D...(..............@....pdata...............l..............@..@.qtmetad.............J..............@..P.rsrc...H............L..............@..@.reloc..X............P..............@..B........................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):68592
                                                                                                                                                                                                                                              Entropy (8bit):6.125954940500008
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:Nt4B1RLj3S6TtH2sweUH+Hz6/4+D6VFsfvUfO:AB1RHFdoeUs6/4O6VFSZ
                                                                                                                                                                                                                                              MD5:F66F6E9EDA956F72E3BB113407035E61
                                                                                                                                                                                                                                              SHA1:97328524DA8E82F5F92878F1C0421B38ECEC1E6C
                                                                                                                                                                                                                                              SHA-256:E23FBC1BEC6CEEDFA9FD305606A460D9CAC5D43A66D19C0DE36E27632FDDD952
                                                                                                                                                                                                                                              SHA-512:7FF76E83C8D82016AB6BD349F10405F30DEEBE97E8347C6762EB71A40009F9A2978A0D8D0C054CF7A3D2D377563F6A21B97DDEFD50A9AC932D43CC124D7C4918
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o...o...o...f...k......m...{..m......~......h......m......h...o..........k......n.....~.n......n...Richo...........................PE..d...V._.........." .....z...t......T........................................@.......b....`......................................... ................ ..X....................0..4.......T.......................(...p...0...............x............................text....y.......z.................. ..`.rdata...Z.......\...~..............@..@.data...............................@....pdata..............................@..@.qtmetad............................@..P.rsrc...X.... ......................@..@.reloc..4....0......................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):144368
                                                                                                                                                                                                                                              Entropy (8bit):6.294675868932723
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3072:rrjwZ43rCOtrBk7wcR0l7wBlaL6BtIEt51T0Nhkqg8FoQY:7hZu9R0l7wFBtIEt51T0Nuqg8JY
                                                                                                                                                                                                                                              MD5:53A85F51054B7D58D8AD7C36975ACB96
                                                                                                                                                                                                                                              SHA1:893A757CA01472A96FB913D436AA9F8CFB2A297F
                                                                                                                                                                                                                                              SHA-256:D9B21182952682FE7BA63AF1DF24E23ACE592C35B3F31ECEEF9F0EABEB5881B9
                                                                                                                                                                                                                                              SHA-512:35957964213B41F1F21B860B03458404FBF11DAF03D102FBEA8C2B2F249050CEFBB348EDC3F22D8ECC3CB8ABFDC44215C2DC9DA029B4F93A7F40197BD0C16960
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R._...1]..1]..1]..]..1]..0\..1]..5\..1]..2\..1]..4\..1]..0\..1]..0\..1]..0]..1]..4\..1]..1\..1]...]..1]..3\..1]Rich..1]........................PE..d...`._.........." .....\...........`.......................................`......wJ....`................................................. ........@..X.... ...............P.........T...................`...(...0...0............p...............................text....Z.......\.................. ..`.rdata......p.......`..............@..@.data...............................@....pdata....... ......................@..@.qtmetadm....0......................@..P.rsrc...X....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_ar.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):130
                                                                                                                                                                                                                                              Entropy (8bit):4.024232093209084
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/2/vlAlHekW3/S1MUe3/CLlI+rwtbWlMrNtYs8ar/u:Cwm+/PtUePCRIRt6Ygs8y/u
                                                                                                                                                                                                                                              MD5:8FF05B56C0995F90A80B7064AA6E915C
                                                                                                                                                                                                                                              SHA1:D5AEB09AE557CEEFB758972EC4AC624CDDC9E6A7
                                                                                                                                                                                                                                              SHA-256:A8A1B0D6F958E7366D1C856BE61000106D3E7FC993FB931675369892B9002D0B
                                                                                                                                                                                                                                              SHA-512:5374E0F1D3F5A6A456B00732DE8005787B17ECEF9C8A2B2C1228966A6A8DE211700334D8FD789DAD269F52D0AEED3F5160010CA60909861E270C253B3EA881A4
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......ar....R.....q.t.b.a.s.e._.a.r.....q.t.s.c.r.i.p.t._.a.r.....q.t.m.u.l.t.i.m.e.d.i.a._.a.r..............$...*.

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_bg.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):153
                                                                                                                                                                                                                                              Entropy (8bit):3.6813848812976975
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/6lLlAlHekVYtzlY1MUdI7lULlI+rwtbWlMoIFl8IPldkO4t/z:CwDC+7tJjUWhURIRt68f8oiP1z
                                                                                                                                                                                                                                              MD5:466EED6C184D2055488D4C5EA9AE5F20
                                                                                                                                                                                                                                              SHA1:8599AB9B731BFC84F6EEC7A0129F396FB8FEC4EA
                                                                                                                                                                                                                                              SHA-256:9E1CE4D91852352043D9191F1A992838F919CBA7E2F2D9BB1161E494E8BF5F5E
                                                                                                                                                                                                                                              SHA-512:D2462951EC7DCE3D0851AE9C4ED644FFE0D2A5BDD15B4AE1A4295C187B4295BC854D6A5038DAC0564D165463419D615EB6CE7A9760CEFAD71AB673FB2109C349
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......bg....v.....q.t.b.a.s.e._.b.g.....q.t.s.c.r.i.p.t._.b.g.....q.t.m.u.l.t.i.m.e.d.i.a._.b.g... .q.t.x.m.l.p.a.t.t.e.r.n.s._.b.g.......

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_ca.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):153
                                                                                                                                                                                                                                              Entropy (8bit):3.631479835393124
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/NVl/lAlHekUOplY1MUce/hlAlI+rwtbWlMpOflUlIPldkOHlz:CwO4+94jUcerAIRt6a6Uloi8
                                                                                                                                                                                                                                              MD5:6FBA66FE449866B478A2EBA66A724A02
                                                                                                                                                                                                                                              SHA1:EBEF6ED8460218CE8DF735659A8CBCD693600AC6
                                                                                                                                                                                                                                              SHA-256:171C7424B24D8502AB53CB3784FF34D8FCFAE26557CF8AF4DFDDEC6485ACC2FE
                                                                                                                                                                                                                                              SHA-512:2D2438738C6D10D8A53B46DE5A94BBF993818D080F344D9F1B94FC83D60335D9A5E8EFCC297D593FFF1D427972F9F9502FC31C332CAEA579FC7A88487390457E
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......ca....v.....q.t.b.a.s.e._.c.a.....q.t.s.c.r.i.p.t._.c.a.....q.t.m.u.l.t.i.m.e.d.i.a._.c.a... .q.t.x.m.l.p.a.t.t.e.r.n.s._.c.a.......

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_cs.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):157
                                                                                                                                                                                                                                              Entropy (8bit):3.7483537099309427
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/fVFlAlHekUsplY1MUcM/hlULlI+rwtbWlMpsfl8IPldkO1lPchn:CwY4+9ujUcMrURIRt6aE8oinh
                                                                                                                                                                                                                                              MD5:D033053C03C3ECFA2AA926E0E674F67F
                                                                                                                                                                                                                                              SHA1:B4E95F8278121E2549F8BB6B5DAF1496F1738A7D
                                                                                                                                                                                                                                              SHA-256:3C0CBFD19490D67D1B3B9E944C3A4D9A9E7F87D7AE35E88D5D5A0077349B5B21
                                                                                                                                                                                                                                              SHA-512:2C7E9E9DBE0B25FBA94A52FE4BCCB1D9FED2A7BD2877DB91F82546C3BC8606280949594227BA0FC1C74C31010E1F573B3A82852BE746EAA4F397140485789136
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......cs....v.....q.t.b.a.s.e._.c.s.....q.t.s.c.r.i.p.t._.c.s.....q.t.m.u.l.t.i.m.e.d.i.a._.c.s... .q.t.x.m.l.p.a.t.t.e.r.n.s._.c.s...........

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_da.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):153
                                                                                                                                                                                                                                              Entropy (8bit):3.6174817344122334
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/4Jlr/lAlHekT6hY1MUb6JAlI+rwtbWlMuel3UlIPldkOQtt:Cw7rC+3jUkAIRt6EVUloi9
                                                                                                                                                                                                                                              MD5:E6A683F4A0883B5B0C7D30B847EF208C
                                                                                                                                                                                                                                              SHA1:FF2440DBBFE04AD86C6F285426AAFD49A895B128
                                                                                                                                                                                                                                              SHA-256:B5036161CE808C728E5FDA985F792DB565831FD01CF00B282547790C037353A2
                                                                                                                                                                                                                                              SHA-512:D73B794A71DFD3A3C06BF43ED109F635B4960F9A3904FB728873AB5251BDF6A791DDFDEBA884A2703A35461E18BA902804095AC4B92A2C9361526469B6D35FFA
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......da....v.....q.t.b.a.s.e._.d.a.....q.t.s.c.r.i.p.t._.d.a.....q.t.m.u.l.t.i.m.e.d.i.a._.d.a... .q.t.x.m.l.p.a.t.t.e.r.n.s._.d.a.......

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_de.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):153
                                                                                                                                                                                                                                              Entropy (8bit):3.6174817344122334
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/8rJFlAlHekTul01MUbul4LlI+rwtbWlMuallyIPldkOknt:Cw/rJ4+XU5RIRt6Aaoi7t
                                                                                                                                                                                                                                              MD5:06168E1261BF72F49F94927723B2E1EB
                                                                                                                                                                                                                                              SHA1:DEAF1B53C3FEE6CB28840418D0060AFA4D59D3FC
                                                                                                                                                                                                                                              SHA-256:5805B8FF3747849794E2D70661D737C69C15F1AE763C38E17084B1E5A81E9153
                                                                                                                                                                                                                                              SHA-512:AA3915C029C74DC270514C7F50E8BEC06C825F278E0DE0477AD8ED3187700BBD7711382A6E47C3AC76AC756CEFF9FA8CDD4E9B9DAC817475BC122F78B02C7D7D
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......de....v.....q.t.b.a.s.e._.d.e.....q.t.s.c.r.i.p.t._.d.e.....q.t.m.u.l.t.i.m.e.d.i.a._.d.e... .q.t.x.m.l.p.a.t.t.e.r.n.s._.d.e.......

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_en.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                                                              Entropy (8bit):4.0
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4n:CwZ
                                                                                                                                                                                                                                              MD5:BCEBCF42735C6849BDECBB77451021DD
                                                                                                                                                                                                                                              SHA1:4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
                                                                                                                                                                                                                                              SHA-256:9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
                                                                                                                                                                                                                                              SHA-512:F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`...

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_es.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):153
                                                                                                                                                                                                                                              Entropy (8bit):3.6070658648473097
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/7lJFlAlHekSMthULlI+rwtbWlMvEJY1MUaEf8IPldkOzvt:CwElJ4+7MrURIRt6cujUaE8oi0F
                                                                                                                                                                                                                                              MD5:EE47DFADBA4414FDC051C5CFBE71DDC1
                                                                                                                                                                                                                                              SHA1:DE650E96A9C130D35F8A498202773EF7FC875D27
                                                                                                                                                                                                                                              SHA-256:E25E43F046F61022FFE871A2F73C6A12EDFC5C3EFD958C0E019A721860A053B0
                                                                                                                                                                                                                                              SHA-512:8C1D8901D2F66CCBF947B831858E08B703517470B2B813B241E00162A275AC9103FF5B9251AD39BD53551E0A4FB45EE74187B218A1EF7C6CF6C5FA9F9219AE04
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......es....v.....q.t.b.a.s.e._.e.s.....q.t.m.u.l.t.i.m.e.d.i.a._.e.s.....q.t.s.c.r.i.p.t._.e.s... .q.t.x.m.l.p.a.t.t.e.r.n.s._.e.s.......

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_fa.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):293121
                                                                                                                                                                                                                                              Entropy (8bit):5.272179385890926
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3072:gEo2cQbzaVmvGQYkHkMRKkNeGr+0BhaRsLAChY21rpnLqL9ytnvC58gypn4l4qF:gEZbza0HjeGrxBhaCLFC
                                                                                                                                                                                                                                              MD5:F9C3624197ACB30A9E6CC799BB65BED6
                                                                                                                                                                                                                                              SHA1:D715EAE24387DE15588F68C92991A93FAFB5EEAB
                                                                                                                                                                                                                                              SHA-256:B292AFB0763B8C7C30A5AF7372BFC12D8A0D00BF3DD4A000715D9F576D9C1A39
                                                                                                                                                                                                                                              SHA-512:199C107AE7EAFCF2A5EEC149CAFEE7ED09B938E204B56AD3AAC9568D27166F61EC8E2225A11AF26F7E1F035FB5CAD98621A01E8A9942D18C273F43B90201162A
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......faB..I....*...u...+...............@.......A...J...B.......C...X...D.......E.......F...%...G.......H...0...I.......P...v...Q.......R.......S.......T..."...U.......V...h...W.......X...s...Y.......]..e....t...................-.......W.......|.......i...;..Eu...;..Z....;...]...;..c....;.......;..0]...M..f....O.......O..2.......#....}..f=...m..fg.........(5......+;..1a..+;...V..+;...!..+O..17..+O...(..1.......E@......F....u..H4......HY...Y..H....S..I....5..I@.....IA......IC......J...1...J.......J.......J...|...K...6...LD......L.......PS......R....Z..T.......Zr.. ...[`...O..[`......\...%@..\...2..._...&l.._...38..1........E..........2u..........1.......1...........@......4G...........................$...L...$..xY...[.......,...u...y...y...y..z.......F.......<.......g.......5W...........9...........f...E...U...E../....E..................0-...%..6....%.........................3......f..........5...?...0..EK...0......0..L ...0..c....0.......0...Z...5...........Y.. D

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_fi.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):117
                                                                                                                                                                                                                                              Entropy (8bit):3.739162292019161
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/4HlAlHekRgOp1MUZWJKlI+rwtbWlMsIkk:Cwxe++IUocIRt6Qkk
                                                                                                                                                                                                                                              MD5:72882942B07B8AAC98034016E752B1A0
                                                                                                                                                                                                                                              SHA1:BF23B4C136B863B10E770019A2DF62FC988859DF
                                                                                                                                                                                                                                              SHA-256:048CA42DCE4FAF5FC21D843576E3C6FD963146ECC78554E7E5F34D07F64FB213
                                                                                                                                                                                                                                              SHA-512:403E7F4E9A0E44F2118804F0781A18EB1852797825498751E3AFA02D9558D90293ABDB570786CED80F7EFF800BEF6D9444A72E6A640D331DA46B2A0EA43C8E96
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......fi....R.....q.t.b.a.s.e._.f.i.....q.t.s.c.r.i.p.t._.f.i.....q.t.m.u.l.t.i.m.e.d.i.a._.f.i.......

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_fr.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):153
                                                                                                                                                                                                                                              Entropy (8bit):3.680458675741643
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/FjlAlHekRL21MUZNJOLlI+rwtbWlMs9KIPldkORT:Cw3+SU0RIRt6koio
                                                                                                                                                                                                                                              MD5:3C45C665CFE036A7474CB4DCBB13CF40
                                                                                                                                                                                                                                              SHA1:62312DFF3C4CD38BAE8456C981601D0D89600F63
                                                                                                                                                                                                                                              SHA-256:8624033D849E670B12C9532337FCBF260F20848E044FEE7787CFE2AC92BE28DB
                                                                                                                                                                                                                                              SHA-512:21659AA452BC2493D915F0BE94F90CDD57759B1F1306AAA2836058D41E80DED24742EBD74E19420021514A6AB4150CA0B447574E96B9D3BF0BC5A8C78DAAF7AC
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......fr....v.....q.t.b.a.s.e._.f.r.....q.t.s.c.r.i.p.t._.f.r.....q.t.m.u.l.t.i.m.e.d.i.a._.f.r... .q.t.x.m.l.p.a.t.t.e.r.n.s._.f.r.......

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_gd.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):70
                                                                                                                                                                                                                                              Entropy (8bit):4.463523104731333
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/EXlAlHekQrEuknbJB:CwjO+5JY
                                                                                                                                                                                                                                              MD5:A8D55457C0413893F746D40B637F9C93
                                                                                                                                                                                                                                              SHA1:25123615482947772176E055E4A74043B2FBCAA0
                                                                                                                                                                                                                                              SHA-256:49DF855A004A17950338AF3146466F6DF4D5852410BD0B58EA80E0D0203A9D24
                                                                                                                                                                                                                                              SHA-512:99718B948D94B292BDEDF6B247A5856BC7AC78408FCC41C980F264C2C8565125786F0289F5F993DCF11B8CDA3AFB2A1D8634B1D0BC9B34992F538F8E4086EC00
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......gd..........q.t.b.a.s.e._.g.d....................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_gl.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):323590
                                                                                                                                                                                                                                              Entropy (8bit):4.568068046062524
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3072:OYSG8zxWSDjq73Pf6FT1f4uh50QGrRfFD54YyUY0Ou4/tnra3Z0uYhB5YHfHRRn2:O39WSD3TMQGrxFD5EUVQ
                                                                                                                                                                                                                                              MD5:0661FFABFBC50187F3BA38876B721946
                                                                                                                                                                                                                                              SHA1:EB5E7205355CFC6BCB4DF27E224079842C97B296
                                                                                                                                                                                                                                              SHA-256:204A01AC7DEB6B5BAE193AFECBD1E50D18C73BF7D94BADEB2BBFDF6123C4ED93
                                                                                                                                                                                                                                              SHA-512:65AB66CC54D65E7678FA731A5C5F2CC9D6FC217B91AD47D538440811E09A23E49CD95CE62A79E3E8C275E250AC1A0B54BD289F6DD067573876DA7AFF54381D02
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......gl_ESB..I....*.......+..&............@.......A...z...B.......C...p...D.......E......F...!...G......H.......I......P...@...Q.......R......S...5...T......U...+...V.......W...a...X.......Y...N...]..o....t..,................F.......p..............4....;..LI...;..bD...;.......;.......;.......;..cJ...M..o1...O..G....O..e.......U....}..oY...m..o........D..(5...X..+;..6/..+;...~..+;......+O..6...+O...N..1......E@...?..F.......H4..'...HY......H...3`..I......I@......IA......IC..0...J...P...J...1...J...0...J.......K...:...LD..2...L...3...PS..:A..R... d..T.......Zr..Rd..[`......[`.....\...WK..\...RR.._...X..._...f...1........E...{......7M..........1.......1....q......O.......9...............*.......)....$... ...$.......[..,=...,..-....y..0X...y...~......Mx......]0.......H......:A......0....9...............E...o...E..b....E.........1.......c....%..;....%...;......3.......^......S................5..4Z...0..L....0.......0..n....0.......0..7....0.......5..9D......!g.

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_he.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):83
                                                                                                                                                                                                                                              Entropy (8bit):3.880645689209568
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/YJ/dQlHekfaB21MUXmlvt:CwT0+D/UUt
                                                                                                                                                                                                                                              MD5:DD5C2C6B148F2DB3E666B859776AE129
                                                                                                                                                                                                                                              SHA1:8368F32039CC0776A1B95C9DED5FE6C9EA0D93FD
                                                                                                                                                                                                                                              SHA-256:C113D14E218D5402B616DABEA27969C6F83852676468C5EF051DDDEFB3EE0235
                                                                                                                                                                                                                                              SHA-512:2EAE33C8707407E083F6B8B05EA2C5B987646DF1553888C16D6508C5A33B2F758DDED73323622CD50324C96F51D61B7CE822F393551A30B211ABD3CC1367249F
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......he....0.....q.t.b.a.s.e._.h.e.....q.t.s.c.r.i.p.t._.h.e.......

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_ar.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):8743
                                                                                                                                                                                                                                              Entropy (8bit):5.189558605179696
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:192:YUM7gBwnG4Vxj4nyn9aAMOJckrL6esm/0sQ5HeK1nvEB:YBkKnZxkyn9aAMWPsm/0sQsGvEB
                                                                                                                                                                                                                                              MD5:CCD39A7C8139AD041E31B3E5D40968B4
                                                                                                                                                                                                                                              SHA1:5751BE96817BB6AE7C9DA9F1FBA7F42F31CFCC5D
                                                                                                                                                                                                                                              SHA-256:222088C9752D1CC3BAB985EF2DC77E5AE78578DCE18A61EC15B39F02E588163D
                                                                                                                                                                                                                                              SHA-512:9844C0EC65EE1C76DBA021EAC6D476A85E6C8F5BBAF4150C1EA80C0A95BEDE67B5E8F981360EF8599FCECDFCBCB83BC0B8AC44DDEFDCD85F914318030E346967
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......arB.....(.....d.0T....*.5w......Uj....!.`.....M.a[............n..t..............39....&................B<s...V..M^...e......4.O5^...r..)^......o>...........?...t.....D ......k.N.....k.N...C...n...T...I...R..........2>.................|..G.......w....T.......l..........,................^............$a......6.>...........x..K......W.b....._Xn......GN...m..~......!.....J.K.H.............pN.............P.~.....o.....W..(.......~......s.>......%c.....o.....R.z.q..........................n.h................e.....i..........:.J.1. .E.3.E.Q.I..........Untitled.....QHelp.....8.*.9.0.Q.1. .F.3... .E.D.A.Q. .'.D.*.Q.,.E.J.9.).:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.......*.9.0.Q.1. .%.F.4.'.!. .'.D./.Q.D.J.D.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....>.*.9.0.Q.1. .%.F.4.'.!. .,./.'.H.D. .A.J. .'.D.E.D.A.Q. .%.1........... Cannot create tables in file %1......QHelpCollectionHandler.....L.*.9.0.Q.1. .*.

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_bg.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):10599
                                                                                                                                                                                                                                              Entropy (8bit):5.192287379770591
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:192:jhYkcd7CYBdmfIOeX3byuJRoZXlBYnEpUYR+BJqO5X9pA2NNrxC0zwRK2nMY762A:a71DQIrLuVCnEtR+DquhN5xC0zwKPYHA
                                                                                                                                                                                                                                              MD5:5538049DA3A1D1D724AB6E11D2E2EDBE
                                                                                                                                                                                                                                              SHA1:7256BE390B88A053C0252488C443BE42F6F2D92A
                                                                                                                                                                                                                                              SHA-256:CBCDD1E0BBAE332D80DDB0A286056F17C824FA28D353D7FDF12FC97D9F6FE054
                                                                                                                                                                                                                                              SHA-512:DD98CAF3A016968EEDC9106C1839DDECC2D109E9E354708BD74B35E766C6A098C1680C0B867EAD9FCE2E2A6D683BE673B8E5DF1A1B2F1AAFDB31910FF833370F
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......bgB...(.(.......0T......5w... S.Uj......`.......a[....(..........t..............39..........&..........B<s...4..M^..........q...J..%..O5^...O..)^...I..o>...I...J..%.......#....t...A.8dz..$..D ....Z.k.N...<.k.N.......n.......I..............2>...p................G..."...w....................7..,................^............$a....<.6.>..........#...K...........$1.W.b....._Xn......GN...*..~....-..TH.."..!.....5.K.H..#R.........pN..."......&..P.~...@.o.....v..(.........."8..~......s.>.....o.... ..z.q..........................O.h....!t..........e....mi..'.....|.(...@.8.G.8.=.0.B.0. .<.>.6.5. .4.0. .5.,. .G.5. .4.>.:.C.<.5.=.B.0.F.8.O.B.0. .2.A.5. .>.I.5. .A.5. .8.=.4.5.:.A.8.@.0...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.........0.1.5.;.5.6.:.0.:..........Note:.....QCLuceneResultWidget.....,. .5.7.C.;.B.0.B.8. .>.B. .B.J.@.A.5.=.5.B.>..........Search Results.....QCLuceneResultWidget....... .

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_ca.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):7444
                                                                                                                                                                                                                                              Entropy (8bit):4.580794980254807
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:192:G8oS34B7n303D37Bn3Jso37cfp3Mg3H373R58noct36R9RFu:GQU7ETrxZvqTXLSoct36Pzu
                                                                                                                                                                                                                                              MD5:66722ED97BCBFD3DAE3C8264413859AB
                                                                                                                                                                                                                                              SHA1:400A93B213FCF9BBC9785881EA82ADB9F444CD6C
                                                                                                                                                                                                                                              SHA-256:ECD4283A660F2CF72849B323810D7EADD063120B6F561E05AA1243A5B280946A
                                                                                                                                                                                                                                              SHA-512:B898BAC9652D7532384ED5CC53FA62DB55D516421D13F815A3E6D5E80AD4C69555F1A7E6C51F8B0A234614824EEE01D6731458F90D40A585990F84A58B9ABE44
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......caB............%.......0T......K:^.....Uj......`.....P..YJ...V.E.4...*...........>...7........B<s.....B\>...6........+.s.....zq.......9.......vR......@.......@.......:....;.8Z....!.g.N......F................t.....D ....z.k.N.......I......^......`#.......2.......G........N...7......N......{..................K...............GN......NO...5.........K.H...@.........pN......V............q..................>...N.........~.....5..%c...:.z.q....i...4....".A.f.e.g.e.i.x. .u.n. .f.i.l.t.r.e..........Add Filter.....FilterNameDialogClass.......N.o.m. .d.e.l. .f.i.l.t.r.e.:..........Filter Name:.....FilterNameDialogClass.......S.e.n.s.e. .t...t.o.l..........Untitled.....QHelp.....`.N.o. .s.'.h.a. .p.o.g.u.t. .c.o.p.i.a.r. .e.l. .f.i.t.x.e.r. .d.e. .c.o.l...l.e.c.c.i...:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....H.N.o. .s.'.h.a. .p.o.g.u.t. .c.r.e.a.r. .e.l. .d.i.r.e.c.t.o.r.i.:. .%.1..........Cannot create directory: %1.....QHelpCollect

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_cs.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):15297
                                                                                                                                                                                                                                              Entropy (8bit):4.708378368926237
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:384:hmv1gdEYEiNrVhTBvAn1ca1f5lwHoJr0vwuxqsP/5jxA:o1gdEvgbloCof9ixqspW
                                                                                                                                                                                                                                              MD5:ED228F0F60AE9AEC28AB9171D5AE9590
                                                                                                                                                                                                                                              SHA1:7F061CF0C699D125A5531E3480C21964452F45EA
                                                                                                                                                                                                                                              SHA-256:4AC56FC63E400943BAB13F1D4C418502138908E1D488C24AEE6131D3D17552AA
                                                                                                                                                                                                                                              SHA-512:794CC671C08BFC50980820A6389B9D0D3514619AD0A8F18EFD5554CBBF2482192DF00B9D3B05FEE45F42276E63E2375FB28E193930D426245035B4B0E3E14ED8
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......cs_CZB...H.(.......(.......0T......0T......5w...0..Uj......`.......a[......a[....$.......p..........t.......t...........!..1"....T.39....T.39.......s...0......(......7/.................B<s...L..MQ......M^../q..........J..6@.0....*B.O5Q..'..O5^..(A..)Q...X..)^......o>..........+....J..6.......4....t.....8dz..5..D ....R.D ......k.A.....k.A.....k.N.....k.N.......n.."....I..........................2...21......2>..........d.............T..G...4...w...!N......&O......&....!..".......#E..,...,.......)....Q..$/...^..$................$a......6.>.. t......5...K.......K....)......5E.W.b..-.._Xa..%a._Xn..%...GA......GN...?......,9..~.......TH..3..!....*..K.H..4h.........pA...J..pN..........7..P.~.. ..o.....0..(....*..(..........3V..~....T.s.1.....s.>..._.o....0..o....1p.z.q..........'9.....#........^.........h....2................Z..e... .i..8J......(.D.o.v.o.d.e.m. .p.r.o. .t.o. .b.y. .m.o.h.l.o. .b...t.,. .~.e. .d.o.k.u.m.e.n.t.a.c.e. .j.e. .s.t...l.e. .j.e.a.t...

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_da.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):4795
                                                                                                                                                                                                                                              Entropy (8bit):4.530246422531362
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:96:X82wNlnKfN1LMFy7LsF3ZqBFZjWo0koBLqBXXjGL0qU7UqB7zoElmP5MUu4DZIHU:XM01f7eOnoB8X2s7Vfg5Mi4beXiOUu
                                                                                                                                                                                                                                              MD5:1D09BEE1FB55A173F7EB39B9A662A170
                                                                                                                                                                                                                                              SHA1:C77F0A148262A91679F19689E4790B754D45D5D5
                                                                                                                                                                                                                                              SHA-256:6BB092552A398687119F6D52145F04BF8373977446D8F00C0DCBD56B96829F0F
                                                                                                                                                                                                                                              SHA-512:BE5A31A6135E8DB024A8B0EB20C4D8EECBF76861F83FF83B4CA97327DB74AD94BB5D77B4E0A59A33B697C32A4EACD61B8C878951F2C545385C74D99FCE56FEE1
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......daB.....%.....m.0T......Uj....V.`....................k.B<s.....B\>..........6.+.s...............t.....D ....|.k.N...9...I...O..2.......G....B...N...O..............!..K...._..........GN...........@.K.H.............pN..............>.....~.....m..%c.....z.q....i..........U.n.a.v.n.g.i.v.e.t..........Untitled.....QHelp.....D.K.a.n. .i.k.k.e. .k.o.p.i.e.r.e. .s.a.m.l.i.n.g.s.f.i.l.e.n.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....6.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .m.a.p.p.e.n.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....V.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .i.n.d.e.k.s.t.a.b.e.l.l.e.r. .i. .f.i.l.e.n. .%.1...........&Cannot create index tables in file %1......QHelpCollectionHandler.....J.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .t.a.b.e.l.l.e.r. .i. .f.i.l.e.n. .%.1........... Cannot create tables in file %1......QHelpCollectionHandler.....P.K.a.n. .i.k.k.e. .i.n.d.l...s.e. .s.q.l.i.t.e.-.d.a.t.a.b.a.s.e.-.d.r

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_de.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):7570
                                                                                                                                                                                                                                              Entropy (8bit):4.550982634910665
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:96:8y/gPmmhL/7LlSivP6kBL7jb0RNUzzpld4UGG3Ik18fLP0L7fGc0OeVP8a8hiAwj:1OD7hx/Bv3oNuFX4iqgv34fZsu
                                                                                                                                                                                                                                              MD5:3B070D169E3381E2FB081172934AAD00
                                                                                                                                                                                                                                              SHA1:70886EB7EF566B296D0814BD4C2440AC176699D6
                                                                                                                                                                                                                                              SHA-256:9962523FBAE9F1E4C3B5C3C16860D059291CB30DC5EBE5A5EDA4C836A03FED1E
                                                                                                                                                                                                                                              SHA-512:271B730B5A7358E923BBBC6FA074A72DA52FA47E3B7726779EF7034200EDA09BF0E1AE4E7B11B59F76805F48DC285F6EFC245EB9C7F4A748BE82B25CEE1DDCAE
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......deB..........B.%.....5.0T......K:^.....Uj....?.`.....f..YJ...V.E.4...............>............B<s...z.B\>...\........+.s...Q.zq....C..9....4..vR...B..@.......@.......:......8Z......g.N......F....>...........t.....D ......k.N.......I......^....|.`#....I..2....<..G....^...N.........................;..........K....y..........GN......NO...........,.K.H.............pN......V...................."..........>.............~........%c.....z.q....i........".F.i.l.t.e.r. .h.i.n.z.u.f...g.e.n..........Add Filter.....FilterNameDialogClass.....".N.a.m.e. .d.e.s. .F.i.l.t.e.r.s.:..........Filter Name:.....FilterNameDialogClass.......O.h.n.e. .T.i.t.e.l..........Untitled.....QHelp.....\.D.i.e. .K.a.t.a.l.o.g.d.a.t.e.i. .k.a.n.n. .n.i.c.h.t. .k.o.p.i.e.r.t. .w.e.r.d.e.n.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....\.D.a.s. .V.e.r.z.e.i.c.h.n.i.s. .k.a.n.n. .n.i.c.h.t. .a.n.g.e.l.e.g.t. .w.e.r.d.e.n.:. .%.1..........Cannot create directory: %

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_en.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                                                              Entropy (8bit):4.0
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4n:CwZ
                                                                                                                                                                                                                                              MD5:BCEBCF42735C6849BDECBB77451021DD
                                                                                                                                                                                                                                              SHA1:4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
                                                                                                                                                                                                                                              SHA-256:9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
                                                                                                                                                                                                                                              SHA-512:F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`...

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_es.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):10704
                                                                                                                                                                                                                                              Entropy (8bit):4.481291573289571
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:192:q9J9j7e4BQhD0h61nnKz+DJF/45ojDU9V1Wa/rmtIBMH:Wp64ShDnnKz+FhjQpWa/ytoMH
                                                                                                                                                                                                                                              MD5:9EDF433AB9EE5FC7CF7782370150B26A
                                                                                                                                                                                                                                              SHA1:A918AE15A0DF187C7789BE8599A80E279F039964
                                                                                                                                                                                                                                              SHA-256:FD16B279F8CF69077F75E94D90C9C07A2AFFF3948A579E3789F5FFB5E5F4202D
                                                                                                                                                                                                                                              SHA-512:88245F6FBAAF603A03D7EA2341411AE040791D47C9FF110C6D6CDD8165F0A8BA7A4A0DA5CD543BBE95A4E93FE3A81E95B3664E00C11791FBCB4923E3A80ABC60
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......es_ESB...(.(.....7.0T..../.5w... C.Uj......`.......a[....0..........t..............39..........&e.........B<s...D..M^..............J..%p.O5^...I..)^...1..o>.......J..%.......#....t.....8dz..$..D ......k.N.....k.N.......n.......I..............2>....................G...#...w............!.......%..,................^............$a......6.>..........#...K...........$C.W.b....._Xn......GN...|..~.......TH.."..!.....5.K.H..#f.........pN...j......'..P.~... .o........(....>....."<..~....c.s.>.....o.... ..z.q..........................u.h....!p.......*..e....Qi..'}......(.L.a. .r.a.z...n. .d.e. .e.s.t.o. .p.u.e.d.e. .s.e.r. .q.u.e. .l.a. .d.o.c.u.m.e.n.t.a.c.i...n. .a...n. .e.s.t... .s.i.e.n.d.o. .i.n.d.e.x.a.d.a...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.....2.R.e.s.u.l.t.a.d.o.s. .d.e. .l.a. .B...s.q.u.e.d.a..........Search Results.....QCLu

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_fr.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):10922
                                                                                                                                                                                                                                              Entropy (8bit):4.459946393010639
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:192:w4BIn67/WsmoB3r6M/eYlSbyE7DnvE7pcn9nPJZe7nOFovzcNn7Uhmio+2/p53I/:w4N19fq3n2c9Bucuhmi52/X3Qpam
                                                                                                                                                                                                                                              MD5:D520C7F85CC06C66715A2B6622BF0687
                                                                                                                                                                                                                                              SHA1:47292D068172FBC9DC0D9BE2F479E890A37CE138
                                                                                                                                                                                                                                              SHA-256:687E351C062F688AAFF6CF05218D6017B80B1A1B4238D1D30250A55EE41C5FED
                                                                                                                                                                                                                                              SHA-512:736B50BB64751B127300BCAFE88888A9D9A2081CBF934EDCFFEF6CEF0575505AFDF714273A97671ABB598AE3D23C8E55F7DCD632FB0AA219ED5F763768576E04
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......fr_FRB...(.(.....y.0T....K.5w...!1.Uj....*.`.......a[............5..t..............39....m.....'W.......S.B<s...d..M^.. ...........J..&`.O5^...+..)^......o>.......J..&.......$....t.....8dz..%..D ......k.N.....k.N...D...n.......I...........c..2>..........M.........G...$...w....K..................,................^............$a......6.>...c......$...K....'......%M.W.b....._Xn...j..GN......~.......TH..#..!.......K.H..$Z......,..pN..........'..P.~.....o........(....h.....#4..~......s.>...M.o....!..z.q...........p......L.........h...."^.......b..e.....i..(W......(.I.l. .e.s.t. .p.o.s.s.i.b.l.e. .q.u.e. .c.e.l.a. .s.o.i.t. .d... .a.u. .f.a.i.t. .q.u.e. .l.a. .d.o.c.u.m.e.n.t.a.t.i.o.n. .e.s.t. .e.n. .c.o.u.r.s. .d.'.i.n.d.e.x.a.t.i.o.n...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.e. .:..........Note:.....QCLuceneResultWidget.....2.R...s.u.l.t.a.t.s. .d.e. .l.a. .r.e.c.h.e.r.c.h.e.

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_gl.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):10891
                                                                                                                                                                                                                                              Entropy (8bit):4.5087667371046205
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:192:Im7gBZHx4hCTNarW6EJDvoIR765f40wqNcMi/8F/Ihon:v0fHccarW6Eh61wqNcMi/Q/won
                                                                                                                                                                                                                                              MD5:B62C74793741FC386332A59113E8D412
                                                                                                                                                                                                                                              SHA1:589CE099F2C1D92581B5CF0E17BE49A2BF0014D4
                                                                                                                                                                                                                                              SHA-256:7399A248609974773F60866C87B78EA7DFBC4F750313D692F7886CD763883C9F
                                                                                                                                                                                                                                              SHA-512:D8E1A3B3732662BA572A1387651F2625742710834BEDB41809DA47B5D23020AA1B558B64A00C10C605D1844F0544483163F4A6227CAFFA5ECDABF3BBF4E12D9B
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......gl_ESB...8.(.......0T......Uj......`.....`.a[....F..........t..............1"... S.39.......s...!.............'F.........B<s...8..MQ.. ...........J..&S.0.....x.O5Q......)Q...O..o>...{.......#...J..&.......$....t.....8dz..%..D ......k.A.....k.A.......n.......I.................."...21....................G...#...w............[...!...?...........Q...?........$a....v.6.>..........$...K...........%0._Xa......GA...n..........~.......TH..#..K.H..$M.........pA...Z......'..P.~...B.o........(..........#+..~......s.1.....o....!..z.q...e.............................. ..e....wi..((......(.A. .r.a.z...n. .d.i.s.t.o. .p.o.d.e. .s.e.r. .q.u.e. .a. .d.o.c.u.m.e.n.t.a.c.i...n. .a...n.d.a. .e.s.t.e.a. .a. .i.n.d.e.x.a.r.s.e...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.....*.R.e.s.u.l.t.a.d.o.s. .d.a. .p.r.o.c.u.r.a..........Search Results.....QCLucene

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_hu.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):10284
                                                                                                                                                                                                                                              Entropy (8bit):4.674501432335502
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:192:RNY+rCG3e7LBqYqYseBb/FEWBgSn62TdJgDO9esYGY3DtgGh621XlZ/8kWvIMK:4+rheHYYZdBb/pgSn62T/FeVD3DGGh62
                                                                                                                                                                                                                                              MD5:5A56E9E2ED6ECE3F249D1C2A7EB3B172
                                                                                                                                                                                                                                              SHA1:D6F079F40FBB813B0293C1D2210BAE7084092FEC
                                                                                                                                                                                                                                              SHA-256:70F33B569C2942F41C6D634EA6A61CB8D80EB2C7011BAD48EF6DBAE9677960D5
                                                                                                                                                                                                                                              SHA-512:28947128FC51791CFDBFD3958FAF9B33979DB52C90AE0159EDB01FE6032284EB37BC05187162983A0435560BCEA864B008F499CDB4CE662792599FE20A37972A
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......hu_HUB...(.(.......0T......5w......Uj......`.....4.a[....N..........t....".........39..........%..........B<s...8..M^...8..........J..$..O5^......)^...]..o>.......J..$......."N...t.....8dz..#g.D ......k.N...>.k.N.......n.......I..............2>..........a.........G...!...w.......................,................^............$a......6.>.........."...K....m......"..W.b...l._Xn...~..GN......~.......TH..!F.!.......K.H..!..........pN..........%..P.~...<.o........(.......... ...~......s.>...{.o.....c.z.q...K.......v......l.........h.... ........t..e....mi..%.....~.(.E.z. .a.m.i.a.t.t. .l.e.h.e.t.,. .h.o.g.y. .a. .d.o.k.u.m.e.n.t...c.i... .m...g. .i.n.d.e.x.e.l...s. .a.l.a.t.t. .v.a.n...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......M.e.g.j.e.g.y.z...s.:..........Note:.....QCLuceneResultWidget.....&.K.e.r.e.s...s.i. .e.r.e.d.m...n.y.e.k..........Search Results.....QCLuceneResultWidget.......A

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_it.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):10612
                                                                                                                                                                                                                                              Entropy (8bit):4.458970627057882
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:192:nRxcfy71b+myBN16cbc+w45rtlTnzo7uHp3JQJ9cVu4BJ1G82g33vOVrNL/7nEF1:RR4R/fJn9JizTgnqrNL/b0hH2K
                                                                                                                                                                                                                                              MD5:3639B57B463987F6DB07629253ACD8BF
                                                                                                                                                                                                                                              SHA1:65935A67C73F19FCF6023FB95030A5ACAF9DA21C
                                                                                                                                                                                                                                              SHA-256:316FE8D0815E2B4B396895BEB38EF1A40431915B5E054DF80F4C0CD556F26E4B
                                                                                                                                                                                                                                              SHA-512:AD7CA93D93A69F273CE80BE7F2F477543B9C5F9C7E4D7448223BFF084EA956B626D6837F22D83C5E282688B938F58C29073C4B5C6F26A797F716C14FABF9FFEE
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......it_ITB...(.(.....g.0T....y.5w... ..Uj....2.`.......a[............'..t..............39..........&..........B<s...j..M^...h......K...J..%..O5^...K..)^......o>...u...J..%.......#....t.....8dz..$..D ......k.N.....k.N.......n.......I..............2>.................o..G..."...w............-......./..,................^...'........$a......6.>..........#...K...........$..W.b....._Xn......GN......~.......TH.."n.!.....5.K.H..#"......>..pN..........&..P.~.....o.....~..(....p.....!...~....A.s.>.....o.... ..z.q..........................q.h....!0.......*..e....;i..'!......(.L.a. .c.a.u.s.a. .d.i. .c.i... .p.o.t.r.e.b.b.e. .e.s.s.e.r.e. .c.h.e. .l.'.i.n.d.i.c.i.z.z.a.z.i.o.n.e. .d.e.l.l.a. .d.o.c.u.m.e.n.t.a.z.i.o.n.e. ... .a.n.c.o.r.a. .i.n. .c.o.r.s.o...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.......R.i.s.u.l.t.a.t.i. .d.e.l.l.a. .r.i.c.e.r.c.

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_ja.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):7917
                                                                                                                                                                                                                                              Entropy (8bit):5.680408580146589
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:192:mP6J37GcBzRjYEPEJJGTnwfJJxb7FTPjzzZBL3/q/I53:mSVqclR5s6Tnwfb7Pj/PL3/q/w3
                                                                                                                                                                                                                                              MD5:1380A9352C476071BDA5A5D4FED0B6C5
                                                                                                                                                                                                                                              SHA1:9B737ED05F80FE5D3CD8F588CCEC16BB11DD3560
                                                                                                                                                                                                                                              SHA-256:AE603B2C0D434D40CDE433FFCBA65F9EE27978A9E19316007BE7FE782A5B8B47
                                                                                                                                                                                                                                              SHA-512:EC3D68126488C3A163898BACAF7E783217868573635182CAF511ED046B4BE1F99A71FBB24DA607CCB50EDAF70893007AAEE9A6BAAE4C1CD33465A0915AA965DA
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......jaB...(.(.....S.0T......5w....'.Uj......`.......a[............u..t............!.39.....................B<s......M^..............J...>.O5^...O..)^......o>.......J...............t...w.8dz.....D ......k.N.....k.N...H...n.......I...........i..2>...<......G......9..G....P..w............i..........,................^..........'.$a......6.>...5..........K............S.W.b...2._Xn......GN...@..~.......TH.....!.......K.H.............pN...........S.P.~.....o.....|..(..............~....o.s.>.....o.......z.q..................@.........h.....&....... ..e.....i........@.(0.0.0.0.0.0.0n}"_.0nO\b.0L}BN.0W0f0D0j0D0_0.0K0.0W0.0~0[0.0..).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......l..:..........Note:.....QCLuceneResultWidget......i.}"}Pg...........Search Results.....QCLuceneResultWidget.....R0.0.0.0.0.0.0n}"_.0nO\b.0L}BN.0W0f0D0j0D0_0.0.i.}"}Pg.0LN.[.Qh0jS..`'0L0B0.0~0Y0..........VThe search results may

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_ko.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):5708
                                                                                                                                                                                                                                              Entropy (8bit):5.698914195742074
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:96:elPQHJ6L4c7LaQaFQv2QEhBL+Ejma0W40U0BzlQlcrnUSaTIdspIc18CLRSM3LBY:dHI97W1BbNz1VqqzJpoj5y5uY7OGrWFE
                                                                                                                                                                                                                                              MD5:CD15674A652C2BF435F7578E119182F8
                                                                                                                                                                                                                                              SHA1:AEA22E4A0D21396733802C7AB738DDD03737B7D6
                                                                                                                                                                                                                                              SHA-256:F11C64694E8E34E1D2C46C1A1D15D6BA9F2DB7B61DE4FDF54ECA5AB977C3E052
                                                                                                                                                                                                                                              SHA-512:88BFA112F4DBC0BFB4013CE0937E5180B4AB4A217FC8A963798C7C86532E794E4A1AD88416AE42F26A1C0631B465A5D69BFE75366E048502F5E21F4115A12F19
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......koB............%.......0T......K:^...g.Uj......`........YJ...>.E.4...........z...>..........;.B<s...K.B\>...b........+.s.....zq....[..9....F..vR......@.......@.......:....c.8Z......g.N...7..F....|...........t.....D ......k.N.......I...m..^......`#....!..2.......G....@...N.................................X..K....{.......i..GN......NO.............K.H..........S..pN...z..V...............................>...........:.~.....i..%c.....z.q....i...s......D.0. .............Add Filter.....FilterNameDialogClass.......D.0. .t...:..........Filter Name:.....FilterNameDialogClass........... ...L..........Untitled.....QHelp.....(...L... ...|.D. .....`. ... ...L.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....".....0...|. .... ... ...L.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....2...|. .%.1... ...x. .L.t...D. .... ... .................&Cannot create index tables in file %1......QHelpCollectionHandler.....,.

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_pl.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):9673
                                                                                                                                                                                                                                              Entropy (8bit):4.622652249027856
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:192:TO/7kBL9wGu3wtCnlhLJUBB7oph+mZ18LgP:T8QnwcCnlhdvphpZ18LgP
                                                                                                                                                                                                                                              MD5:2B68446B69D9AA40B273D75A581D2992
                                                                                                                                                                                                                                              SHA1:8A09BD38998543B74E2673478EDD54FB4BBDD068
                                                                                                                                                                                                                                              SHA-256:CC6CB4D8C54086224672F2E49E623C8CB7C0C1CD65B8D5ECD42FC9BA3A6065BD
                                                                                                                                                                                                                                              SHA-512:F3A3D6A416B3411613B06FC3EE56625D4D4DE80087182AB0D0601E49314861ABEF97D11A15B4C0511911544A59FBC4A4A52F0CCF0FD43F763A76A8922D8E57B6
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......plB.....(.......0T....T.5w......Uj... R.`.......a[...............t............2.39....H......6.......n.B<s.. ...M^..._......6.O5^...F..)^......o>...............t.....D ......k.N.....k.N.../...n.......I...W..........2>...w................G.......w............&.......:..,................^...(..... ..$a....?.6.>...$..........K......W.b....._Xn......GN...Y..~......!.....*.K.H...E....."...pN...-.........P.~...}.o........(....1..~......s.>......%c.."..o.....r.z.q............................h................e.....i..#.......N.i.e.n.a.z.w.a.n.y..........Untitled.....QHelp.....P.N.i.e. .m.o.|.n.a. .s.k.o.p.i.o.w.a... .p.l.i.k.u. .z. .k.o.l.e.k.c.j...:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....>.N.i.e. .m.o.|.n.a. .u.t.w.o.r.z.y... .k.a.t.a.l.o.g.u.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....H.N.i.e. .m.o.|.n.a. .u.t.w.o.r.z.y... .t.a.b.e.l. .w. .p.l.i.k.u. .%.1........... Cannot create tables in file

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_ru.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):7288
                                                                                                                                                                                                                                              Entropy (8bit):5.297177914619657
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:192:dBJjvfq7D6X68uBAzlp5W9+yBPZZZMM7vL0PXJL:JKrMEL0PXJL
                                                                                                                                                                                                                                              MD5:794AF445A5D7082D51BD22683449F86D
                                                                                                                                                                                                                                              SHA1:3A0C369872B112A1572AA17EEB814B168B225D98
                                                                                                                                                                                                                                              SHA-256:557B644E6DA5F1EC720EF93965617087E4D1F40B2494CC5AA524CF3796108DE7
                                                                                                                                                                                                                                              SHA-512:D42C870A16AEE7626BBE24886AD423895529A2F1A51AC2DBC303BC0E4EF9D3241FE894ECA3F7217AD408C8DCEE165CA4B89D84570357B0EB80340A3F72B0A846
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......ruB..........\.%.......0T......K:^.....Uj....L.`........YJ...X.E.4...............>............B<s.....B\>............+.s.....zq.......9....B..vR...L..@.......@....G..:......8Z......g.N......F....>...........t.....D ....R.k.N...E...I...W..^......`#....s..2.......G....^...N.........................K.......d..K............O..GN...b..NO.............K.H.............pN...P..V....................g..........>.............~........%c.....z.q....i........$...>.1.0.2.;.5.=.8.5. .D.8.;.L.B.@.0..........Add Filter.....FilterNameDialogClass.........<.O. .D.8.;.L.B.@.0.:..........Filter Name:.....FilterNameDialogClass.........5.7.K.<.O.=.=.K.9..........Untitled.....QHelp.....b...5. .C.4.0.;.>.A.L. .A.:.>.?.8.@.>.2.0.B.L. .D.0.9.;. .:.>.;.;.5.:.F.8.8. .A.?.@.0.2.:.8.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....<...5. .C.4.0.;.>.A.L. .A.>.7.4.0.B.L. .:.0.B.0.;.>.3.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....`

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_sk.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):10388
                                                                                                                                                                                                                                              Entropy (8bit):4.70568613551943
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:192:uPq7iBWseXKkVu4+Qv9zEJ1xGMaLNmBgJqdC6/MxIMt:LWcseV04Xv9zEoLNDJqdX/MxRt
                                                                                                                                                                                                                                              MD5:75C94E59F1FC5312AE25381C247AF992
                                                                                                                                                                                                                                              SHA1:E3E5F4582CC5FAFE6DF43644D11484861023C084
                                                                                                                                                                                                                                              SHA-256:F41E33E1D790BD0D3EB180F1F875BC191FE74773628F25C2CAD95E1402E66867
                                                                                                                                                                                                                                              SHA-512:959B8F4D57FC9728DD4804322333D1792D45A0EE85615B559E0CA3BD2DEA22E2C8C68C6482AE9425D29C819B0ED27473EDDC82EF4B6ECFFB2E2E7B56E1509B63
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......sk_SKB...8.(.......0T......Uj......`.....0.a[....8..........t..............1"......39.......s........... .....%..........B<s...6..MQ..............J..$-.0.......O5Q......)Q...;..o>...........G...J..$......."....t.....8dz..#..D ......k.A...2.k.A.......n..._...I.................. ...21..........e.........G...!...w....Y...........!...........=...Q............$a......6.>.........."...K....i......# ._Xa..."..GA..............~.......TH..!{.K.H.."7.........pA..........%..P.~.....o........(..........!...~....u.s.1.....o.......z.q...c..............................f..e....9i..&-......(.D...v.o.d.o.m. .m...~.e. .b.y.e. .t.o.,. .~.e. .d.o.k.u.m.e.n.t...c.i.a. .s.t...l.e. .n.i.e. .j.e. .z.i.n.d.e.x.o.v.a.n.....).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......P.o.z.n...m.k.a.:..........Note:.....QCLuceneResultWidget.....".V...s.l.e.d.k.y. .h.>.a.d.a.n.i.a..........Search Results.....QCLuceneResultWidg

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_sl.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):10363
                                                                                                                                                                                                                                              Entropy (8bit):4.613473842638716
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:192:vNBqTi7qBCVIQf54EslZ2Jy/L/BnmpP0bX3caK6q1B6/hgIlCCUb0:vjq2+UVT4ESZOYmpP0bX26q1I/yqCCUw
                                                                                                                                                                                                                                              MD5:3B0AEE27B193A8A563C5CB5C7C4FE60F
                                                                                                                                                                                                                                              SHA1:C94E832595EC765370553468F87C02DB7E7D138A
                                                                                                                                                                                                                                              SHA-256:2EC955E662407EBCD8DCDAE5AAA21E4108E0B5B0AEE0E9DB712C27072943535F
                                                                                                                                                                                                                                              SHA-512:EBC25C378126876F44279E23CA0CF06FC9E7D5F51AD7E3DBDABA7A50C81112EDC1C76F7FD0AF47E447A93C3593BB953A0C9C1FBBFC49494E6B29BF21655F690E
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......slB...8.(.....E.0T......Uj......`.......a[............!..t..............1"....;.39.......s....^............$........i.B<s...,..MQ..........}...J..#..0.....Z.O5Q...[..)Q......o>...............J..$I......"W...t...C.8dz..#H.D ......k.A.....k.A.......n.......I.................. P..21....................G...!...w............?...!...3...........Q...+........$a....>.6.>.........."...K...........".._Xa......GA..............~....A..TH..!I.K.H..!..........pA...>......%..P.~...>.o........(....d..... ...~......s.1.....o.......z.q.....................................e....{i..&.....z.(.R.a.z.l.o.g. .j.e. .m.o.r.d.a. .t.o.,. .d.a. .s.e. .d.o.k.u.m.e.n.t.a.c.i.j.o. .a.e. .v.e.d.n.o. .i.n.d.e.k.s.i.r.a...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......O.p.o.m.b.a.:..........Note:.....QCLuceneResultWidget.....".R.e.z.u.l.t.a.t.i. .i.s.k.a.n.j.a..........Search Results.....QCLuceneResultWidget.......R.e.

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_tr.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):4629
                                                                                                                                                                                                                                              Entropy (8bit):4.68793836539357
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:96:BoiK0UD2wMLb7Lqlguotqbww5BLNwWjK0kHU9zuQlUVUfniqthweEIFwC18lLEGA:PXFf7pU75BWWOpcJcVqDFNz8brgyf76r
                                                                                                                                                                                                                                              MD5:32D6EE3D8EE6408A03E568B972F93BCB
                                                                                                                                                                                                                                              SHA1:582EE079DBD42000C378E0701D26405750524DBA
                                                                                                                                                                                                                                              SHA-256:EBDECA0CFEE7A9441DEB800BABFD97C63BC4E421DA885C55B3BD49725EBACD25
                                                                                                                                                                                                                                              SHA-512:24AAA30B9CB4DB82A57411FBA24A87D70D8B845AE48A6FDA633D0BE6B824B58FDD2F450C2B385F16F49E2F9C6FA0A3124FD0F28594726940F996C66F8F3216CC
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......tr_TRB.....%.....[.0T......Uj......`.....$..............L.B<s.....B\>..........4.+.s...............t.....D ......k.N...5...I......2.......G....5...N..........a...............f..K....9..........GN...........@.K.H..........q..pN...t..........>...z.~...../..%c.....z.q....i..........B.a._.l.1.k.s.1.z..........Untitled.....QHelp.....J.K.o.l.e.k.s.i.y.o.n. .d.o.s.y.a.s.1. .k.o.p.y.a.l.a.n.a.m.1.y.o.r.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....2.D.i.z.i.n. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....\.%.1. .d.o.s.y.a.s.1.n.d.a. .d.i.z.i.n. .t.a.b.l.o.l.a.r.1. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r...........&Cannot create index tables in file %1......QHelpCollectionHandler.....N.%.1. .d.o.s.y.a.s.1.n.d.a. .t.a.b.l.o.l.a.r. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r........... Cannot create tables in file %1......QHelpCollectionHandler.....P.S.q.l.i.t.e. .v.e.r.i.t.a.b.a.n.1. .s...r...c...

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_uk.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):9750
                                                                                                                                                                                                                                              Entropy (8bit):5.281035122342072
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:192:eMp79BCN+u8hhbHbny+HJouHgei50JBSfDvbetpP/RIkT:eIhgNgBbny+phiS3SfDDetpP/RRT
                                                                                                                                                                                                                                              MD5:90A776917D534B65942063C319573CDC
                                                                                                                                                                                                                                              SHA1:5DF3B213D985A3BBDB476B37B7780D7D7DF17E41
                                                                                                                                                                                                                                              SHA-256:497CFC473684692EE44D7A3795E8FB2270C57069FD9EB98A615DD29AB9BE8A7C
                                                                                                                                                                                                                                              SHA-512:B34A019716B50CE8E1E20AC32756B3B0D5802971F7A04F4BDDE2418DA551AFB9742B79E934979DB6FAB9DAC05D7D26A3B19ABA77158321F8D9AAB08AEBBD455A
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......uk_UAB...(.(.....?.0T......5w......Uj......`.......a[...............t............K.39....u....."..........B<s...8..M^...j......y...J..!..O5^...Y..)^......o>...o...J..":...... <...t...E.8dz..!3.D ....".k.N.....k.N...d...n.......I..............2>...>......o.........G.......w............E.......e..,................^...S........$a......6.>...'...... y..K........... ..W.b....._Xn......GN...p..~.......TH...4.!.....9.K.H.............pN..........#].P.~...~.o.....N..(....b.........~......s.>.....o.....o.z.q..........................U.h.............D..e.....i..#.......(...@.8.G.8.=.>.N. .F.L.>.3.>. .<.>.6.5. .1.C.B.8. .B.5.,. .I.>. .4.>.:.C.<.5.=.B.0.F.V.O. .4.>.A.V. .V.=.4.5.:.A.C.T.B.L.A.O...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.........@.8.<.V.B.:.0.:..........Note:.....QCLuceneResultWidget.....". .5.7.C.;.L.B.0.B.8. .?.>.H.C.:.C..........Search Results.....QCLuceneResultWidget....... .5.7

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_zh_CN.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):6441
                                                                                                                                                                                                                                              Entropy (8bit):5.790303416386852
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:192:pB37nBD4H5PCyLDxLSzJPduYx9vja/FIgH9yIFqfs:rTZ4HUAD1S1JFe/F59PFqfs
                                                                                                                                                                                                                                              MD5:9297A6905B8B1823BF7E318D9138A104
                                                                                                                                                                                                                                              SHA1:3DB992A1B3BBCAF314B7EA4A000D6334D7492A52
                                                                                                                                                                                                                                              SHA-256:C02AAA20923F18ADDAB520BE5CB84EFD4C723396BDC24B4C9A72D406F101C7B4
                                                                                                                                                                                                                                              SHA-512:01F12CEE0AE456D78942A6049E1C77F94B406C8FFB4A5944DE15E54D1C760CDBA13279530A8F29B1443D1BBC647D3AF5436AAD8C43EB3944316C48300B3827E4
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......zhB......I....L.0T......Uj......`.......a[...............t....P..@....Z.......<.........39.......s....2.................B<s......MQ..........9...J......31.....0.......O5Q......)Q...^..o>...........(...........J...V...........t.....8dz.....D ....Z.k.A.....k.A.......n.......I...........t..w................!...........o.......D...Q...E........$a......6.>...h...............%._Xa......GA..........._..TH...r.........pA.............P.~.....o.....].~.q.............~......o.....h.z.q...........H..0q....................i........2..S.u...y.`.Q.v.S.V.S..f/V.N:..e.hckcW(..}"_.0............M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......l..............Note:.....QCLuceneResultWidget......d.}"~.g...........Search Results.....QCLuceneResultWidget.....,d.}"~.g.N_..^vN.[.et..V.N:..e.hckcW(..}"_............VThe search results may not be complete since the documentation is still being indexed!.....QCLuceneResultWidget..

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_help_zh_TW.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):9301
                                                                                                                                                                                                                                              Entropy (8bit):5.80411750798786
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:192:4bgIXwsL78BQp4dRDP0ludqODa/wkB/tTWn5dJ6mO8IZiT9Dzz/wI3HyRWqUqS:lI/oS4dR5c/tTWn5/EZA9D/w+H8WqUqS
                                                                                                                                                                                                                                              MD5:47C3328D3918CF627112BB6C50E30B86
                                                                                                                                                                                                                                              SHA1:05705603AB3F28402A6C103E1C41DDFF21D140C0
                                                                                                                                                                                                                                              SHA-256:3697F1660D7F2AC9B37AC33CD1C7ECAE08ADBD26710E7E0076497CCDDC8BC830
                                                                                                                                                                                                                                              SHA-512:8DE1C3C5A48965CF6D8AA545DA9F0A5C00AE124F3E4153597915E7C0F4CAE1E26723270F58A47AA9FFA4AAF30E6EBA522D4EBAD27DECF17EF108E353E611980E
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......zh_TWB......I....[.%.......0T......0T......Uj......Uj....R.`.....>.a[....................g..t....7..@......................39.......s................... .........B<s.....B<s.....B\>......MQ..........[...J...]..31.....+.s...c.0.....U.O5Q......)Q...C..o>.......................J...............t...3...t.....8dz.....D ....R.D ......k.A.....k.A.....k.N...'...n.......I.......I...........[..2....x..G........N......w................!...........:...........Q...&...............$a......6.>...I.......L.......$..K......................_Xa...y..GA...O..GN...........$..........TH...I.K.H................ Y..pA...K..pN.............P.~.....o.....D.~.q......>.............~......~........%c.. ..o.....!.z.q...........#..0q....................i..!Y....(..g.S..f/V.p.N.W(^.z.e.N.v.}"_.uvN-0............M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......P..;............Note:.....QCLuceneResultWidget......d.\.}Pg...........Sea

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_hu.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):146
                                                                                                                                                                                                                                              Entropy (8bit):3.6255640074603277
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/IrLlAlHekfK/gp1MUXaMlI+rwtbWlMiayIPldkOgn:CwDrC+TYIUrIRt6HoiHn
                                                                                                                                                                                                                                              MD5:5A46979B45C67DD6312F33CCEA2ED7BC
                                                                                                                                                                                                                                              SHA1:4C56836B1FB10D9903B299CBCB925947D515B4C8
                                                                                                                                                                                                                                              SHA-256:BB246AABD501E14CED8B1FFC1369E3D5D26567AAE62B3EAD4D94C22FB77C3471
                                                                                                                                                                                                                                              SHA-512:BDBA4E1731CF254E95B0F1337410937C765E96FBB1D42F1D053033E1511FEE6F50C02705F781F4DAA0347E2299DC78A5A9942AC4EA343ED1F8F401F9ACD961E4
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......hu....v.....q.t.b.a.s.e._.h.u.....q.t.s.c.r.i.p.t._.h.u.....q.t.m.u.l.t.i.m.e.d.i.a._.h.u... .q.t.x.m.l.p.a.t.t.e.r.n.s._.h.u

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_it.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):153
                                                                                                                                                                                                                                              Entropy (8bit):3.5752972123113778
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/EbFlAlHeke5zOp1MUWLt7KlI+rwtbWlMj5FKIPldkOA9kk:CwDM+35aIUW5SIRt6Q50oi9Gk
                                                                                                                                                                                                                                              MD5:2BB8C94D420D3BC344C79A01043BDC89
                                                                                                                                                                                                                                              SHA1:3FBA773D58E6D3699C20AB41AEE6801E71E2DDAE
                                                                                                                                                                                                                                              SHA-256:9117AAC2D07BC86DFA55A29B8825ED27C7093300FCC90E143E135E00E85F09D7
                                                                                                                                                                                                                                              SHA-512:C6B13655AFB206B0056F5656B4A9BF33CC267FCC928F6973258131CFA6443970510226FE45A041E5AA988809E17D0B11C7458F4A241C71521EDED186596C6055
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......it....v.....q.t.b.a.s.e._.i.t.....q.t.s.c.r.i.p.t._.i.t.....q.t.m.u.l.t.i.m.e.d.i.a._.i.t... .q.t.x.m.l.p.a.t.t.e.r.n.s._.i.t.......

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_ja.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):146
                                                                                                                                                                                                                                              Entropy (8bit):3.599979504080125
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/il/lAlHekd6hY1MUV6JAlI+rwtbWlMgel3UlIPldkOG:Cwz4+pjUGAIRt6qVUloiB
                                                                                                                                                                                                                                              MD5:8A1EE3433304838CCD0EBE0A825E84D8
                                                                                                                                                                                                                                              SHA1:2B3476588350C5384E0F9A51FF2E3659E89B4846
                                                                                                                                                                                                                                              SHA-256:23457CE8E44E233C6F85D56A4EE6A2CECD87C9C7BDDE6D8B8A925902EED1CD9C
                                                                                                                                                                                                                                              SHA-512:2D8ACD668DF537E98B27161F9FA49828EB2EB6E9CF41DB38E7F5D31F610D150CD1B580A8AE9B472A4DFDE4D4BF983C24A56293BB911CF5879368664E4D4CF3D2
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......ja....v.....q.t.b.a.s.e._.j.a.....q.t.s.c.r.i.p.t._.j.a.....q.t.m.u.l.t.i.m.e.d.i.a._.j.a... .q.t.x.m.l.p.a.t.t.e.r.n.s._.j.a

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_ko.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):146
                                                                                                                                                                                                                                              Entropy (8bit):3.652277257665055
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/rrr/lAlHekcQ/01MUUQMlI+rwtbWlMhQGlIPldkORn:CwCC+1Q/UUpIRt6SBloimn
                                                                                                                                                                                                                                              MD5:7B2659AF52B824EAC6C169CDD9467EE9
                                                                                                                                                                                                                                              SHA1:5727109218B222E3B654A8CC9933E970EB7C2118
                                                                                                                                                                                                                                              SHA-256:4CC1AF37E771F0A43898849CFF2CD42A820451B8D2B2E88931031629D781DB05
                                                                                                                                                                                                                                              SHA-512:E9475AC80BDBBEFF54F2724A2B6BA76992F18FD1913FD8EE1540A99FD7A112B79FED5A130B6AC6D7460E4420C06354FC6E4CF7770A7C6CBD3EAC1BDAF0082DE5
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......ko....v.....q.t.b.a.s.e._.k.o.....q.t.s.c.r.i.p.t._.k.o.....q.t.m.u.l.t.i.m.e.d.i.a._.k.o... .q.t.x.m.l.p.a.t.t.e.r.n.s._.k.o

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_lt.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):165383
                                                                                                                                                                                                                                              Entropy (8bit):4.805977227348512
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:i5v3+zmayloj6yJjhnBAbnrKnGrhA7WgdXclIsooY9i:SvOzAloj6yJ9BA7riGr+7WKXc+s5ui
                                                                                                                                                                                                                                              MD5:8992B652D1499F5D2F12674F3F875A35
                                                                                                                                                                                                                                              SHA1:E22766A49612F79156C550D83C6C230345DDA433
                                                                                                                                                                                                                                              SHA-256:47EB5F97467DF769261421D54A5BEA1131C9FB9B6388791D38BB6574335B64BF
                                                                                                                                                                                                                                              SHA-512:9B8B6DBFF432F2A46C14BC183A6BAF84ACBF02BF2C5BB8C306C6538FBD9BE1C0A9015BD46728F2F652F9163AFC56B1E16D16EB95D8F7728F3C562AE9F4F1AE1E
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......ltB..0X...*..)C...+...|......P....@..9....A..9....B..:....C..:....D..;....E..;....F..<6...G..<....H..=)...I..=....P..>q...Q..>....R..?....S..@f...T..@....U..A\...V..B....W..B....X..C....Y..Cy...]..k....t..........t>......th......t.......pd...;..J'...;.._h...;.......;...{...;..J....;...)...M..l....O...R...O...............}..l9...m..lo......^S..(5..P{..+;..4...+;......+;......+O..4...+O......1...^...E@..?p..F...C...H4......HY......H.......I...D...I@..s...IA..t...IC...2..J.......J....Y..J.......J.......K...9...LD...`..L.......PS......R.......T...q...Zr...`..[`......[`..&@..\....e..\....b.._......._....P..1........E..........5........L..1...O...1...PP......7......../...........$.......$.......,.......y.......y..........K^..............x......8................L...E.......E.......E..*....................%..:....%.........0U.....W......Zo.....^....5.......0..I....0...F...0...|...0.......0.......0..+\...5...}.......... D...g.. D......+....j..,.......,.......<U...+..<U

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_lv.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):89
                                                                                                                                                                                                                                              Entropy (8bit):4.156834975253888
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/HzllldQlHekbxplUp1MUTJ+b:Cwv+DIUEb
                                                                                                                                                                                                                                              MD5:19F1B919BB531E9E12E7F707BEBD8497
                                                                                                                                                                                                                                              SHA1:46E82683CEA28D877C73A5CE02F965BB1130FC62
                                                                                                                                                                                                                                              SHA-256:03467738042A15676E504BA02CB326DCDB773B171FADA3CD62B7A0E0564314A0
                                                                                                                                                                                                                                              SHA-512:901D7B26CAC7A4D0FFDB39A1D25767B5BC71BED4AFBE788D70BF19D4C58A8295167111675AB45E743FDF4768AF874D69417414C01CF23D5C525A3F6C8BF7D21F
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......lv....0.....q.t.b.a.s.e._.l.v.....q.t.s.c.r.i.p.t._.l.v........)....

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_pl.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):161
                                                                                                                                                                                                                                              Entropy (8bit):3.8693516202048612
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/5J/p/lAlHekHp/7KlI+rwtbWlM6Tl/z21MUPp/FOlIPldkOjehB:Cwr+26IRt6nFURkloiT
                                                                                                                                                                                                                                              MD5:D71EA9FEFD97464B178235150EC8759E
                                                                                                                                                                                                                                              SHA1:61026FE602FD1B8B442A0D341C6BD759EEC75488
                                                                                                                                                                                                                                              SHA-256:BD7DD0C2CAB119A973DC10C3BFF7499D9728B928B541F86056921B30C8DB78E6
                                                                                                                                                                                                                                              SHA-512:ECD76A7D8B8D733E635B2BFEA90A4CD387B83D9D8A4EB6D299F59FF22AAA8D617A4C886A825A1CDDD901925C7839E2C18BDD4E0CD84152641922B66B62663F77
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......pl....v.....q.t.b.a.s.e._.p.l.....q.t.m.u.l.t.i.m.e.d.i.a._.p.l.....q.t.s.c.r.i.p.t._.p.l... .q.t.x.m.l.p.a.t.t.e.r.n.s._.p.l............,..

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_pt.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):70334
                                                                                                                                                                                                                                              Entropy (8bit):4.732724622610353
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:768:OKGUuWW+WHjS0gMBd483+Y7bDPs4RHBloLUIltlzAJnx4nnliM1OPlOibLG:JGUuWPuSgm0Jn+n4Mhj
                                                                                                                                                                                                                                              MD5:6656500F7A28EF820AE9F97FD47FB5BB
                                                                                                                                                                                                                                              SHA1:CC112B9C9513BCF7497F3417168B4C8A9F7640A9
                                                                                                                                                                                                                                              SHA-256:2C1E7BBF5168A64B43752DD4C547601C0BDE6D610F8671FA3E3AF38597E84783
                                                                                                                                                                                                                                              SHA-512:5C3CBFCF86AF6B4D949C1D914CD379E512E73BA350AF661033A386EE7FB981FBFCB43D9A35FDE7656E17BB09F64F1469F84867A780573C3359D645269461D5A6
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......pt_PTB...(...*...9...+...e...]..6....;.......;..-....;..;`...;..};...;.......M..6....O... ...O...w...........}..7....m..7B..........+;......+;..8S..+;..>...+O......+O..8#..H4......H.......J......K.......LD...)..L....}..PS...l..Zr...B..[`...;..[`.....\...kU.._......._.......1...?...............8...............E............,..................p........0...............v...........%...O...%..G........4...0.......0..:....0..y....0..|....0.......0...X...5.......5...... D..=... D..Kn..+....L..,...>...,......<U..z...<U......<.......F...>...F.......H5...4..H5..=...H5..K...H5......f....p..f...1...f...;...f...I...f...|H..f.......f.......l....................b......<...............>.......L ...........`......`..._.......A......2....e...g...e..>D...e..LW................y...,.*.y.....*.y..o..*.y.....*.T..L..*.0..'..*.0....+F...y..+F......+f......+f...C..+.z..0..+.....d.+....p0.+.....R.+.z..0U.+.....u.+....8..+....Ct.+....L..+....y..+.....Z.+......+...pc.+.....+....0..

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_ru.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):164
                                                                                                                                                                                                                                              Entropy (8bit):3.984562388316898
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/oZlAlHekF8Op1MUNKJKlI+rwtbWlM4KKIPldkOSxRMugB:CwY+GIUgcIRt61oihM3
                                                                                                                                                                                                                                              MD5:F7A8C75408B9A34A2B185E76F51B7B85
                                                                                                                                                                                                                                              SHA1:065E987139C5FB809A6F9CDF3845BCD79707FDBB
                                                                                                                                                                                                                                              SHA-256:6492B267608C6FB76907BD8FCFC8F1EF57E9F4EBBC2E81ACA81715A88388F94A
                                                                                                                                                                                                                                              SHA-512:E768C5B438EC899801B22B1325F2244ACCC5E7C2EC5D270F510BC3CBC2D9A0536949C026DB7FB5862835E506A9F2020DEB2CC4001E7011FF974324542734F855
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......ru....v.....q.t.b.a.s.e._.r.u.....q.t.s.c.r.i.p.t._.r.u.....q.t.m.u.l.t.i.m.e.d.i.a._.r.u... .q.t.x.m.l.p.a.t.t.e.r.n.s._.r.u........)......,..

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_sk.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):157
                                                                                                                                                                                                                                              Entropy (8bit):3.7731953311404336
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/3xRlAlHekE8lgp1MUM8lMlI+rwtbWlM5UllyIPldkOfll6kchn:CwS0+t8CIUM86IRt6KUlsoi2CVh
                                                                                                                                                                                                                                              MD5:24C179481B5EF574F33E983A62A34D53
                                                                                                                                                                                                                                              SHA1:0A67F1ED8CA4A5182F504806F8D47D499789F2D2
                                                                                                                                                                                                                                              SHA-256:B6ADFFD889FF96BF195CB997327E7D7005A815CAD67823FA6915A19C2D9BB668
                                                                                                                                                                                                                                              SHA-512:4757F3693120DAB2FBB7BCF1734EA20B3E3D9056B4B4E934A3129D660CFDC6C58B230459DB55912AF24AD5692BD221830BE0FF91E41D3EECD9439E79AC23FFE6
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......sk....v.....q.t.b.a.s.e._.s.k.....q.t.s.c.r.i.p.t._.s.k.....q.t.m.u.l.t.i.m.e.d.i.a._.s.k... .q.t.x.m.l.p.a.t.t.e.r.n.s._.s.k...........

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_sl.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):228428
                                                                                                                                                                                                                                              Entropy (8bit):4.726953418955661
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3072:9zQH0hOtgmiAZu0eeAEv+v49JnnSmICgr3n7jhCQUeinqyU5UggtRLGrQ2LZO+Y1:RpUsSpGr36wsR
                                                                                                                                                                                                                                              MD5:D35A0FE35476BE8BD149CEE46E42B5E9
                                                                                                                                                                                                                                              SHA1:9F3C85C115A283E5230D1EEAD84C8CB73A71FA03
                                                                                                                                                                                                                                              SHA-256:C44E0313A9414CC0E490B65B0C036FA11BCA959353B228886547BC2C8492034F
                                                                                                                                                                                                                                              SHA-512:BEEB1751882AF081E80BE93F7464D4C6322B724EFA2CBD3E1CBE709181D380C1C57E770FA962BB706D6FCF4A8CB393E3F6E187C1F604F8CEEFB201CA3200BD1C
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......slB..<....*.......+.......@...C...A.......B...<...C.......D...2...E.......F...d...G.......H...W...I.......P.......Q.......R.......S...x...T.......U...n...V...%...W.......X.......Y.......]..g~...t...V.......f..................................;..G....;..[....;...q...;..ia...;... ...M..g....O.......O.......[..,e...........}..g....m..h........Q..(5......+;..2...+;...b..+;...i..+O..2...+O...4..1......E@......F.......H4......HY...%..H.......I.......I@......IA...9..IC......J...6...J.......J.......J...^...K...7...LD......L....n..PS...U..R.......T....=..Zr......[`...V..[`......\...!,..\...8U.._..."b.._.../h..1.......E...9......4...............5........e...................$...<...$..Z....[.......,.......y...L...y..].......H.......@.......J.......6........~..........E...O...E..+....E...~..............,1...%..8r...%...........^..............................5.......0..Gx...0.......0..P....0..h....0.......0.......5...^.......... D...... D......+....`..,.......,...-...<U

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_sv.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):65851
                                                                                                                                                                                                                                              Entropy (8bit):4.7906769989650515
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:4u6DkpgyKmRmG15mGM6iFPi6Q/qTlOQZY2dKN8gKw:4u6DotUG1sGMZPi6Q/qTlO2Y2YKw
                                                                                                                                                                                                                                              MD5:0E85E0E0E7DDFE3D4BDE302F27047F9C
                                                                                                                                                                                                                                              SHA1:AE59348E0C2E4F86F99DA6CF5DAB3B7E92504B7C
                                                                                                                                                                                                                                              SHA-256:4B4B6FF7FD237C9DA0301B4946132E68653D15EB5FAF38E4C5FBFEBB12DD97F7
                                                                                                                                                                                                                                              SHA-512:8CAAB6C61E9FA26A3A289A9E4DC515D157B3092D6D4ED43861220261BD2B7CC79B35B52F9ADE4EF558B5385B37EAC14575420DD55C475F435BB95B6C1E2561B6
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`...B.......*.......+...i...]..6....;.......;..-f...;..:;...;..t....;.......M..64...O.......O...........q...}..6\...m..6........(..+;......+;..7...+;..=...+O......+O..7c..H4......H.......J.......K....F..LD...+..L.......PS...N..Zr......[`...7..[`...N..\...h4.._....J.._....k..1...>...............7........}......D............,...........*......i....................................%.......%..Fc.......6...0.......0..9....0..q....0..t....0.......0.......5.......5...... D..<}.. D..I...+.......,...=X..,.......<U..r...<U...n..<.......F...=...F....F..H5......H5..<...H5..J4..H5......f.......f...1V..f...:f..f...H;..f...t&..f.......f.......l..................8......;z..............<.......Je.......6...`...&...`...!.......9......1....e.......e..=....e..J..............g...y.....*.y.../.*.y..h..*.y.....*.T..J..*.0..'[.*.0...K.+F...q..+F.....+f......+f...A..+.z../..+.......+....i`.+.....X.+.z../..+.....S.+....7..+....Bi.+....K..+....q..+.......+......+...i..+.....+....0..F0i.....G.

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_tr.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):110
                                                                                                                                                                                                                                              Entropy (8bit):3.630483009136986
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/7zl9lAlHekDN/01MULV4LlI+rwtbWlM+N:Cw5+wUGRIRt6n
                                                                                                                                                                                                                                              MD5:16CDF5B9D48B0F795D532A0D07F5C3A0
                                                                                                                                                                                                                                              SHA1:6E403C9096B3051973E2B681DFEBBC8DD024830D
                                                                                                                                                                                                                                              SHA-256:F574A2CFD4715885C3DBDF5AE60995252673BD94FDAA9586F7E0586F6C1AC0EE
                                                                                                                                                                                                                                              SHA-512:36A0431368010157EA8A45DCB00458076CCFFC08B37E443DEBD1AAD4A30C6080803337725A7A3DCBF2B410DC7BE89CEAF6C07C46F876E4EF5B08159E3BF38E6D
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......tr....R.....q.t.b.a.s.e._.t.r.....q.t.s.c.r.i.p.t._.t.r.....q.t.m.u.l.t.i.m.e.d.i.a._.t.r

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_uk.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):164
                                                                                                                                                                                                                                              Entropy (8bit):4.021402900389864
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/ZlRlAlHekCczOp1MUKUt7KlI+rwtbWlM/cFKIPldkONRMugB:CwUl0+rjIUKUcIRt6M/oioM3
                                                                                                                                                                                                                                              MD5:9B101363343847FE42167183320C03F0
                                                                                                                                                                                                                                              SHA1:F0DF2CFF913E588B7CADFDABBF69F4F632B2F96A
                                                                                                                                                                                                                                              SHA-256:F1621E680E1642F9463E4B07E7E78B50F9A7BDB7C321D7302039CB3405CBDEA4
                                                                                                                                                                                                                                              SHA-512:DA14FDF8DB514902733CAAC492293873351C595EBBE0ACB0849BECE24AB822602EE64D01051F1426CD1FC13A95D8607302CF9B515D9806FDD3BD047087DE447C
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......uk....v.....q.t.b.a.s.e._.u.k.....q.t.s.c.r.i.p.t._.u.k.....q.t.m.u.l.t.i.m.e.d.i.a._.u.k... .q.t.x.m.l.p.a.t.t.e.r.n.s._.u.k........)......,..

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_zh_CN.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):117347
                                                                                                                                                                                                                                              Entropy (8bit):5.8593733369029195
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:51dXW89nqEFu54aekvRzHHSVuf8j2+/xc3lhnbsfdAoz/w:v9qEFeLekvRznSVHJG3lhn+djY
                                                                                                                                                                                                                                              MD5:0D02F0DE5A12BCB338B7042DFBDAACF3
                                                                                                                                                                                                                                              SHA1:B7C10D249D8986AD8C6939B370407D07227A39F5
                                                                                                                                                                                                                                              SHA-256:28CDE75D7B32C81FEF1D4630C37B79A61DEC24B357632FF00D6365A57D8BE43B
                                                                                                                                                                                                                                              SHA-512:21F02EBA36B4411921EA3C70310B8E454E8FC2B8F09957FD6A63B71689DC381F7A5E2C3BDF2810734D659AB43D8A7BD46EF6436ECC52F75C71B5F5C313365444
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......zhB..+....*.......+.......@.......A...8...B.......C.......D.......E...V...F.......G...L...H.......I...9...P.......Q...e...R...^...S.......T...T...U.......V...|...W.......X...o...Y.......]..4 ...;...2...;..,....;..8....;.......;.......M..4H...O.......O...........#...}..4p...m..4........N..(5......+;...f..+;..6Y..+;..<...+O...8..+O..6'..1......E@......F....Y..H4..."..HY..J...H.......I.......J.......J.......K....5..LD..._..L......PS...V..Q....6..R...N...W..../..Zr.....[`.....[`......\...lU.._......._....L..1...<........j......6...............B........I...$..K....$.......,...g...y...3.......A......r...........................9..L7......;w...E..5b...E...G.......5...%.......%..D........`......*........................0.......0..8W...0..}y...0...6...0.......0.......5.......5...... D..:... D..J...+....R..,...;...,......<U..~...<U......<......F...;...F......H5...i..H5..:...H5..Jk..H5...w..VE...[..f....u..f...0X..f...9...f...E...f.......f.......f....j..g....A..l.

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qt_zh_TW.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):141
                                                                                                                                                                                                                                              Entropy (8bit):3.7198292994386235
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4C/0N6xg/Rl/gl+kNXDelHrwtbWlMwTolIPldkOfDn:CwOO2+g6Mt63oloiUn
                                                                                                                                                                                                                                              MD5:ED4135D705AEF3D97F8BF6B8FF11F09C
                                                                                                                                                                                                                                              SHA1:308E2B8F74B863A61AD0B68F4A18ED06965EBEAA
                                                                                                                                                                                                                                              SHA-256:751ECDA0C33E061D91241268357FBD2F6B7F70A1116E714F28D22EFD61EC7A1A
                                                                                                                                                                                                                                              SHA-512:B6E6D00553A9C427130129B9D30E862028E549F372A832F0F05747C8E2A79E443F4932EC3AE177537C8BA00D26B5B6CB97D5B35426AB5229F6A468CA485BE0B1
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......zh_TW....n.....q.t.b.a.s.e._.z.h._.T.W...$.q.t.m.u.l.t.i.m.e.d.i.a._.z.h._.T.W...&.q.t.x.m.l.p.a.t.t.e.r.n.s._.z.h._.T.W

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_ar.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):160017
                                                                                                                                                                                                                                              Entropy (8bit):5.35627970915292
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:XGlAMfkX1M0RdaCkR8lfv8vtc8EFrVYA2I4AJZWEWgHg1C8COvzHKHC6Jp9NV0V7:XUr0RACkIwDEpV1Lgf1ubtw3Bb
                                                                                                                                                                                                                                              MD5:A7E4D0BA0FC5DF07F62CC66EC9878979
                                                                                                                                                                                                                                              SHA1:21FD131B23BDD1BBA7BBB86F3ED5C83876F45638
                                                                                                                                                                                                                                              SHA-256:E03FE68D83201543698FD7FE267DD5DFC5BFD195147E74FF2F19AC3491401263
                                                                                                                                                                                                                                              SHA-512:D9E6B10506FCF20B5B783F011908083D9DF6C5DF88E21B10D07F53A01AD6506A4B921C85335A25BAE54E27BAD7D01B6E240D58FDEEAABC7FF32014EC120C2ECF
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......arB..2....*.......+.......@.......A.......B..._...C......D.......E......F.......G... ...H...D...I...h...P...C...Q...g...R......S.......T.......U.......V...x...W......X.......Y.......]..'=...s......t...........]...........;..'....;..(....;.......;.......M..'e...O.......O...9...........}..'........C...=......m..'....t..........!o..(5...Z..+;..5u..+;..c...+O......1...!...D@...8..E@.....H4...,..HY..QI..H.......IC......J....1..J.......J.......LD......L.......PS......QR...R..R...V2..T.......U....]..X.......Zr.....[`......\....t..]x......_......._.......yg......1...6....E..8V..............C............................$..RN...[...0...,.......y.......y...................K...........9..R....E.."............z.......................%..F;...D...[..................................!....5.......0...I...0.......0...5...0..#....5.......5...p..............W}.. D..(... D..P=..+.......<U......<U......<.......H5..(...H5..P...L.......VE......VE......V....B..f...JJ..f.......f.

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_bg.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):165337
                                                                                                                                                                                                                                              Entropy (8bit):5.332219158085151
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:9ULiyUxPoT6qx+J7FJlaaMJnxjqxq+0Uiff0mbVeb7wiEwYuYqDKBkKHMXHCIMll:9ULpIVFnpwUiEujw27ncUQUz
                                                                                                                                                                                                                                              MD5:660413AD666A6B31A1ACF8F216781D6E
                                                                                                                                                                                                                                              SHA1:654409CDF3F551555957D3DBCF8D6A0D8F03A6C5
                                                                                                                                                                                                                                              SHA-256:E448AC9E3F16C29EB27AF3012EFE21052DAA78FABFB34CD6DFF2F69EE3BD3CDB
                                                                                                                                                                                                                                              SHA-512:C6AE4B784C3D302D7EC6B9CE7B27DDAF00713ADF233F1246CD0475697A59C84D6A86BAA1005283B1F89FCC0835FD131E5CF07B3534B66A0A0AA6AC6356006B8F
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......bg_BGB../....*..,....+..."...@...]...A.......B.......C.......D...P...E...!...F.......G.......H.......I.......P.......Q.......R...A...S...e...T.......U.......V.......W...1...X...U...Y...y...]..,....s...,...t...................P...;..+....;..-E...;..!....;..+....M..,Y...O...,...O...........*...}..,............=...Q...m..,....t...|......>...(5..1...+;..<...+;..o...+O...r..1...>...D@......E@......H4......HY..[...H.......IC......J....E..J....X..J.......LD......L....L..PS......QR.."...R...`...T....X..U.......X.......Zr...q..[`...`..\.......]x......_......._....T..yg.....1...=....E..?...............L(.......(...............'...$..\....[.......,...I...y...!...y...................S...........9..]%...E..5p...........z..!q...................%..O....D..................D.....8......:......?....5...&...0.......0.. ....0...c...0..5....5.......5..................b:.. D..-... D..Z...+.......<U......<U...0..<.......H5..-...H5..[...L.......VE..#a..VE..;...V.......f...T...f...!..

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_ca.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):210159
                                                                                                                                                                                                                                              Entropy (8bit):4.666388181115542
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3072:P/DVhdlafzvZfeW+6kXEVjSVPzC3ceKdP2:xYf7UW+WjwP2
                                                                                                                                                                                                                                              MD5:B383F6D4B9EEA51C065E73ECB95BBD23
                                                                                                                                                                                                                                              SHA1:DD6C2C4B4888B0D14CEBFC86F471D0FC9B07FE42
                                                                                                                                                                                                                                              SHA-256:52E94FCC9490889B55812C5433D009B44BDC2DC3170EB55B1AF444EF4AAE1D7F
                                                                                                                                                                                                                                              SHA-512:9401940A170E22CE6515E3C1453C563D93869A3C3686C859491A1F8795520B61BF3F0BFE4687A7380C0CC0C75E25559354FDB5CEF916AF4C5B6CD9661464A54A
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......caB..7....*.......+.../...@..:P...A..:t...B..:....C..:....D..;=...E..<....F..<Z...G..<~...H..<....I..<....P..>....Q..>....R..?....S..?R...T..?v...U..?....V..?....W..@....X..@<...Y..@`...]../....s..1....t..........2s......#p...;.......;../....;..W....;..e+...M../3...O.......O..9.......J....}../]......8....=..9....m../....t..9Y.......S..(5..lB..+;.._...+;...=..+O..U...1.......D@..:...E@..?...H4...J..HY..~...H..."...IC...0..J....W..J....0..J.......LD..!...L...!f..PS..)...QR.."...R.......T...9~..U...9...U...z...X...>...Zr..E...[`...e..\...LD..]x..7U.._......._...M...yg..f...1...a....E..c....7.........U.......p........b.......4.......K...$.......[.......,.......y.......y...................^...........9...:...E...s...... (...z..":.......d......!....%..tQ...D.."......."......2......ve.....y...........5..#H...0...\...0..W+...0..';...0.......5..(....5..........)s.......... D..0w.. D..}...+...1...<?..5x..<U......<U..5...<...6@..H5..0...H5..~...L...9...VE..$...V...SV..f.

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_cs.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):174701
                                                                                                                                                                                                                                              Entropy (8bit):4.87192387061682
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3072:5WjuhX0CVRaakGjW9E8SSOQfX/JlwVOMxrboRPqWxXfQvO7zjBf:5iFGj1QfXr8Gd
                                                                                                                                                                                                                                              MD5:C57D0DE9D8458A5BEB2114E47B0FDE47
                                                                                                                                                                                                                                              SHA1:3A0E777539C51BB65EE76B8E1D8DCE4386CBC886
                                                                                                                                                                                                                                              SHA-256:03028B42DF5479270371E4C3BDC7DF2F56CBBE6DDA956A2864AC6F6415861FE8
                                                                                                                                                                                                                                              SHA-512:F7970C132064407752C3D42705376FE04FACAFD2CFE1021E615182555F7BA82E7970EDF5D14359F9D5CA69D4D570AA9DDC46D48CE787CFF13D305341A3E4AF79
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......cs_CZB..3p...*..F....+.......@..!....@..Ef...A..!....A..E....B.."1...B..E....C.."U...C..E....D.."....D..F....E..#p...E..F)...F..#....F..FP...G..#....G..Fw...H..$....H..F....I..$6...I..F....P..&%...P..Gr...Q..&I...Q..G....R..&....R..G....S..&....S..H....T..&....T..H8...U..'....U..H_...V..'Z...V..H....W..'~...W..H....X..'....X..H....Y..'....Y..H....]..,....]..,....s.......t...9...............*...;.......;..+....;..1B...;......;..?x...;..N....;..iY...;..s3...M..,B...M..,....O.......O...w...O..rr...........}..,j...}..-....... 5...=.. ....m..,....m..-8...t.. .......ay..(5..TT..+;...A..+;..B...+;..u...+O......+O..=a..1...a...D@.."...E@..&m..E@..G...F...J...H4...=..HY..`...H.......I...J...IC......J....-..J.......J.......LD......L....(..PS.....QR.."S..R...e...T.... ..U......X.......Zr...g..[`......\......]x......_......._......._...v...yg......1...C....E..E...............=.......Q........................s...$..a....[.......,.......y.......y...y..............G..........

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_da.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):181387
                                                                                                                                                                                                                                              Entropy (8bit):4.755193800761075
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3072:XzswP2UvZ5aZ9jFTkmq/gnBNW/+PcWrqm2Vliz0DGdaS4KSLZjwTTgwUR0toT:j3m27AjCT
                                                                                                                                                                                                                                              MD5:859CE522A233AF31ED8D32822DA7755B
                                                                                                                                                                                                                                              SHA1:70B19B2A6914DA7D629F577F8987553713CD5D3F
                                                                                                                                                                                                                                              SHA-256:7D1E5CA3310B54D104C19BF2ABD402B38E584E87039A70E153C4A9AF74B25C22
                                                                                                                                                                                                                                              SHA-512:F9FAA5A19C2FD99CCD03151B7BE5DDA613E9C69678C028CDF678ADB176C23C7DE9EB846CF915BC3CC67ABD5D62D9CD483A5F47A57D5E6BB2F2053563D62E1EF5
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......daB..4....*..h....+......@...f...A.......B.......C.......D...U...E.......F...v...G.......H.......I.......P.......Q.......R...6...S...Z...T...~...U.......V.......W..."...X...F...Y...j...]..+....s.......t..................-...;..+....;..,....;../....;..;....M..+....O.......O...r...........}..,............=...8...m..,0...t...c......T...(5..B...+;..NH..+;..~H..+O..,...1...UP..D@......E@......H4...E..HY..j...H.......IC...#..J....J..J.......J.......LD......L....1..PS...B..QR......R...o...T.......U.......X.......Zr......[`...W..\....}..]x...[.._....-.._.......yg...e..1...O....E..R....7..........-!......]............................$..k....[...7...,.......y...c...y.................j4...........9..l8...E..p............z...;..................%..a....D...~.............-.....L......OH.....Uz...5.......0.......0...U...0.......0..p....5...7...5..L$..............p... D..-... D..i...+....@..<U.....<U.....<....S..H5..-2..H5..j$..L....B..VE.. ...VE..P...V...*...f...e...f.

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_de.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):220467
                                                                                                                                                                                                                                              Entropy (8bit):4.626295310482312
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3072:7w8go8+ph6JVB8XVXYWpSNEeg8+vaD+p4N8DDiEKugwGZulh15ce4M+4NsPYXCZW:88h8Sj286tTiDD
                                                                                                                                                                                                                                              MD5:40760A3456C9C8ABE6EA90336AF5DA01
                                                                                                                                                                                                                                              SHA1:B249AA1CBF8C2636CE57EB4932D53492E4CE36AC
                                                                                                                                                                                                                                              SHA-256:553C046835DB9ADEF15954FA9A576625366BA8BFD16637038C4BCD28E5EBACE1
                                                                                                                                                                                                                                              SHA-512:068E55F39B5250CC937E4B2BD627873132D201D351B9351BE703CD9B95D3BAFB4BD649CB4DF120A976D7C156DA679758D952CAC5E0523107244E517D323BC0C5
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......de_DEB..7....*.......+..3....@..R....A..R....B..S....C..S@...D..S....E..T]...F..T....G..T....H..T....I..U#...P..W....Q..W6...R..W....S..W....T..W....U..W....V..XG...W..Xk...X..X....Y..X....]..2%...s..J$...t..9R......J.......B....;..1....;..3....;..q....;.......M..2O...O.......O..X@......ia...}..2y......Q....=..Q....m..2....t..Q...........(5......+;..ev..+;......+O..oh..1....4..D@..R...E@..WZ..H4..4...HY...[..H...AY..IC..>o..J...>...J.......J...>6..LD..@A..L...@...PS..I...QR..#...R....h..T...W...U...Xh..U....~..X...]...Zr..e(..[`..)...\...j...]x..O..._....K.._...lI..yg...U..1...f....E..i....7..........o.......wG......6.......6.......8....$...n...[..8....,..9....y.......y..=................3......>....9.......E..."......?_...z..#d.......0......A%...%..z....D..A.......B......KP......2.............^...5..B....0.......0..p....0..F....0...}...5..G....5..........H........... D..3}.. D...O..+...Q...<?..Ti..<U......<U..T...<...U)..H5..3...H5......L...X...VE..%j..V...l..

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_en.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                                                              Entropy (8bit):4.0
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3:j2wZC4n:CwZ
                                                                                                                                                                                                                                              MD5:BCEBCF42735C6849BDECBB77451021DD
                                                                                                                                                                                                                                              SHA1:4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
                                                                                                                                                                                                                                              SHA-256:9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
                                                                                                                                                                                                                                              SHA-512:F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`...

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_es.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):165170
                                                                                                                                                                                                                                              Entropy (8bit):4.679910767547088
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:JVwzuvb+Ta64KQd84arHX5pxiVhA8QlOD/BnFNa8NsvsfFsfcoZtIx6F:JVwSTG4KqVaLX5pEVK7OJFczstgRtIx8
                                                                                                                                                                                                                                              MD5:C7C58A6D683797BFDD3EF676A37E2A40
                                                                                                                                                                                                                                              SHA1:809E580CDBF2FFDA10C77F8BE9BAC081978C102B
                                                                                                                                                                                                                                              SHA-256:4FFDA56BA3BB5414AB0482D1DDE64A6F226E3488F6B7F3F11A150E01F53FA4C8
                                                                                                                                                                                                                                              SHA-512:C5AED1A1AA13B8E794C83739B7FDDEAFD96785655C287993469F39607C8B9B0D2D8D222ECD1C13CF8445E623B195192F64DE373A8FB6FE43743BAF50E153CDA5
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......es_ESB../....*..*,...+...y...@.......A.......B.......C.......D...v...E...=...F.......G.......H.......I.......P.......Q... ...R...k...S.......T.......U.......V...1...W...U...X...y...Y.......]..+....s.......t...................c...;..+....;..,....;...%...;..#....;..-....M..+....O.......O...............}..,............=...]...m..,/...t..........A...(5..3...+;..<...+;..o...+O..!b..1...Ap..D@......E@...D..H4...-..HY..[F..H.......IC...%..J....L..J.......J.......LD......L....O..PS......QR..!...R...`K..T.......U....&..X.......Zr.....[`...h..\......]x...|.._....Y.._....A..yg......1...=....E..?a......!.......K........G...............R...$..\Q...[.......,...z...y.......y..................+............9..\....E..2............z.. ....................%..ON...D........................:......=B.....A....5...7...0.......0......0.."....0...,...0..3....5...}...5...Y..............a... D..-!.. D..Z6..+....0..<U...h..<U......<.......H5..-M..H5..Z...L.......VE.."...VE..>...V......

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_fi.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):179941
                                                                                                                                                                                                                                              Entropy (8bit):4.720938209922096
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3072:lvdTgO2Yl97ZWnbgTLt/Tf9IlqAeiy5uWkYGM0wNCdRjSK2YUlUs:lvdkA9vh5uWkY0MK2YXs
                                                                                                                                                                                                                                              MD5:8472CF0BF6C659177AD45AA9E3A3247C
                                                                                                                                                                                                                                              SHA1:7B5313CDA126BB7863001499FB66FB1B56C255FC
                                                                                                                                                                                                                                              SHA-256:E47FE13713E184D07FA4495DDE0C589B0E8F562E91574A3558A9363443A4FA72
                                                                                                                                                                                                                                              SHA-512:DE36A1F033BD7A4D6475681EDC93CC7B0B5DCB6A7051831F2EE6F397C971B843E1C10B66C4FB2EFF2A23DC07433E80FBF7B95E62C5B93E121AB5AD88354D9CB8
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......fiB..38...*..ct...+......@.......A.......B.......C...@...D.......E...]...F.......G.......H.......I...#...P.......Q...6...R.......S.......T.......U.......V...G...W...k...X.......Y.......]..*....s...T...t.......................;..*....;..+....;..&....;..3....M..+!...O.......O...e...........}..+K...........=.......m..+w...t..........J...(5..9...+;..:y..+;..mW..+O..$...1...KY..D@......E@...Z..H4...l..HY..X&..H.......IC......J.......J...."..J......LD.....L.......PS...'..QR.. L..R...]...T.......U.......X.......Zr......[`......\.......]x......_....k.._....>..yg.. /..1...;....E..>....7..{(......%.......J........T.......&.......U...$..Y[...[......,...s...y.......y...a.......}......d...........9..Y....E..k'...........z...........V..........%..M....D...Q.......{......d.....A......E......K....5.......0.......0..&J...0.......0..k....5...*...5..I9.............._:.. D..,O.. D..W...+....9..<U...G..<U...*..<.......H5..,y..H5..W...H5......L....5..VE..!u..VE..E...V..."{..f.

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_fr.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):166167
                                                                                                                                                                                                                                              Entropy (8bit):4.685212271435657
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:CLZ1w8McowCppcPwL5pYFw+G00QsbLckCiWxvq+sjs06oFm:C91wxcowspc4L5pUw+cz39CiQ7tloFm
                                                                                                                                                                                                                                              MD5:1F41FF5D3A781908A481C07B35998729
                                                                                                                                                                                                                                              SHA1:ECF3B3156FFE14569ECDF805CF3BE12F29681261
                                                                                                                                                                                                                                              SHA-256:EDB32A933CEF376A2636634E14E2977CED6284E4AA9A4AC7E2292F9CA54C384A
                                                                                                                                                                                                                                              SHA-512:A492E8AC88095A38A13549C18C68E1F61C7054AB9362C2B04C65B93E48E4A07941C8DA6950BAE79041094623E0ED330CA975110FDE8248B4D9380B9F729AD891
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......fr_FRB../....*..-....+.......@.......A.......B.......C...?...D.......E...\...F.......G.......H.......I..."...P.......Q...5...R.......S.......T.......U.......V...F...W...j...X.......Y.......]..+....s...=...t.......................;..+....;..,....;.......;..$b...;.......M..,....O.......O...5...........}..,3...........=.......m..,]...t..........A...(5..5j..+;..<T..+;..o...+O.."+..1...B\..D@......E@...Y..H4...8..HY..[{..H.......IC......J.......J.......J.......LD...|..L.......PS...?..QR..!...R...`j..T.......U....[..X.......Zr.....[`...)..\......]x......_....7.._.......yg...i..1...=Q...E..?@......"Y......K............................$..\....[...^...,...'...y.......y...+.......o....../c.......Y...9..\....E..6(...........z..!................j...%..OC...D...+.......[......a.....;......>......B....5.......0.......0...m...0..#....0.......0..6....5.......5..................a... D..-Y.. D..Ze..+....]..<U...;..<U......<.......H5..-...H5..Z...L.......VE.."...VE..?...V......

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_gd.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):189580
                                                                                                                                                                                                                                              Entropy (8bit):4.630160941635514
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:SiaI3C87jhakhR0VGkw7ys7CskUH6y4e6IFB4xyMuhvDnJGhFaCo527arBbm07LZ:S2yGjh17yGqxTXhvQoejJd8FUjVgk
                                                                                                                                                                                                                                              MD5:EB1FB93B0BE51C2AD78FC7BA2F8B9F42
                                                                                                                                                                                                                                              SHA1:24F7FF809E2F11C579CD388FEA5A4C552FF8D4D0
                                                                                                                                                                                                                                              SHA-256:63B439DD44139AA3AED54C2EBE03FA9BC77F22C14ED8FBA8EFF2608445BB233D
                                                                                                                                                                                                                                              SHA-512:E13770AEF33B6666ED7D54E03EE20CA291D4167D673BA6C61D8E64CDD5F7FFE0A9521B95AF67BE719BF263932ECF16E2B2D0B5F3404F9BCD7879114FCC6FC474
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......gd_GBB..2....*...u...+......@.......A...B...B.......C.......D.. ....E.. ....F..!&...G..!J...H..!n...I..!....P..#m...Q..#....R..#....S..$....T..$$...U..$H...V..$....W..$....X..$....Y..%....]../....s...'...t...................F...;.......;../....;..=V...;..G....M../G...O.......O...k......$....}../o.......i...=.......m../....t..........[...(5..M...+;..@...+;..x...+O..:...1...\7..D@...f..E@..#...H4...p..HY..be..H.......IC......J.......J....R..J.......LD......L.......PS......QR..#l..R...g...T.......U.......X....\..Zr......[`......\...&...]x......_....C.._...'t..yg..?...1...BM...E..D.......;.......R'.......t.......@.......?...$..c....[......,...i...y.......y...Y.......f.......+...........9..c....E...............z.."....................%..U....D..................G.....UB.....W......\]...5.......0.......0..<....0...;...0.......5.......5..ij..............h... D..0... D..aC..+....K..<U.....<U...~..<.......H5..0...H5..a...L....1..VE..$...VE..X...V...8|..f...Z...f...=..

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_he.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):138690
                                                                                                                                                                                                                                              Entropy (8bit):5.515748942553918
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3072:XSue8Z7T3iJsqBejt/zNHSLzdetY2ZISfC/S:XSueK3w7Ijt8zUtYAISfC/S
                                                                                                                                                                                                                                              MD5:DEAF87D45EE87794AB2DC821F250A87A
                                                                                                                                                                                                                                              SHA1:DB39C6BAA443AA9BB208043EF7FB7E3403C12D90
                                                                                                                                                                                                                                              SHA-256:E1EBCA16AFE8994356F81CA007FBDB9DDF865842010FE908923D873B687CAD3F
                                                                                                                                                                                                                                              SHA-512:276FCE81249EFFE19E95607C39F9ACB3A4AFA3F90745DA21B737A03FEA956B079BCA958039978223FD03F75AC270EC16E46095D0C6DDA327366C948EC2D05B9C
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......he_ILB../....*......+..Sw...@......A......B.......C.......D...X...E.......F.../...G...O...H...o...I......P.......Q.......R...I...S...i...T......U......V.......W.......X.../...Y...O...]..$....s......t..X:.......4......`Y...;..$....;..%....;.......;...5...;.......M..$....O...6...O..s............}..%-...........=...m...m..%k...t..........^..(5......+;..2...+;..^...+O...N..1.......D@......E@...(..H4..T...HY..L...H..._...IC..\...J...\...J.......J...\j..LD..^...L...^o..PS..fl..QR......R...Q...T...su..U...s...X...x3..Zr..~...[`..L\..\.......]x....._......._....o..yg...(..1...3....E..5C.......z......?V......U.......U.......W....$..M....[..W....,..X....y.......y..\........a..............\@...9..NO...E...?......]s...z...G.......(......^....%..B^...D.._......._.................... ..........5..`/...0.......0...L...0......0..d(...0......5..ek...5..........fB......R... D..&O.. D..K...+...l...<U......<U..p)..<...p...H5..&w..H5..La..L...s...VE......VE......V.....

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_hu.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):160494
                                                                                                                                                                                                                                              Entropy (8bit):4.831791320613137
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3072:BmOMZadV9n51xXeQvjOiIzz7/Vs9Db3ihuJNvMfWxBNlYzYbTrIkfwb03l24cNKu:HkWa5pg0MahBHDd
                                                                                                                                                                                                                                              MD5:E9D302A698B9272BDA41D6DE1D8313FB
                                                                                                                                                                                                                                              SHA1:BBF35C04177CF290B43F7D2533BE44A15D929D02
                                                                                                                                                                                                                                              SHA-256:C61B67BB9D1E84F0AB0792B6518FE055414A68E44D0C7BC7C862773800FA8299
                                                                                                                                                                                                                                              SHA-512:12947B306874CF93ABA64BB46FAC48179C2D055E770D41AF32E50FFFB9F0C092F583AFCEA8B53FE9E238EF9370E9FFFBEB581270DFA1A7CB74EBE54D9BFF459F
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......hu_HUB../....*.......+.......@.......A...0...B...{...C.......D.......E.......F.......G...<...H...`...I.......P...s...Q.......R.......S.......T...*...U...N...V.......W.......X.......Y.......]..+y...s.......t.......................;..+Q...;..,U...;.......;.......;..&....M..+....O.......O...U..........}..+............=.......m..+....t..........9c..(5..,...+;..;...+;..m7..+O......1...9...D@...T..E@......H4...v..HY..Y...H.......IC......J.......J.......J.......LD......L.......PS...}..QR..!...R...]...T.......U....{..X.......Zr...=..[`......\....*..]x...-.._......._......yg...M..1...<....E..>...............J........T.......(.......S...$..Z....[.......,...u...y.......y...[...............#...........9..Z....E..#&...........z..!'...................%..Mv...D..._....................32.....5......9....5.......0...h...0...E...0.......0.......0..#....5...Z...5...........G......_2.. D..,... D..W...+....W..<U......<U...B..<.......H5..,...H5..X{..L....)..VE.."...VE..6l..V....*.

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_it.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):161172
                                                                                                                                                                                                                                              Entropy (8bit):4.680034416311688
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:eSfxfdO4BKJb0td5pqCOIUP/PFIM7gxGQ9sRrFM6QJ4m8ihkM:eSfxFO4BKJb0td5pnOrvCqg9mRK4IkM
                                                                                                                                                                                                                                              MD5:88D040696DE3D068F91E0BF000A9EC3E
                                                                                                                                                                                                                                              SHA1:F978B265E50D14FDDE9693EC96E99B636997B74D
                                                                                                                                                                                                                                              SHA-256:7C7DC8B45BF4E41FEC60021AB13D9C7655BE007B8123DB8D7537A119EB64A366
                                                                                                                                                                                                                                              SHA-512:F042637B61C49C91043D73B113545C383BD8D9766FD4ACC21675B4FF727652D50863E72EA811553CB26DF689F692530184A6CE8FE71F9250B5A55662AFE7D923
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......it_ITB../....*.......+.......@.......A..."...B...m...C.......D.......E.......F.......G...0...H...T...I...x...P...q...Q.......R.......S.......T...(...U...L...V.......W.......X.......Y.......]..+....s...'...t...................^...;..+[...;..,g...;.......;.......;..!B...M..+....O...D...O...........(...}..+........I...=.......m..,....t..........4...(5..'...+;..<...+;..oV..+O......1...5...D@...F..E@......H4...J..HY..Z...H.......IC...L..J....s..J....j..J.......LD......L....f..PS......QR..!...R..._...T.......U....3..X.......Zr......[`...Q..\.......]x......_......._....0..yg...C..1...=....E..?o..............Kf.......h.......8.......I...$..[....[.......,...m...y...9...y...........z.......z...........9..\=...E..$u.......:...z.. k...................%..N....D..................M............0......5/...5...2...0.......0...0...0...A...0...)...0..$....5.......5...J.......a......a... D..,... D..Y...+.......<U......<U......<....v..H5..-...H5..Z...L.......VE.."c..VE..1...V....X.

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_ja.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):129911
                                                                                                                                                                                                                                              Entropy (8bit):5.802855391832282
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:W8YYSCjKBJ26c1Z7f25pVmuLXpxfqt7FEUWNrfQje9kWI23pKXvx:xYuKBJ01Z7u5pQuLbESUWNzAAI23pKfx
                                                                                                                                                                                                                                              MD5:608B80932119D86503CDDCB1CA7F98BA
                                                                                                                                                                                                                                              SHA1:7F440399ABA23120F40F6F4FCAE966D621A1CC67
                                                                                                                                                                                                                                              SHA-256:CBA382ACC44D3680D400F2C625DE93D0C4BD72A90102769EDFD1FE91CB9B617B
                                                                                                                                                                                                                                              SHA-512:424618011A7C06748AADFC2295109D2D916289C81B01C669DA4991499B207B781604A03259C546739A3A6CF2F8F6DFA753B23406B2E2812F5407AEE343B5CBDD
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......jaB../....*...'...+..=....@.......A.......B...?...C...c...D......E......F.......G.......H..."...I...F...P.......Q...'...R...r...S......T......U.......V...8...W...\...X......Y......].."k...s...Q...t..A...............I....;.."C...;..#A...;.......;.......;.......M.."....O...B...O..[?......h....}.."........m...=.......m.."....t...........M..(5......+;......+;..WU..+O......1.......D@......E@...K..H4..>=..HY..F...H...Hr..IC..E...J...F...J.......J...E...LD..Gz..L...G...PS..O...QR......R...K!..T...Z...U...[e..X..._f..Zr..e...[`..7...\...i...]x...'.._......._...j...yg..~+..1.../....E..1?.......#......:.......?.......?n......A....$..G....[..Ap...,..B....y.......y..Ew......|...............E....9..H....E..........F....z...]..............HL...%..=R...D..H.......I!......[......J......M..........5..It...0...3...0.......0...C...0..M....0...a...5..N....5..........N.......L6.. D..#... D..E...+...U%..<U......<U..X ..<...X...H5..#...H5..FK..L...[...VE......VE......V......f.

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_ko.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):156799
                                                                                                                                                                                                                                              Entropy (8bit):5.859529082176036
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:rvTy18hhPekHs1iNXVExWbStnn8TExgkYOvYejZOvXx4Mmf0MwUL8smk/pDZyy:y18hJ61nMStnn8TOgknQRLWZmkxNyy
                                                                                                                                                                                                                                              MD5:082E361CBAC2E3A0849F87B76EF6E121
                                                                                                                                                                                                                                              SHA1:F10E882762DCD2E60041BDD6CC57598FC3DF4343
                                                                                                                                                                                                                                              SHA-256:0179ED1B136E1CB3F583351EAA2C545BA3D83A6EE3F82C32505926A1A5F5F183
                                                                                                                                                                                                                                              SHA-512:F378A42116924E30FA0B8FFF1D3C3CB185DC35B2746DCE2818BE7C2AA95C5DE103DF44AAC74DA969C36C557F1D4DE42AC7647EC41066247F8AD2697BDED667EA
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......koB..7....*.......+.......@...K...A...o...B......C.......D...8...E.......F...U...G...y...H......I.......P......Q.......R.......S...C...T...g...U.......V.......W.......X...-...Y...Q...]..$....s...>...t...................y...;..${...;..%....;...u...;...l...M..$....O.......O...8...........}..$............=...C...m..%!...t...n..........(5...a..+;..E@..+;..l|..+O......1.......D@.....E@......H4......HY..\...H....]..IC......J.......J....8..J.......LD...a..L.......PS......QR......R...`...T.......U....^..U.......X....y..Zr......[`..y...\....A..]x......_......._....o..yg......1...FJ...E..HE...7..................Q........a.......5...........$..]....[...;...,.......y.......y...V...............!.......|...9..]....E...R...........z...4.......f.......5...%..Te...D..................D......^.............*...5...S...0.......0.......0.......0.......5.......5...........n......a... D..%... D..[...+.......<?......<U...;..<U...+..<.......H5..&...H5..\...L.......VE......V....A..f.

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_lv.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):153608
                                                                                                                                                                                                                                              Entropy (8bit):4.843805801051326
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3072:y5pmbKIhooMbGe91MrjOhmGzP6LJbWz5XIxELpU6:yObeqrjPGzeJyJLy6
                                                                                                                                                                                                                                              MD5:BD8BDC7BBDB7A80C56DCB61B1108961D
                                                                                                                                                                                                                                              SHA1:9538C4D8BB9A95C0D9DC57C7708A99DD53A32D1F
                                                                                                                                                                                                                                              SHA-256:846E047573AE40C83671C3BA7F73E27EFC24B98C82701DA0DF9973E574178BB2
                                                                                                                                                                                                                                              SHA-512:F040EC410EBFEA21145F944E71ADCAE8E5F60907D1D3716A937A9A59A48F70C6B7EAAC91C2C554F59357A7BC820CDBD17C73A4DECC20B51F68EB79EDD35C5554
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......lv_LVB.......*...B...+..y....@.......A...=...B......C......D.......E.......F...#...G...G...H...k...I.......P...~...Q......R.......S.......T...5...U...Y...V......W.......X.......Y.......]..%....s.......t...8.......n.......A...;..&....;.......;...!...;...A...;../....M..%....O.......O...............}..%...........=.......m..&....t...(......(g..(5...+..+;..4...+;..d...+O......1...(...D@...a..E@......H4..z...HY..Q...H.......IC......J....6..J.......J.......LD......L....9..PS......QR......R...U...T....S..U.......X...._..Zr......[`..r...\.......]x...*.._......._....{..yg......1...5v...E..7........(......B.......|.......|W......~r...$..R....[..~....,.......y...l...y...............................9..S....E...g...........z...z...................%..F....D........................"Z.....$......)....5.......0...\...0.......0...r...0.......0.......5...a...5..........J......V... D..&... D..P...+.......<U......<U......<.......H5..'"..H5..P...L....~..VE...R..VE..%...V......

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_pl.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):162982
                                                                                                                                                                                                                                              Entropy (8bit):4.841899887077422
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:sXpestp/YIFtDT8FIWYbIJmPYuIpnmxAk6mwyJNqSm9+P:sxpTDT8FIWfJmdCmxApmbnqSm9+P
                                                                                                                                                                                                                                              MD5:F9475A909A0BAF4B6B7A1937D58293C3
                                                                                                                                                                                                                                              SHA1:76B97225A11DD1F77CAC6EF144812F91BD8734BD
                                                                                                                                                                                                                                              SHA-256:CE99032A3B0BF8ABAD758895CC22837088EAD99FD2D2514E2D180693081CFE57
                                                                                                                                                                                                                                              SHA-512:8A4F1B802B6B81FF25C44251FB4A880E93E9A5FE25E36825A24BFE0EFB34E764E7E1EE585D3A56554964B7921E7813C67F12D200D6E0C5EAF4BB76B064B5C890
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......pl_PLB..0....*.."....+.......@...F...A...j...B......C.......D...3...E.......F...P...G...t...H.......I.......P.......Q.......R.......S...>...T...b...U.......V.......W.......X...(...Y...L...]..*....s.......t...r.......o.......+...;..*....;..+....;..."...;... ...M..*....O...6...O...........a...}..+...........=.......m..+G...t...G......,...(5......+;..:...+;..k...+O......1...-[..D@.....E@......H4...U..HY..WU..H.......IC......J....6..J.......J.......LD......L....%..PS......QR.. ...R...[...T....1..U.......X......Zr......[`......\.......]x...A.._......._....}..yg......1...;W...E..=........%......H....................$..Xp...[.......,.......y...i...y...........}......$R...........9..X....E..+)...........z.. E...................%..K....D...p....................&......(......-....5.......0.......0...e...0.......0..+....5...]...5...........f......]-.. D..,%.. D..V?..+....V..<U......<U......<....-..H5..,M..H5..V...L....Z..VE..!...VE..)...V.......f...P...f....K..f......

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_ru.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):203767
                                                                                                                                                                                                                                              Entropy (8bit):5.362551648909705
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:hn4dEJ63pdhPpy6gu5fs4MHQv6sLlxnrncF423ZL9xyuXwdcX8LZuf76CW+WeXFx:aN3pdV5fZbpItXsttRY+WSq
                                                                                                                                                                                                                                              MD5:5096AD2743BF89A334FBA6A2964300D4
                                                                                                                                                                                                                                              SHA1:405F45361A537C7923C240D51B0FF1C46621C203
                                                                                                                                                                                                                                              SHA-256:3DA6605668F9178D11A838C4515478084DCFB4F9CF22F99D7A92B492DB9C224B
                                                                                                                                                                                                                                              SHA-512:7B88B501792B5831426BAA669138192ED94CC3F8323A3DF9D5287655DC4D877706908C517AB7523AE8A283BF50B47123F13B8AE40EA2F3081C3459EDC47FC8DD
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......ru_RUB..7....*...L...+...W...@..,....A..,....B..-1...C..-U...D..-....E...r...F.......G.......H../....I../8...P..1'...Q..1K...R..1....S..1....T..1....U..2....V..2\...W..2....X..2....Y..2....].......s..$c...t...'......%........r...;..-....;.......;..J....;..V....M...C...O.......O..&.......8....}...m......+3...=..+....m.......t..+.......p...(5..]@..+;..[0..+;......+O..H...1...qM..D@..-...E@..1o..H4...p..HY..xm..H....*..IC...@..J....g..J.......J.......LD......L....p..PS......QR..!...R...}...T...&...U...'...U...ki..X...+...Zr..3...[`......\...:...]x..)..._......._...;...yg..S...1...\....E..__...7.........H.......k................j.......U...$..y....[.......,.......y...k...y...............................9..y....E...O...........z..!*...................%..nW...D.................%w.....g......j~.....qw...5...H...0.......0..I....0..._...0......5.......5..................~... D../k.. D..wa..+....?..<?.."t..<U......<U.."...<...#z..H5../...H5..w...L...&...VE.."...V...F$.

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_sk.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):125763
                                                                                                                                                                                                                                              Entropy (8bit):4.80343609423322
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3072:roXDuC1u/2lUBGjJirE5tsd/aev1GIfOdvhw:OucMGjH5tbm
                                                                                                                                                                                                                                              MD5:3D60E50DCBCBD70EE699BC9B1524FCB9
                                                                                                                                                                                                                                              SHA1:0211B4911B5B74CC1A46C0FCA87D3BF5632AA44A
                                                                                                                                                                                                                                              SHA-256:D586AE2C314074CF398417FDECB40709D5478DFEB0A67C2FE60D509EE9B59ED7
                                                                                                                                                                                                                                              SHA-512:F98211867F1DBCB8A342C00E23FA5718BE6E999F7449CB8470B41BF0F527C7F78CC4D6666E28968F32E96026907156753979BFADA7E6BF4225D02A902D24906D
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......sk_SKB..$x...*.......+..>....@......A......B.......C.......D...3...E...Z...F......G......H.......I.......P.......Q...D...R.......S......T.......U.......V...1...W...X...X.......Y......]...Y...t..D-......K....;...3...;.......;.......;......;...V...M.......O.._ ......l....}.......m...........T..(5...(..+;......+;..%...+O......1......E@...k..F.......H4..?I..HY..@7..H...J...I....,..IC..HT..J...H{..J...H...LD..J"..L...Jv..PS..Q...R...D...Zr..i]..[`..7...\...nB.._...o...1...&....E..(........B......19......A.......A....$..AF...[..C....,..D....y..G.......v........g......G....9..A....E..........IH...%..4.......Kf..............................5..K....0...,...0.......0.......0..Of...0.......5..P....5..........E... D...C.. D..?'..+...Y`..<U......<U..\...<...]...H5...m..H5..?...L...^...VE......f.......f...8...g.......l...aP.......................6......d....D..f(...`..f...............?....`..h5...y..H....5..j........E...e.......e..@....... ......>......oZ......l..

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_tr.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):194487
                                                                                                                                                                                                                                              Entropy (8bit):4.877239354585035
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3072:yRRhAFCvqDBitD/iDG9AOH+l4TcwZBPqHo9fd9CFRK+2IKAimxsjucV2p0ZqvRu7:yRRHs5mksWVX3lA3
                                                                                                                                                                                                                                              MD5:6CBC5D8E1EABEC96C281065ECC51E35E
                                                                                                                                                                                                                                              SHA1:4E1E6BA3772428227CB033747006B4887E5D9AD1
                                                                                                                                                                                                                                              SHA-256:6A0BF6E70E7920C2B193E76E92F78F315936955D3B06AC039D917F2E06C43281
                                                                                                                                                                                                                                              SHA-512:CE1F9EE180176153D5F523D71E0DB06F4DEA65C24E5E2CD56341CFAEE349A8E9A0F606D99F7219A35DD4516D1528C90AEA4BB87548A55392B8F2B36164D478B1
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......tr_TRB..7....*.......+...-...@.......A.......B.......C...%...D.......E...F...F.......G.......H.......I.......P.. ....Q.. ....R..!D...S..!h...T..!....U..!....V.."....W.."0...X.."T...Y.."x...]..,g...s.../...t......................;..,9...;..-I...;..9@...;..E....M..,....O.......O...G...........}..,............=...\...m..,....t.........._3..(5..LJ..+;..Wt..+;...\..+O..7...1..._...D@......E@..!...H4...@..HY..t...H....2..IC...r..J......J....D..J....K..LD...$..L....x..PS......QR..!...R...x...T.......U....q..U...Y...X...."..Zr...%..[`......\....:..]x......_......._.......yg..6...1...X....E..[....7...Z......7Q......f............................$..u....[...:...,...5...y.......y...........7...............!...9..u....E...........P...z.. ........p...........%..j....D..................A.....U......Y......_....5...V...0.......0..8....0...U...0.......5.......5..~b..............z+.. D..-... D..s...+.......<?...8..<U...s..<U...p..<.......H5..-...H5..s...L.......VE.."0..V...4..

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_uk.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):158274
                                                                                                                                                                                                                                              Entropy (8bit):5.402056706327934
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:jXwjFVUDdMUD4TzdAhpQgO5poZHvJllEnhmdK4I77/dnPJX/imfb1jhvv3BxT8ue:jBzD4Tzaw5pCvJ8hVPdlvj3p8
                                                                                                                                                                                                                                              MD5:D6234E4E21021102B021744D5FA22346
                                                                                                                                                                                                                                              SHA1:63A14327D0CF0941D6D6B58BFA7E8B10337F557B
                                                                                                                                                                                                                                              SHA-256:51B8FF55B37DC5907D637A8DDDA12FBE816852B0244C74EB4F0FB84867A786E0
                                                                                                                                                                                                                                              SHA-512:37D24A092C5F29BACB7A4CA8207C4EEFD0F073B7E74A492402867F758084091BF1D79D2BA2B4A28B35FEF42E8023C371FDE97578F74BB2033551154E77102DE6
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......uk_UAB../....*...E...+...l...@.......A.......B...G...C...k...D.......E.......F.......G.......H...*...I...N...P...=...Q...a...R.......S.......T.......U.......V...r...W.......X.......Y.......]..*y...s.......t...........;.......n...;..*Q...;..+U...;.......;...x...;..!(...M..*....O.......O...........6...}..*........E...=.......m..*....t..........3...(5..&...+;..:...+;..k0..+O...A..1...4-..D@... ..E@......H4...8..HY..W...H....2..IC...V..J....}..J.......J....%..LD...&..L....z..PS......QR.. ...R...\...T....(..U.......X.......Zr......[`..~...\.......]x......_......._....4..yg...c..1...;....E..=w.......m......I............................$..X....[...<...,.......y.......y...........M...................9..Y....E...F.......D...z.. ........P...........%..LB...D.......................-n...../......4W...5...F...0...p...0...W...0.......0...k...0.......5.......5..................^... D..+... D..V...+.......<U.../..<U......<....>..H5..+...H5..V...L....S..VE..!...VE..0...V......

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\Qt5\translations\qtbase_zh_TW.qm

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Qt Translation file
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):127849
                                                                                                                                                                                                                                              Entropy (8bit):5.83455389078597
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3072:Fv2cHP10gOs6dcFxsJopMqOWv2WIrPFP8pa:Fh6s6iFxEodjef8pa
                                                                                                                                                                                                                                              MD5:9C6A3721D01ECAF3F952CE96F46CE046
                                                                                                                                                                                                                                              SHA1:4A944E9E31DF778F7012D8E4A66497583BFD2118
                                                                                                                                                                                                                                              SHA-256:085D29EAF9BBB788B2F2503D74A1EF963A9411CEB600441254CE49A120E1AB63
                                                                                                                                                                                                                                              SHA-512:6E2807B8785F42A26C9CCBDBA0327DD40B529B10C468593F0E74113774D1CCDAA4FD9ACE9B259B9040E1475911428ECAEA49425B0F170862CF8147D23DB48E46
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:<.d....!..`.......zh_TWB..2x...*.......+..)....@.......A.......B...j...C......D.......E......F.......G...)...H...M...I...q...P...%...Q...I...R......S......T.......U.......V...Z...W...~...X......Y.......]..!....s.......t..-...............4....;..!z...;.."|...;.......;.......M..!....O.......O..Ay......N)...}..!............=.......m.." ...t...(.........(5......+;..;...+;.._...+O......1.......D@...C..E@...m..H4..*W..HY..Pm..H...3...IC..1...J...1...J.......J...1...LD..2...L...38..PS..6...QR...T..R...T...T...A...U...A...X...E...Zr..K...[`..$...\...OW..]x......_......._...P...yg..a^..1...<....E..>....7...>.......;......Fo......+.......+.......-L...$..QR...[..-....,...F...y.......y..1J...............6......1p...9..Q....E..........2....z...........<......3....%..H....D..4W......4}....................Z...... ...5..4....0...?...0...K...0..5....0...L...5..6....5..........6.......U... D.."... D..O...+...<%..<U......<U..>...<...?:..H5..#...H5..O...L...AS..VE...M..VE......V.......f...L..

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\QtCore.pyd

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):2483712
                                                                                                                                                                                                                                              Entropy (8bit):6.241719144701645
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:49152:ZYS8YHrNj4/7RsRLvYpiW3pCBU+Z7bJWvCSBYgbxGJ5M2GM/fXR1fUdihfSbCo6e:9bpj4/7RsRLvYpiW3pCBU+Z7bJWvCSBv
                                                                                                                                                                                                                                              MD5:678FA1496FFDEA3A530FA146DEDCDBCC
                                                                                                                                                                                                                                              SHA1:C80D8F1DE8AE06ECF5750C83D879D2DCC2D6A4F8
                                                                                                                                                                                                                                              SHA-256:D6E45FD8C3B3F93F52C4D1B6F9E3EE220454A73F80F65F3D70504BD55415EA37
                                                                                                                                                                                                                                              SHA-512:8D9E3FA49FB42F844D8DF241786EA9C0F55E546D373FF07E8C89AAC4F3027C62EC1BD0C9C639AFEABC034CC39E424B21DA55A1609C9F95397A66D5F0D834E88E
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}.........../....td./..../...td./...td./...td./...n../...1../......P...c./....c./....c./...Rich...........................PE..d....p.f.........." ...(.*...........+.......................................0&...........`.............................................L.....................#.$.............%.... t.......................t..(....r..@............@..(o...........................text...~(.......*.................. ..`.rdata..x....@......................@..@.data...h...........................@....pdata..$.....#......n#.............@..@.reloc.......%......L%.............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\QtGui.pyd

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):2494976
                                                                                                                                                                                                                                              Entropy (8bit):6.232020603277999
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:24576:SUjOoTFrwI8nc6EmRAQ9RzgpP2bXYUKuXeLQp5PjYq0zb:SUqCgnZXRAQ9RzggbozJLQp5Mq
                                                                                                                                                                                                                                              MD5:AE182C36F5839BADDC9DCB71192CFA7A
                                                                                                                                                                                                                                              SHA1:C9FA448981BA61343C7D7DECACAE300CAD416957
                                                                                                                                                                                                                                              SHA-256:A9408E3B15FF3030F0E9ACB3429000D253D3BB7206F750091A7130325F6D0D72
                                                                                                                                                                                                                                              SHA-512:8950244D828C5EDE5C3934CFE2EE229BE19CC00FBF0C4A7CCEBEC19E8641345EF5FD028511C5428E1E21CE5491A3F74FB0175B03DA17588DAEF918E3F66B206A
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......... j..sj..sj..sc..sn..s.p.rh..s1..rh..s.p.ri..s.p.rb..s.p.r...s...rh..s..ro..sj..s...syw.ra..syw.rk..syw.rk..sRichj..s........PE..d....p.f.........." ...(.....................................................P&...........`.........................................`&..L....&................$...............%.....................................p...@...............@{...........................text...O........................... ..`.rdata..............................@..@.data...xz.......^...t..............@....pdata........$.......#.............@..@.reloc........%......^%.............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\QtWidgets.pyd

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):5144576
                                                                                                                                                                                                                                              Entropy (8bit):6.262739223310643
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:49152:Qi+reIG7QwktsFPKoe2yicbbqgkcY9abW7KnTYK2bjMkTDGM7y:uqT7Q1kyTvoWW7EYvM9M
                                                                                                                                                                                                                                              MD5:E8C3BFBC19378E541F5F569E2023B7AA
                                                                                                                                                                                                                                              SHA1:ACA007030C1CEE45CBC692ADCB8BCB29665792BA
                                                                                                                                                                                                                                              SHA-256:A1E97A2AB434C6AE5E56491C60172E59CDCCE42960734E8BDF5D851B79361071
                                                                                                                                                                                                                                              SHA-512:9134C2EAD00C2D19DEC499E60F91E978858766744965EAD655D2349FF92834AB267AC8026038E576A7E207D3BBD4A87CD5F2E2846A703C7F481A406130530EB0
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................=....1M............1M.....1M.....1M.....+......t.............J......J......J.....Rich...........................PE..d....p.f.........." ...(..,...!.....P.,.......................................N...........`..........................................><.T...D?<...............H..z...........pM..O..Pa8..............................`8.@.............,..............................text.....,.......,................. ..`.rdata........,.......,.............@..@.data... :....A.......A.............@....pdata...z....H..|....H.............@..@.reloc...O...pM..P...0M.............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\PyQt5\sip.cp313-win_amd64.pyd

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):120320
                                                                                                                                                                                                                                              Entropy (8bit):6.034057886020456
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:pPd5NTdYgpmMrZhekwFH4PqgZNBQmT6V6WRFYE9Icx7pz4H5B:NhTdtmMdEkwuFTSvYE9Iczz4H5
                                                                                                                                                                                                                                              MD5:4F7F9E3A9466F4C0103FB04E1987E098
                                                                                                                                                                                                                                              SHA1:D4A339702E936AA5ECC1FE906AE2BA3BB0E481D7
                                                                                                                                                                                                                                              SHA-256:EBF27146466D61411493D2E243EAC691740F9C4B7A4B9AB0D408BE45B5E0AA35
                                                                                                                                                                                                                                              SHA-512:920BA8D58DCA7946341C1CC01FEA0B76CCE008F1D10061F84455A3DE9BA00FD9534F40C983486211BE92B85F786CD610C386529711A6F573A02BFAF8CA543A19
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........kSR...R...R...[...Z....X..P.......P....X..Q....X..Z....X.._....^..Q...R.......G_..[...G_..S...G_..S...G_..S...RichR...........PE..d.... g.........." ...(.H...........J.......................................0............`.............................................X...h................................ ..........................................@............`...............................text...(G.......H.................. ..`.rdata..lU...`...V...L..............@..@.data.... ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\VCRUNTIME140.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):120400
                                                                                                                                                                                                                                              Entropy (8bit):6.6017475353076716
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
                                                                                                                                                                                                                                              MD5:862F820C3251E4CA6FC0AC00E4092239
                                                                                                                                                                                                                                              SHA1:EF96D84B253041B090C243594F90938E9A487A9A
                                                                                                                                                                                                                                              SHA-256:36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
                                                                                                                                                                                                                                              SHA-512:2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\VCRUNTIME140_1.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):49744
                                                                                                                                                                                                                                              Entropy (8bit):6.701724666218339
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
                                                                                                                                                                                                                                              MD5:68156F41AE9A04D89BB6625A5CD222D4
                                                                                                                                                                                                                                              SHA1:3BE29D5C53808186EBA3A024BE377EE6F267C983
                                                                                                                                                                                                                                              SHA-256:82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
                                                                                                                                                                                                                                              SHA-512:F7BF8AD7CD8B450050310952C56F6A20B378A972C822CCC253EF3D7381B56FFB3CA6CE3323BEA9872674ED1C02017F78AB31E9EB9927FC6B3CBA957C247E5D57
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.{...{...{...0...y.......y...r.H.p...{...H.......|.......`.......~.......z.....$.z.......z...Rich{...........PE..d...l0.?.........." ...).<...8.......@...............................................b....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\_bz2.pyd

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):84240
                                                                                                                                                                                                                                              Entropy (8bit):6.607563436050078
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
                                                                                                                                                                                                                                              MD5:CB8C06C8FA9E61E4AC5F22EEBF7F1D00
                                                                                                                                                                                                                                              SHA1:D8E0DFC8127749947B09F17C8848166BAC659F0D
                                                                                                                                                                                                                                              SHA-256:FC3B481684B926350057E263622A2A5335B149A0498A8D65C4F37E39DD90B640
                                                                                                                                                                                                                                              SHA-512:E6DA642B7200BFB78F939F7D8148581259BAA9A5EDDA282C621D14BA88083A9B9BD3D17B701E9CDE77AD1133C39BD93FC9D955BB620546BB4FCF45C68F1EC7D6
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).....\......0........................................P......7[....`.............................................H...(........0....... .. ......../...@..........T...........................`...@...............x............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\_ctypes.pyd

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):131344
                                                                                                                                                                                                                                              Entropy (8bit):6.311142284249784
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
                                                                                                                                                                                                                                              MD5:A55E57D7594303C89B5F7A1D1D6F2B67
                                                                                                                                                                                                                                              SHA1:904A9304A07716497CF3E4EAAFD82715874C94F1
                                                                                                                                                                                                                                              SHA-256:F63C6C7E71C342084D8F1A108786CA6975A52CEFEF8BE32CC2589E6E2FE060C8
                                                                                                                                                                                                                                              SHA-512:FFA61AD2A408A831B5D86B201814256C172E764C9C1DBE0BD81A2E204E9E8117C66F5DFA56BB7D74275D23154C0ED8E10D4AE8A0D0564434E9761D754F1997FC
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............h....................................... .......Z....`.........................................P.................................../...........=..T............................;..@............0...............................text............................... ..`.rdata...y...0...z..................@..@.data....$....... ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\_decimal.pyd

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):277776
                                                                                                                                                                                                                                              Entropy (8bit):6.5855511991551
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
                                                                                                                                                                                                                                              MD5:F3377F3DE29579140E2BBAEEFD334D4F
                                                                                                                                                                                                                                              SHA1:B3076C564DBDFD4CA1B7CC76F36448B0088E2341
                                                                                                                                                                                                                                              SHA-256:B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
                                                                                                                                                                                                                                              SHA-512:34D9591590BBA20613691A5287EF329E5927A58127CE399088B4D68A178E3AF67159A8FC55B4FCDCB08AE094753B20DEC2AC3F0B3011481E4ED6F37445CECDD5
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....Z...............................................P......W.....`.................................................L........0..........t+......./...@..........T...............................@............... ............................text.............................. ..`.rdata..\...........................@..@.data...8'......."..................@....pdata..t+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\_hashlib.pyd

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):64272
                                                                                                                                                                                                                                              Entropy (8bit):6.220967684620152
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
                                                                                                                                                                                                                                              MD5:32D76C9ABD65A5D2671AEEDE189BC290
                                                                                                                                                                                                                                              SHA1:0D4440C9652B92B40BB92C20F3474F14E34F8D62
                                                                                                                                                                                                                                              SHA-256:838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
                                                                                                                                                                                                                                              SHA-512:49DC391F4E63F4FF7D65D6FD837332745CC114A334FD61A7B6AA6F710B235339964B855422233FAC4510CCB9A6959896EFE880AB24A56261F78B2A0FD5860CD9
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P...~.......=..............................................!.....`.........................................p...P................................/......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\_lzma.pyd

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):157968
                                                                                                                                                                                                                                              Entropy (8bit):6.854644275249963
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
                                                                                                                                                                                                                                              MD5:1BA022D42024A655CF289544AE461FB8
                                                                                                                                                                                                                                              SHA1:9772A31083223ECF66751FF3851D2E3303A0764C
                                                                                                                                                                                                                                              SHA-256:D080EABD015A3569813A220FD4EA74DFF34ED2A8519A10473EB37E22B1118A06
                                                                                                                                                                                                                                              SHA-512:2B888A2D7467E29968C6BB65AF40D4B5E80722FFDDA760AD74C912F3A2F315D402F3C099FDE82F00F41DE6C9FAAEDB23A643337EB8821E594C567506E3464C62
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...).`...........1.......................................p.......P....`.............................................L.......x....P.......0.......:.../...`..4....|..T...........................P{..@............p...............................text...^^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\_queue.pyd

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):33552
                                                                                                                                                                                                                                              Entropy (8bit):6.446391764486538
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:384:7GpPCRjqMu/AoS6rf7sif0NHQibZIJ9UoOHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:fkTM6rg9aeZIJ9Uok5YiSyvTo2Et
                                                                                                                                                                                                                                              MD5:1C03CAA59B5E4A7FB9B998D8C1DA165A
                                                                                                                                                                                                                                              SHA1:8A318F80A705C64076E22913C2206D9247D30CD7
                                                                                                                                                                                                                                              SHA-256:B9CF502DADCB124F693BF69ECD7077971E37174104DBDA563022D74961A67E1E
                                                                                                                                                                                                                                              SHA-512:783ECDA7A155DFC96A718D5A130FB901BBECBED05537434E779135CBA88233DD990D86ECA2F55A852C9BFB975074F7C44D8A3E4558D7C2060F411CE30B6A915F
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).....:.......................................................r....`.........................................PD..L....D..d....p.......`..l....T.../..........@4..T............................3..@............0...............................text............................... ..`.rdata..2....0....... ..............@..@.data........P.......>..............@....pdata..l....`.......D..............@..@.rsrc........p.......H..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\_socket.pyd

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):83728
                                                                                                                                                                                                                                              Entropy (8bit):6.331814573029388
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
                                                                                                                                                                                                                                              MD5:FE896371430BD9551717EF12A3E7E818
                                                                                                                                                                                                                                              SHA1:E2A7716E9CE840E53E8FC79D50A77F40B353C954
                                                                                                                                                                                                                                              SHA-256:35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
                                                                                                                                                                                                                                              SHA-512:67ECD9A07DF0A07EDD010F7E3732F3D829F482D67869D6BCE0C9A61C24C0FDC5FF4F4E4780B9211062A6371945121D8883BA2E9E2CF8EB07B628547312DFE4C9
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m|.ll}..o|.ll}..h|.ll}..i|.ll}..m|.ll}.lm}.ll}..m|.ll}..a|.ll}..l|.ll}..}.ll}..n|.ll}Rich.ll}........PE..d.....g.........." ...).x.......... -.......................................`.......s....`.........................................@...P............@.......0.........../...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\_ssl.pyd

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):181520
                                                                                                                                                                                                                                              Entropy (8bit):5.972827303352998
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3072:kO+IWyXHllRhN1qhep7fM6CpqjZI8u7pUULbaLZErWreVEzvT3iFCNc6tYwJc1OW:kpSrhN1E2M6CpUuwg5dEW7
                                                                                                                                                                                                                                              MD5:1C0E3E447F719FBE2601D0683EA566FC
                                                                                                                                                                                                                                              SHA1:5321AB73B36675B238AB3F798C278195223CD7B1
                                                                                                                                                                                                                                              SHA-256:63AE2FEFBFBBBC6EA39CDE0A622579D46FF55134BC8C1380289A2976B61F603E
                                                                                                                                                                                                                                              SHA-512:E1A430DA2A2F6E0A1AED7A76CC4CD2760B3164ABC20BE304C1DB3541119942508E53EA3023A52B8BADA17A6052A7A51A4453EFAD1A888ACB3B196881226C2E5C
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...)............ /..............................................R\....`.............................................d................................/..............T...........................P...@............................................text...0........................... ..`.rdata..D%.......&..................@..@.data...`...........................@....pdata...............n..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\_wmi.pyd

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):38160
                                                                                                                                                                                                                                              Entropy (8bit):6.338856805460127
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
                                                                                                                                                                                                                                              MD5:1C30CC7DF3BD168D883E93C593890B43
                                                                                                                                                                                                                                              SHA1:31465425F349DAE4EDAC9D0FEABC23CE83400807
                                                                                                                                                                                                                                              SHA-256:6435C679A3A3FF4F16708EBC43F7CA62456C110AC1EA94F617D8052C90C143C7
                                                                                                                                                                                                                                              SHA-512:267A1807298797B190888F769D998357B183526DFCB25A6F1413E64C5DCCF87F51424B7E5D6F2349D7A19381909AB23B138748D8D9F5858F7DC0552F5C5846AC
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H2.&a.&a.&a..a.&a..'`.&a..%`.&a.."`.&a..'`.&a..#`.&a..'`.&a.'a..&a.."`.&a../`.&a..&`.&a...a.&a..$`.&aRich.&a................PE..d.....g.........." ...).,...<.......)..............................................'.....`.........................................0V..H...xV.......................f.../......x...tG..T............................C..@............@.......T..@....................text....*.......,.................. ..`.rdata..d ...@..."...0..............@..@.data........p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc..x............d..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\base_library.zip

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):1394456
                                                                                                                                                                                                                                              Entropy (8bit):5.531698507573688
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
                                                                                                                                                                                                                                              MD5:A9CBD0455B46C7D14194D1F18CA8719E
                                                                                                                                                                                                                                              SHA1:E1B0C30BCCD9583949C247854F617AC8A14CBAC7
                                                                                                                                                                                                                                              SHA-256:DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
                                                                                                                                                                                                                                              SHA-512:B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\certifi\cacert.pem

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):299427
                                                                                                                                                                                                                                              Entropy (8bit):6.047872935262006
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
                                                                                                                                                                                                                                              MD5:50EA156B773E8803F6C1FE712F746CBA
                                                                                                                                                                                                                                              SHA1:2C68212E96605210EDDF740291862BDF59398AEF
                                                                                                                                                                                                                                              SHA-256:94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
                                                                                                                                                                                                                                              SHA-512:01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\charset_normalizer\md.cp313-win_amd64.pyd

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):10752
                                                                                                                                                                                                                                              Entropy (8bit):4.818583535960129
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:96:Mvs10hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFCCQAADo+cX6m:MXv9XFCk2z1/t12iwU5usJFuCyPcqgE
                                                                                                                                                                                                                                              MD5:56FE4F6C7E88212161F49E823CCC989A
                                                                                                                                                                                                                                              SHA1:16D5CBC5F289AD90AEAA4FF7CB828627AC6D4ACF
                                                                                                                                                                                                                                              SHA-256:002697227449B6D69026D149CFB220AC85D83B13056C8AA6B9DAC3FD3B76CAA4
                                                                                                                                                                                                                                              SHA-512:7C9D09CF9503F73E6F03D30E54DBB50606A86D09B37302DD72238880C000AE2B64C99027106BA340753691D67EC77B3C6E5004504269508F566BDB5E13615F1E
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d....$.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):124928
                                                                                                                                                                                                                                              Entropy (8bit):5.953784637413928
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:3072:JDE+0ov6ojgN3qN8h51Zlh+YW5E38vCsmLS:JdefPZE2ICDLS
                                                                                                                                                                                                                                              MD5:10116447F9276F10664BA85A5614BA3A
                                                                                                                                                                                                                                              SHA1:EFD761A3E6D14E897D37AFB0C7317C797F7AE1D6
                                                                                                                                                                                                                                              SHA-256:C393098E7803ABF08EE8F7381AD7B0F8FAFFBF66319C05D72823308E898F8CFC
                                                                                                                                                                                                                                              SHA-512:C04461E52B7FE92D108CBDEB879B7A8553DD552D79C88DFA3F5D0036EED8D4B8C839C0BF2563BC0C796F8280ED2828CA84747CB781D2F26B44214FCA2091EAE4
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.....................7...............7.......7.......7.......6..........D....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).@...........C.......................................0............`.........................................0...d.................................... ......................................P...@............P...............................text....?.......@.................. ..`.rdata..nY...P...Z...D..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\libcrypto-3.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):5232408
                                                                                                                                                                                                                                              Entropy (8bit):5.940072183736028
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
                                                                                                                                                                                                                                              MD5:123AD0908C76CCBA4789C084F7A6B8D0
                                                                                                                                                                                                                                              SHA1:86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
                                                                                                                                                                                                                                              SHA-256:4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
                                                                                                                                                                                                                                              SHA-512:80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\libffi-8.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):39696
                                                                                                                                                                                                                                              Entropy (8bit):6.641880464695502
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
                                                                                                                                                                                                                                              MD5:0F8E4992CA92BAAF54CC0B43AACCCE21
                                                                                                                                                                                                                                              SHA1:C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
                                                                                                                                                                                                                                              SHA-256:EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
                                                                                                                                                                                                                                              SHA-512:6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\libssl-3.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):792856
                                                                                                                                                                                                                                              Entropy (8bit):5.57949182561317
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
                                                                                                                                                                                                                                              MD5:4FF168AAA6A1D68E7957175C8513F3A2
                                                                                                                                                                                                                                              SHA1:782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
                                                                                                                                                                                                                                              SHA-256:2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
                                                                                                                                                                                                                                              SHA-512:C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..|m..|m..|m.u.m..|m+.}l..|m.u}l..|m+..l..|m+.xl..|m+.yl..|m..}l..|m..}m..|m..xl..|m..|l..|m...m..|m..~l..|mRich..|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\psutil\_psutil_windows.pyd

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):67072
                                                                                                                                                                                                                                              Entropy (8bit):5.909456553599775
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:1536:j3sHmR02IvVxv7WCyKm7c5Th4JBHTOvyyaZE:jnIvryCyKx5Th4J5OvyyO
                                                                                                                                                                                                                                              MD5:49AC12A1F10AB93FAFAB064FD0523A63
                                                                                                                                                                                                                                              SHA1:3AD6923AB0FB5D3DD9D22ED077DB15B42C2FBD4F
                                                                                                                                                                                                                                              SHA-256:BA033B79E858DBFCBA6BF8FB5AFE10DEFD1CB03957DBBC68E8E62E4DE6DF492D
                                                                                                                                                                                                                                              SHA-512:1BC0F50E0BB0A9D9DDDAD31390E5C73B0D11C2B0A8C5462065D477E93FF21F7EDC7AA2B2B36E478BE0A797A38F43E3FBEB6AAABEF0BADEC1D8D16EB73DF67255
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nT..*5..*5..*5..#M2. 5..x@..(5..x@..&5..x@.."5..x@...5...k..(5..aM..;5..*5...5...@..:5...@..+5...@^.+5...@..+5..Rich*5..................PE..d...._.g.........." .........h......\........................................@............`.........................................0...`.......@.... .......................0..(.......................................8............................................text...h........................... ..`.rdata..\I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\python3.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):70416
                                                                                                                                                                                                                                              Entropy (8bit):6.1258200129869405
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
                                                                                                                                                                                                                                              MD5:16855EBEF31C5B1EBE767F1C617645B3
                                                                                                                                                                                                                                              SHA1:315521F3A748ABFA35CD4D48E8DD09D0556D989B
                                                                                                                                                                                                                                              SHA-256:A5C6A329698490A035133433928D04368CE6285BB91A9D074FC285DE4C9A32A4
                                                                                                                                                                                                                                              SHA-512:C3957B3BD36B10C7AD6EA1FF3BC7BD65CDCEB3E6B4195A25D0649AA0DA179276CE170DA903D77B50A38FC3D5147A45BE32DBCFDBFBF76CC46301199C529ADEA4
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%?..a^e.a^e.a^e.).m.`^e.).e.`^e.)..`^e.).g.`^e.Richa^e.........PE..d......g.........." ...)............................................................z.....`.........................................`..................................../..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\python313.dll

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):6083856
                                                                                                                                                                                                                                              Entropy (8bit):6.126922729922386
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
                                                                                                                                                                                                                                              MD5:B9DE917B925DD246B709BB4233777EFD
                                                                                                                                                                                                                                              SHA1:775F258D8B530C6EA9F0DD3D1D0B61C1948C25D2
                                                                                                                                                                                                                                              SHA-256:0C0A66505093B6A4BB3475F716BD3D9552095776F6A124709C13B3F9552C7D99
                                                                                                                                                                                                                                              SHA-512:F4BF3398F50FDD3AB7E3F02C1F940B4C8B5650ED7AF16C626CCD1B934053BA73A35F96DA03B349C1EB614BB23E0BC6B5CC58B07B7553A5C93C6D23124F324A33
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).:+..T9......J........................................d.....uF]...`...........................................O.....h.P.......d......0].......\../....d..... A3.T.....................I.(....?3.@............P+..............................text....8+......:+................. ..`.rdata....%..P+...%..>+.............@..@.data...$9....P..N....P.............@....pdata.......0]...... U.............@..@PyRuntim.N...._..P....W.............@....rsrc.........d.......[.............@..@.reloc........d.......[.............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\select.pyd

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):30992
                                                                                                                                                                                                                                              Entropy (8bit):6.554484610649281
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
                                                                                                                                                                                                                                              MD5:20831703486869B470006941B4D996F2
                                                                                                                                                                                                                                              SHA1:28851DFD43706542CD3EF1B88B5E2749562DFEE0
                                                                                                                                                                                                                                              SHA-256:78E5994C29D8851F28B5B12D59D742D876683AEA58ECEEA1FB895B2036CDCDEB
                                                                                                                                                                                                                                              SHA-512:4AAF5D66D2B73F939B9A91E7EDDFEB2CE2476C625586EF227B312230414C064AA850B02A4028363AA4664408C9510594754530A6D026A0A84BE0168D677C1BC4
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).....2............................................................`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI65522\unicodedata.pyd

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):709904
                                                                                                                                                                                                                                              Entropy (8bit):5.861739047785334
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
                                                                                                                                                                                                                                              MD5:0902D299A2A487A7B0C2D75862B13640
                                                                                                                                                                                                                                              SHA1:04BCBD5A11861A03A0D323A8050A677C3A88BE13
                                                                                                                                                                                                                                              SHA-256:2693C7EE4FBA55DC548F641C0CB94485D0E18596FFEF16541BD43A5104C28B20
                                                                                                                                                                                                                                              SHA-512:8CBEF5A9F2D24DA1014F8F1CCBDDD997A084A0B04DD56BCB6AC38DDB636D05EF7E4EA7F67A085363AAD3F43D45413914E55BDEF14A662E80BE955E6DFC2FECA3
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).B...f......P,..............................................<.....`.........................................P...X................................/..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              C:\Windows\appcompat\Programs\Amcache.hve

                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                              Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                                              File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                              Size (bytes):1835008
                                                                                                                                                                                                                                              Entropy (8bit):4.421621629419227
                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                              SSDEEP:6144:WSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNc0uhiTw:1vloTMW+EZMM6DFy203w
                                                                                                                                                                                                                                              MD5:53CD1654E18908162DEA2E28907E9BDA
                                                                                                                                                                                                                                              SHA1:94BF9328FB3FA7EE9CB23F45ED1F90250E5F76AF
                                                                                                                                                                                                                                              SHA-256:94CADC01F1C3A4568DB7461FD2C7F79FFFF648E8B301C24F8290F28375AA40B0
                                                                                                                                                                                                                                              SHA-512:9B8A8656BF846A43AF9D71F20EFCFF3CAC4AF740CA65DDD11E32AF35EE8864178B5F083417F2106FE56A1A187F6444ACA256539E76AAD5014A9D170C64A649EC
                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                              Preview:regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.f...R.............................................................................................................................................................................................................................................................................................................................................."...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                              Static File Info

                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                              File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                              Entropy (8bit):7.995839128769757
                                                                                                                                                                                                                                              TrID:
                                                                                                                                                                                                                                              • Win64 Executable GUI (202006/5) 92.65%
                                                                                                                                                                                                                                              • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                                                              • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                                                              • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                              File name:WTvNL75dCr.exe
                                                                                                                                                                                                                                              File size:38'749'227 bytes
                                                                                                                                                                                                                                              MD5:41d0bfe78163967efad3c207926add4b
                                                                                                                                                                                                                                              SHA1:c9bc16bc1e3a6ec027a83b1efa0fc4c4a6234bf3
                                                                                                                                                                                                                                              SHA256:94b19d2d17eeb9168cb11f97d532ee65962f70a2c1249f3abfc8625c8c3193f8
                                                                                                                                                                                                                                              SHA512:2dc5fcbdb3f1afbc44bb0e039ee5c84be149465855d29a5a534c9b7922993f74676392ecae6a8158fc5c07711be8a44314f030df8ea01b97a90972883a7e6ccb
                                                                                                                                                                                                                                              SSDEEP:786432:I+gX4BMdhwzTQXR5FbPp6FcSS5U/LT2KzVyPVLBdebXMb8VH/zEa:uXGMK4XR3bLSCU/+6yPl3ebcBa
                                                                                                                                                                                                                                              TLSH:A7873300E5D409DEE5B22974F4F1528BD55DF0EE8B72C2EB81A002538577BC09B6EA7B
                                                                                                                                                                                                                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n=..*\.Z*\.Z*\.Za$.[-\.Za$.[.\.Za$.[ \.Z:..Z)\.Z:..[#\.Z:..[;\.Z:..[.\.Za$.[!\.Z*\.Z.\.Zb..[3\.Zb..[+\.ZRich*\.Z........PE..d..

                                                                                                                                                                                                                                              File Icon

                                                                                                                                                                                                                                              Icon Hash:4a464cd47461e179

                                                                                                                                                                                                                                              Static PE Info

                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                              Entrypoint:0x14000cdb0
                                                                                                                                                                                                                                              Entrypoint Section:.text
                                                                                                                                                                                                                                              Digitally signed:false
                                                                                                                                                                                                                                              Imagebase:0x140000000
                                                                                                                                                                                                                                              Subsystem:windows gui
                                                                                                                                                                                                                                              Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                                                              DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                              Time Stamp:0x67601DF1 [Mon Dec 16 12:32:49 2024 UTC]
                                                                                                                                                                                                                                              TLS Callbacks:
                                                                                                                                                                                                                                              CLR (.Net) Version:
                                                                                                                                                                                                                                              OS Version Major:6
                                                                                                                                                                                                                                              OS Version Minor:0
                                                                                                                                                                                                                                              File Version Major:6
                                                                                                                                                                                                                                              File Version Minor:0
                                                                                                                                                                                                                                              Subsystem Version Major:6
                                                                                                                                                                                                                                              Subsystem Version Minor:0
                                                                                                                                                                                                                                              Import Hash:72c4e339b7af8ab1ed2eb3821c98713a

                                                                                                                                                                                                                                              Entrypoint Preview

                                                                                                                                                                                                                                              Instruction
                                                                                                                                                                                                                                              dec eax
                                                                                                                                                                                                                                              sub esp, 28h
                                                                                                                                                                                                                                              call 00007F8871206BACh
                                                                                                                                                                                                                                              dec eax
                                                                                                                                                                                                                                              add esp, 28h
                                                                                                                                                                                                                                              jmp 00007F88712067CFh
                                                                                                                                                                                                                                              int3
                                                                                                                                                                                                                                              int3
                                                                                                                                                                                                                                              int3
                                                                                                                                                                                                                                              int3
                                                                                                                                                                                                                                              int3
                                                                                                                                                                                                                                              int3
                                                                                                                                                                                                                                              int3
                                                                                                                                                                                                                                              int3
                                                                                                                                                                                                                                              int3
                                                                                                                                                                                                                                              int3
                                                                                                                                                                                                                                              int3
                                                                                                                                                                                                                                              int3
                                                                                                                                                                                                                                              int3
                                                                                                                                                                                                                                              int3
                                                                                                                                                                                                                                              dec eax
                                                                                                                                                                                                                                              sub esp, 28h
                                                                                                                                                                                                                                              call 00007F8871206F78h
                                                                                                                                                                                                                                              test eax, eax
                                                                                                                                                                                                                                              je 00007F8871206973h
                                                                                                                                                                                                                                              dec eax
                                                                                                                                                                                                                                              mov eax, dword ptr [00000030h]
                                                                                                                                                                                                                                              dec eax
                                                                                                                                                                                                                                              mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                                                                              jmp 00007F8871206957h
                                                                                                                                                                                                                                              dec eax
                                                                                                                                                                                                                                              cmp ecx, eax
                                                                                                                                                                                                                                              je 00007F8871206966h
                                                                                                                                                                                                                                              xor eax, eax
                                                                                                                                                                                                                                              dec eax
                                                                                                                                                                                                                                              cmpxchg dword ptr [0003577Ch], ecx
                                                                                                                                                                                                                                              jne 00007F8871206940h
                                                                                                                                                                                                                                              xor al, al
                                                                                                                                                                                                                                              dec eax
                                                                                                                                                                                                                                              add esp, 28h
                                                                                                                                                                                                                                              ret
                                                                                                                                                                                                                                              mov al, 01h
                                                                                                                                                                                                                                              jmp 00007F8871206949h
                                                                                                                                                                                                                                              int3
                                                                                                                                                                                                                                              int3
                                                                                                                                                                                                                                              int3
                                                                                                                                                                                                                                              dec eax
                                                                                                                                                                                                                                              sub esp, 28h
                                                                                                                                                                                                                                              test ecx, ecx
                                                                                                                                                                                                                                              jne 00007F8871206959h
                                                                                                                                                                                                                                              mov byte ptr [00035765h], 00000001h
                                                                                                                                                                                                                                              call 00007F88712060A5h
                                                                                                                                                                                                                                              call 00007F8871207390h
                                                                                                                                                                                                                                              test al, al
                                                                                                                                                                                                                                              jne 00007F8871206956h
                                                                                                                                                                                                                                              xor al, al
                                                                                                                                                                                                                                              jmp 00007F8871206966h
                                                                                                                                                                                                                                              call 00007F8871213EAFh
                                                                                                                                                                                                                                              test al, al
                                                                                                                                                                                                                                              jne 00007F887120695Bh
                                                                                                                                                                                                                                              xor ecx, ecx
                                                                                                                                                                                                                                              call 00007F88712073A0h
                                                                                                                                                                                                                                              jmp 00007F887120693Ch
                                                                                                                                                                                                                                              mov al, 01h
                                                                                                                                                                                                                                              dec eax
                                                                                                                                                                                                                                              add esp, 28h
                                                                                                                                                                                                                                              ret
                                                                                                                                                                                                                                              int3
                                                                                                                                                                                                                                              int3
                                                                                                                                                                                                                                              inc eax
                                                                                                                                                                                                                                              push ebx
                                                                                                                                                                                                                                              dec eax
                                                                                                                                                                                                                                              sub esp, 20h
                                                                                                                                                                                                                                              cmp byte ptr [0003572Ch], 00000000h
                                                                                                                                                                                                                                              mov ebx, ecx
                                                                                                                                                                                                                                              jne 00007F88712069B9h
                                                                                                                                                                                                                                              cmp ecx, 01h
                                                                                                                                                                                                                                              jnbe 00007F88712069BCh
                                                                                                                                                                                                                                              call 00007F8871206EEEh
                                                                                                                                                                                                                                              test eax, eax
                                                                                                                                                                                                                                              je 00007F887120697Ah
                                                                                                                                                                                                                                              test ebx, ebx
                                                                                                                                                                                                                                              jne 00007F8871206976h
                                                                                                                                                                                                                                              dec eax
                                                                                                                                                                                                                                              lea ecx, dword ptr [00035716h]
                                                                                                                                                                                                                                              call 00007F8871213CA2h

                                                                                                                                                                                                                                              Data Directories

                                                                                                                                                                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x3ca5c0x78.rdata
                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x470000xf41c.rsrc
                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x440000x2250.pdata
                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x570000x764.reloc
                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x3a0800x1c.rdata
                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x39f400x140.rdata
                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0x2b0000x4a0.rdata
                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                              Sections

                                                                                                                                                                                                                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                              .text0x10000x29f000x2a0002a7ae207b6295492e9da088072661752False0.5514439174107143data6.487454925709845IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                              .rdata0x2b0000x12a500x12c0047617410db689a6344095ba39379f07dFalse0.5244661458333333data5.752642903186749IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                              .data0x3e0000x53f80xe00dba0caeecab624a0ccc0d577241601d1False0.134765625data1.8392217063172436IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                              .pdata0x440000x22500x2400f5559f14427a02f0a5dbd0dd026cae54False0.470703125data5.291665041994019IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                              .rsrc0x470000xf41c0xf600455788c285fcfdcb4008bc77e762818aFalse0.803099593495935data7.5549760623589695IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                              .reloc0x570000x7640x800816c68eeb419ee2c08656c31c06a0fffFalse0.5576171875data5.2809528666624175IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                              Resources

                                                                                                                                                                                                                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                              RT_ICON0x472080xea8Device independent bitmap graphic, 48 x 96 x 8, image size 00.585820895522388
                                                                                                                                                                                                                                              RT_ICON0x480b00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.7360108303249098
                                                                                                                                                                                                                                              RT_ICON0x489580x568Device independent bitmap graphic, 16 x 32 x 8, image size 00.755057803468208
                                                                                                                                                                                                                                              RT_ICON0x48ec00x952cPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9975384937676757
                                                                                                                                                                                                                                              RT_ICON0x523ec0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.3887966804979253
                                                                                                                                                                                                                                              RT_ICON0x549940x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.49530956848030017
                                                                                                                                                                                                                                              RT_ICON0x55a3c0x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.7207446808510638
                                                                                                                                                                                                                                              RT_GROUP_ICON0x55ea40x68data0.7019230769230769
                                                                                                                                                                                                                                              RT_MANIFEST0x55f0c0x50dXML 1.0 document, ASCII text0.4694508894044857

                                                                                                                                                                                                                                              Imports

                                                                                                                                                                                                                                              DLLImport
                                                                                                                                                                                                                                              USER32.dllCreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                                                                                                                                                                                                                              COMCTL32.dll
                                                                                                                                                                                                                                              KERNEL32.dllGetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
                                                                                                                                                                                                                                              ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                                                                                                                                                                                                                              GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                                                                                                                                                                                                                                              Network Behavior

                                                                                                                                                                                                                                              Network Port Distribution

                                                                                                                                                                                                                                              TCP Packets

                                                                                                                                                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                              Dec 19, 2024 12:10:18.962291002 CET49705443192.168.2.5104.20.22.46
                                                                                                                                                                                                                                              Dec 19, 2024 12:10:18.962327003 CET44349705104.20.22.46192.168.2.5
                                                                                                                                                                                                                                              Dec 19, 2024 12:10:18.962481022 CET49705443192.168.2.5104.20.22.46
                                                                                                                                                                                                                                              Dec 19, 2024 12:10:18.963459015 CET49705443192.168.2.5104.20.22.46
                                                                                                                                                                                                                                              Dec 19, 2024 12:10:18.963475943 CET44349705104.20.22.46192.168.2.5
                                                                                                                                                                                                                                              Dec 19, 2024 12:10:20.191477060 CET44349705104.20.22.46192.168.2.5
                                                                                                                                                                                                                                              Dec 19, 2024 12:10:20.192508936 CET49705443192.168.2.5104.20.22.46
                                                                                                                                                                                                                                              Dec 19, 2024 12:10:20.192524910 CET44349705104.20.22.46192.168.2.5
                                                                                                                                                                                                                                              Dec 19, 2024 12:10:20.194458961 CET44349705104.20.22.46192.168.2.5
                                                                                                                                                                                                                                              Dec 19, 2024 12:10:20.194601059 CET49705443192.168.2.5104.20.22.46
                                                                                                                                                                                                                                              Dec 19, 2024 12:10:20.196271896 CET49705443192.168.2.5104.20.22.46
                                                                                                                                                                                                                                              Dec 19, 2024 12:10:20.196455956 CET44349705104.20.22.46192.168.2.5
                                                                                                                                                                                                                                              Dec 19, 2024 12:10:20.196465969 CET49705443192.168.2.5104.20.22.46
                                                                                                                                                                                                                                              Dec 19, 2024 12:10:20.196590900 CET49705443192.168.2.5104.20.22.46

                                                                                                                                                                                                                                              UDP Packets

                                                                                                                                                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                              Dec 19, 2024 12:10:18.821146011 CET6046253192.168.2.51.1.1.1
                                                                                                                                                                                                                                              Dec 19, 2024 12:10:18.958519936 CET53604621.1.1.1192.168.2.5

                                                                                                                                                                                                                                              DNS Queries

                                                                                                                                                                                                                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                              Dec 19, 2024 12:10:18.821146011 CET192.168.2.51.1.1.10x9e94Standard query (0)nodejs.orgA (IP address)IN (0x0001)false

                                                                                                                                                                                                                                              DNS Answers

                                                                                                                                                                                                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                              Dec 19, 2024 12:10:18.958519936 CET1.1.1.1192.168.2.50x9e94No error (0)nodejs.org104.20.22.46A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                              Dec 19, 2024 12:10:18.958519936 CET1.1.1.1192.168.2.50x9e94No error (0)nodejs.org104.20.23.46A (IP address)IN (0x0001)false

                                                                                                                                                                                                                                              Statistics

                                                                                                                                                                                                                                              CPU Usage

                                                                                                                                                                                                                                              Click to jump to process

                                                                                                                                                                                                                                              Memory Usage

                                                                                                                                                                                                                                              Click to jump to process

                                                                                                                                                                                                                                              High Level Behavior Distribution

                                                                                                                                                                                                                                              Click to dive into process behavior distribution

                                                                                                                                                                                                                                              Behavior

                                                                                                                                                                                                                                              Click to jump to process

                                                                                                                                                                                                                                              System Behavior

                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                              Target ID:0
                                                                                                                                                                                                                                              Start time:06:10:06
                                                                                                                                                                                                                                              Start date:19/12/2024
                                                                                                                                                                                                                                              Path:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                                              Commandline:"C:\Users\user\Desktop\WTvNL75dCr.exe"
                                                                                                                                                                                                                                              Imagebase:0x7ff7c0370000
                                                                                                                                                                                                                                              File size:38'749'227 bytes
                                                                                                                                                                                                                                              MD5 hash:41D0BFE78163967EFAD3C207926ADD4B
                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                              Target ID:2
                                                                                                                                                                                                                                              Start time:06:10:12
                                                                                                                                                                                                                                              Start date:19/12/2024
                                                                                                                                                                                                                                              Path:C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                                              Commandline:"C:\Users\user\Desktop\WTvNL75dCr.exe"
                                                                                                                                                                                                                                              Imagebase:0x7ff7c0370000
                                                                                                                                                                                                                                              File size:38'749'227 bytes
                                                                                                                                                                                                                                              MD5 hash:41D0BFE78163967EFAD3C207926ADD4B
                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                                              • Rule: JoeSecurity_PythonBackDoor_1, Description: Yara detected Python BackDoor, Source: 00000002.00000003.2124245565.000001CDFEEB9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                              • Rule: JoeSecurity_PythonBackDoor_1, Description: Yara detected Python BackDoor, Source: 00000002.00000002.2521541963.000001CDFEE60000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                              Target ID:3
                                                                                                                                                                                                                                              Start time:06:10:16
                                                                                                                                                                                                                                              Start date:19/12/2024
                                                                                                                                                                                                                                              Path:C:\Windows\System32\systeminfo.exe
                                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                                              Commandline:systeminfo
                                                                                                                                                                                                                                              Imagebase:0x7ff6890b0000
                                                                                                                                                                                                                                              File size:110'080 bytes
                                                                                                                                                                                                                                              MD5 hash:EE309A9C61511E907D87B10EF226FDCD
                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                              Reputation:moderate
                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                              Target ID:4
                                                                                                                                                                                                                                              Start time:06:10:16
                                                                                                                                                                                                                                              Start date:19/12/2024
                                                                                                                                                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                              Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                              File size:862'208 bytes
                                                                                                                                                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                              Target ID:5
                                                                                                                                                                                                                                              Start time:06:10:16
                                                                                                                                                                                                                                              Start date:19/12/2024
                                                                                                                                                                                                                                              Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                                              Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                                                                              Imagebase:0x7ff6ef0c0000
                                                                                                                                                                                                                                              File size:496'640 bytes
                                                                                                                                                                                                                                              MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                              Target ID:6
                                                                                                                                                                                                                                              Start time:06:10:17
                                                                                                                                                                                                                                              Start date:19/12/2024
                                                                                                                                                                                                                                              Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                                              Commandline:C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"
                                                                                                                                                                                                                                              Imagebase:0x7ff67d9a0000
                                                                                                                                                                                                                                              File size:289'792 bytes
                                                                                                                                                                                                                                              MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                              Target ID:7
                                                                                                                                                                                                                                              Start time:06:10:17
                                                                                                                                                                                                                                              Start date:19/12/2024
                                                                                                                                                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                              Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                              File size:862'208 bytes
                                                                                                                                                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                              Target ID:8
                                                                                                                                                                                                                                              Start time:06:10:17
                                                                                                                                                                                                                                              Start date:19/12/2024
                                                                                                                                                                                                                                              Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                                              Commandline:wmic computersystem get manufacturer
                                                                                                                                                                                                                                              Imagebase:0x7ff6a8720000
                                                                                                                                                                                                                                              File size:576'000 bytes
                                                                                                                                                                                                                                              MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                              Target ID:11
                                                                                                                                                                                                                                              Start time:06:10:21
                                                                                                                                                                                                                                              Start date:19/12/2024
                                                                                                                                                                                                                                              Path:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                                              Commandline:C:\Windows\system32\WerFault.exe -u -p 5364 -s 968
                                                                                                                                                                                                                                              Imagebase:0x7ff7f6c50000
                                                                                                                                                                                                                                              File size:570'736 bytes
                                                                                                                                                                                                                                              MD5 hash:FD27D9F6D02763BDE32511B5DF7FF7A0
                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                              Disassembly

                                                                                                                                                                                                                                              Reset < >

                                                                                                                                                                                                                                                Execution Graph

                                                                                                                                                                                                                                                Execution Coverage:9.4%
                                                                                                                                                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                Signature Coverage:14.1%
                                                                                                                                                                                                                                                Total number of Nodes:2000
                                                                                                                                                                                                                                                Total number of Limit Nodes:52
                                                                                                                                                                                                                                                execution_graph 16014 7ff7c0389961 16026 7ff7c038a3d8 16014->16026 16031 7ff7c038b150 GetLastError 16026->16031 16032 7ff7c038b191 FlsSetValue 16031->16032 16033 7ff7c038b174 FlsGetValue 16031->16033 16035 7ff7c038b1a3 16032->16035 16036 7ff7c038b181 SetLastError 16032->16036 16034 7ff7c038b18b 16033->16034 16033->16036 16034->16032 16062 7ff7c038eb98 16035->16062 16039 7ff7c038a3e1 16036->16039 16040 7ff7c038b21d 16036->16040 16053 7ff7c038a504 16039->16053 16042 7ff7c038a504 __GetCurrentState 38 API calls 16040->16042 16047 7ff7c038b222 16042->16047 16043 7ff7c038b1d0 FlsSetValue 16045 7ff7c038b1dc FlsSetValue 16043->16045 16046 7ff7c038b1ee 16043->16046 16044 7ff7c038b1c0 FlsSetValue 16048 7ff7c038b1c9 16044->16048 16045->16048 16075 7ff7c038aef4 16046->16075 16069 7ff7c038a948 16048->16069 16123 7ff7c0393650 16053->16123 16063 7ff7c038eba9 _get_daylight 16062->16063 16064 7ff7c038ebfa 16063->16064 16065 7ff7c038ebde HeapAlloc 16063->16065 16080 7ff7c0393590 16063->16080 16083 7ff7c0384f08 16064->16083 16065->16063 16066 7ff7c038b1b2 16065->16066 16066->16043 16066->16044 16070 7ff7c038a97c 16069->16070 16071 7ff7c038a94d RtlFreeHeap 16069->16071 16070->16036 16071->16070 16072 7ff7c038a968 GetLastError 16071->16072 16073 7ff7c038a975 Concurrency::details::SchedulerProxy::DeleteThis 16072->16073 16074 7ff7c0384f08 _get_daylight 9 API calls 16073->16074 16074->16070 16109 7ff7c038adcc 16075->16109 16086 7ff7c03935d0 16080->16086 16092 7ff7c038b2c8 GetLastError 16083->16092 16085 7ff7c0384f11 16085->16066 16091 7ff7c03902d8 EnterCriticalSection 16086->16091 16093 7ff7c038b309 FlsSetValue 16092->16093 16098 7ff7c038b2ec 16092->16098 16094 7ff7c038b2f9 16093->16094 16095 7ff7c038b31b 16093->16095 16096 7ff7c038b375 SetLastError 16094->16096 16097 7ff7c038eb98 _get_daylight 5 API calls 16095->16097 16096->16085 16099 7ff7c038b32a 16097->16099 16098->16093 16098->16094 16100 7ff7c038b348 FlsSetValue 16099->16100 16101 7ff7c038b338 FlsSetValue 16099->16101 16103 7ff7c038b354 FlsSetValue 16100->16103 16104 7ff7c038b366 16100->16104 16102 7ff7c038b341 16101->16102 16105 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 5 API calls 16102->16105 16103->16102 16106 7ff7c038aef4 _get_daylight 5 API calls 16104->16106 16105->16094 16107 7ff7c038b36e 16106->16107 16108 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 5 API calls 16107->16108 16108->16096 16121 7ff7c03902d8 EnterCriticalSection 16109->16121 16157 7ff7c0393608 16123->16157 16162 7ff7c03902d8 EnterCriticalSection 16157->16162 19242 7ff7c039abe3 19244 7ff7c039abf3 19242->19244 19246 7ff7c0385478 LeaveCriticalSection 19244->19246 18999 7ff7c037bae0 19000 7ff7c037bb0e 18999->19000 19001 7ff7c037baf5 18999->19001 19001->19000 19003 7ff7c038d5fc 12 API calls 19001->19003 19002 7ff7c037bb6e 19003->19002 19069 7ff7c039ad69 19072 7ff7c0385478 LeaveCriticalSection 19069->19072 19316 7ff7c039adfe 19317 7ff7c039ae17 19316->19317 19318 7ff7c039ae0d 19316->19318 19320 7ff7c0390338 LeaveCriticalSection 19318->19320 19594 7ff7c0390290 19596 7ff7c0390298 19594->19596 19597 7ff7c03902c9 19596->19597 19598 7ff7c03902c5 19596->19598 19600 7ff7c038f074 19596->19600 19605 7ff7c0390300 19597->19605 19609 7ff7c038ed10 19600->19609 19603 7ff7c038f0c9 InitializeCriticalSectionAndSpinCount 19604 7ff7c038f0af 19603->19604 19604->19596 19606 7ff7c039032b 19605->19606 19607 7ff7c039032f 19606->19607 19608 7ff7c039030e DeleteCriticalSection 19606->19608 19607->19598 19608->19606 19610 7ff7c038ed6d 19609->19610 19611 7ff7c038ed68 __vcrt_InitializeCriticalSectionEx 19609->19611 19610->19603 19610->19604 19611->19610 19612 7ff7c038ed9d LoadLibraryExW 19611->19612 19613 7ff7c038ee92 GetProcAddress 19611->19613 19618 7ff7c038edfc LoadLibraryExW 19611->19618 19614 7ff7c038ee72 19612->19614 19615 7ff7c038edc2 GetLastError 19612->19615 19613->19610 19617 7ff7c038eea3 19613->19617 19614->19613 19616 7ff7c038ee89 FreeLibrary 19614->19616 19615->19611 19616->19613 19617->19610 19618->19611 19618->19614 18945 7ff7c038f98c 18946 7ff7c038fb7e 18945->18946 18949 7ff7c038f9ce _isindst 18945->18949 18947 7ff7c0384f08 _get_daylight 11 API calls 18946->18947 18948 7ff7c038fb6e 18947->18948 18950 7ff7c037c550 _log10_special 8 API calls 18948->18950 18949->18946 18952 7ff7c038fa4e _isindst 18949->18952 18951 7ff7c038fb99 18950->18951 18966 7ff7c0396194 18952->18966 18957 7ff7c038fbaa 18958 7ff7c038a900 _isindst 17 API calls 18957->18958 18961 7ff7c038fbbe 18958->18961 18964 7ff7c038faab 18964->18948 18990 7ff7c03961d8 18964->18990 18967 7ff7c038fa6c 18966->18967 18968 7ff7c03961a3 18966->18968 18972 7ff7c0395598 18967->18972 18997 7ff7c03902d8 EnterCriticalSection 18968->18997 18973 7ff7c03955a1 18972->18973 18977 7ff7c038fa81 18972->18977 18974 7ff7c0384f08 _get_daylight 11 API calls 18973->18974 18975 7ff7c03955a6 18974->18975 18976 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 18975->18976 18976->18977 18977->18957 18978 7ff7c03955c8 18977->18978 18979 7ff7c03955d1 18978->18979 18980 7ff7c038fa92 18978->18980 18981 7ff7c0384f08 _get_daylight 11 API calls 18979->18981 18980->18957 18984 7ff7c03955f8 18980->18984 18982 7ff7c03955d6 18981->18982 18983 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 18982->18983 18983->18980 18985 7ff7c0395601 18984->18985 18986 7ff7c038faa3 18984->18986 18987 7ff7c0384f08 _get_daylight 11 API calls 18985->18987 18986->18957 18986->18964 18988 7ff7c0395606 18987->18988 18989 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 18988->18989 18989->18986 18998 7ff7c03902d8 EnterCriticalSection 18990->18998 19330 7ff7c0385410 19331 7ff7c038541b 19330->19331 19339 7ff7c038f2a4 19331->19339 19352 7ff7c03902d8 EnterCriticalSection 19339->19352 19079 7ff7c038c520 19090 7ff7c03902d8 EnterCriticalSection 19079->19090 19856 7ff7c0397c20 19859 7ff7c03925f0 19856->19859 19860 7ff7c0392642 19859->19860 19861 7ff7c03925fd 19859->19861 19865 7ff7c038b224 19861->19865 19866 7ff7c038b250 FlsSetValue 19865->19866 19867 7ff7c038b235 FlsGetValue 19865->19867 19868 7ff7c038b242 19866->19868 19869 7ff7c038b25d 19866->19869 19867->19868 19870 7ff7c038b24a 19867->19870 19871 7ff7c038a504 __GetCurrentState 45 API calls 19868->19871 19873 7ff7c038b248 19868->19873 19872 7ff7c038eb98 _get_daylight 11 API calls 19869->19872 19870->19866 19874 7ff7c038b2c5 19871->19874 19875 7ff7c038b26c 19872->19875 19885 7ff7c03922c4 19873->19885 19876 7ff7c038b28a FlsSetValue 19875->19876 19877 7ff7c038b27a FlsSetValue 19875->19877 19879 7ff7c038b296 FlsSetValue 19876->19879 19880 7ff7c038b2a8 19876->19880 19878 7ff7c038b283 19877->19878 19881 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19878->19881 19879->19878 19882 7ff7c038aef4 _get_daylight 11 API calls 19880->19882 19881->19868 19883 7ff7c038b2b0 19882->19883 19884 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19883->19884 19884->19873 19908 7ff7c0392534 19885->19908 19887 7ff7c03922f9 19923 7ff7c0391fc4 19887->19923 19890 7ff7c0392316 19890->19860 19891 7ff7c038d5fc _fread_nolock 12 API calls 19892 7ff7c0392327 19891->19892 19893 7ff7c039232f 19892->19893 19895 7ff7c039233e 19892->19895 19894 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19893->19894 19894->19890 19895->19895 19930 7ff7c039266c 19895->19930 19898 7ff7c039243a 19899 7ff7c0384f08 _get_daylight 11 API calls 19898->19899 19901 7ff7c039243f 19899->19901 19900 7ff7c0392495 19903 7ff7c03924fc 19900->19903 19941 7ff7c0391df4 19900->19941 19904 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19901->19904 19902 7ff7c0392454 19902->19900 19905 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19902->19905 19907 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19903->19907 19904->19890 19905->19900 19907->19890 19909 7ff7c0392557 19908->19909 19910 7ff7c0392561 19909->19910 19956 7ff7c03902d8 EnterCriticalSection 19909->19956 19912 7ff7c03925d3 19910->19912 19914 7ff7c038a504 __GetCurrentState 45 API calls 19910->19914 19912->19887 19916 7ff7c03925eb 19914->19916 19918 7ff7c0392642 19916->19918 19920 7ff7c038b224 50 API calls 19916->19920 19918->19887 19921 7ff7c039262c 19920->19921 19922 7ff7c03922c4 65 API calls 19921->19922 19922->19918 19924 7ff7c0384f4c 45 API calls 19923->19924 19925 7ff7c0391fd8 19924->19925 19926 7ff7c0391fe4 GetOEMCP 19925->19926 19927 7ff7c0391ff6 19925->19927 19928 7ff7c039200b 19926->19928 19927->19928 19929 7ff7c0391ffb GetACP 19927->19929 19928->19890 19928->19891 19929->19928 19931 7ff7c0391fc4 47 API calls 19930->19931 19932 7ff7c0392699 19931->19932 19933 7ff7c03927ef 19932->19933 19934 7ff7c03926d6 IsValidCodePage 19932->19934 19940 7ff7c03926f0 memcpy_s 19932->19940 19935 7ff7c037c550 _log10_special 8 API calls 19933->19935 19934->19933 19936 7ff7c03926e7 19934->19936 19937 7ff7c0392431 19935->19937 19938 7ff7c0392716 GetCPInfo 19936->19938 19936->19940 19937->19898 19937->19902 19938->19933 19938->19940 19957 7ff7c03920dc 19940->19957 20013 7ff7c03902d8 EnterCriticalSection 19941->20013 19958 7ff7c0392119 GetCPInfo 19957->19958 19967 7ff7c039220f 19957->19967 19963 7ff7c039212c 19958->19963 19958->19967 19959 7ff7c037c550 _log10_special 8 API calls 19960 7ff7c03922ae 19959->19960 19960->19933 19961 7ff7c0392e40 48 API calls 19962 7ff7c03921a3 19961->19962 19968 7ff7c0397b84 19962->19968 19963->19961 19966 7ff7c0397b84 54 API calls 19966->19967 19967->19959 19969 7ff7c0384f4c 45 API calls 19968->19969 19970 7ff7c0397ba9 19969->19970 19973 7ff7c0397850 19970->19973 19974 7ff7c0397891 19973->19974 19975 7ff7c038f8a0 _fread_nolock MultiByteToWideChar 19974->19975 19979 7ff7c03978db 19975->19979 19976 7ff7c0397b59 19978 7ff7c037c550 _log10_special 8 API calls 19976->19978 19977 7ff7c0397a11 19977->19976 19982 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19977->19982 19980 7ff7c03921d6 19978->19980 19979->19976 19979->19977 19981 7ff7c038d5fc _fread_nolock 12 API calls 19979->19981 19983 7ff7c0397913 19979->19983 19980->19966 19981->19983 19982->19976 19983->19977 19984 7ff7c038f8a0 _fread_nolock MultiByteToWideChar 19983->19984 19985 7ff7c0397986 19984->19985 19985->19977 20004 7ff7c038f0e4 19985->20004 19988 7ff7c03979d1 19988->19977 19990 7ff7c038f0e4 __crtLCMapStringW 6 API calls 19988->19990 19989 7ff7c0397a22 19991 7ff7c038d5fc _fread_nolock 12 API calls 19989->19991 19992 7ff7c0397a40 19989->19992 20001 7ff7c0397af4 19989->20001 19990->19977 19991->19992 19992->19977 19994 7ff7c038f0e4 __crtLCMapStringW 6 API calls 19992->19994 19993 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19993->19977 19995 7ff7c0397ac0 19994->19995 19996 7ff7c0397ae0 19995->19996 19997 7ff7c0397af6 19995->19997 19995->20001 19998 7ff7c03907e8 WideCharToMultiByte 19996->19998 19999 7ff7c03907e8 WideCharToMultiByte 19997->19999 20000 7ff7c0397aee 19998->20000 19999->20000 20000->20001 20002 7ff7c0397b0e 20000->20002 20001->19977 20001->19993 20002->19977 20003 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20002->20003 20003->19977 20005 7ff7c038ed10 __crtLCMapStringW 5 API calls 20004->20005 20006 7ff7c038f122 20005->20006 20008 7ff7c038f12a 20006->20008 20010 7ff7c038f1d0 20006->20010 20008->19977 20008->19988 20008->19989 20009 7ff7c038f193 LCMapStringW 20009->20008 20011 7ff7c038ed10 __crtLCMapStringW 5 API calls 20010->20011 20012 7ff7c038f1fe __crtLCMapStringW 20011->20012 20012->20009 20106 7ff7c03916b0 20117 7ff7c03973e4 20106->20117 20118 7ff7c03973f1 20117->20118 20119 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20118->20119 20120 7ff7c039740d 20118->20120 20119->20118 20121 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20120->20121 20122 7ff7c03916b9 20120->20122 20121->20120 20123 7ff7c03902d8 EnterCriticalSection 20122->20123 18832 7ff7c0385628 18833 7ff7c0385642 18832->18833 18834 7ff7c038565f 18832->18834 18836 7ff7c0384ee8 _fread_nolock 11 API calls 18833->18836 18834->18833 18835 7ff7c0385672 CreateFileW 18834->18835 18837 7ff7c03856dc 18835->18837 18838 7ff7c03856a6 18835->18838 18839 7ff7c0385647 18836->18839 18883 7ff7c0385c04 18837->18883 18857 7ff7c038577c GetFileType 18838->18857 18842 7ff7c0384f08 _get_daylight 11 API calls 18839->18842 18845 7ff7c038564f 18842->18845 18846 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 18845->18846 18852 7ff7c038565a 18846->18852 18847 7ff7c03856bb CloseHandle 18847->18852 18848 7ff7c03856d1 CloseHandle 18848->18852 18849 7ff7c03856e5 18853 7ff7c0384e7c _fread_nolock 11 API calls 18849->18853 18850 7ff7c0385710 18904 7ff7c03859c4 18850->18904 18856 7ff7c03856ef 18853->18856 18856->18852 18858 7ff7c03857ca 18857->18858 18859 7ff7c0385887 18857->18859 18862 7ff7c03857f6 GetFileInformationByHandle 18858->18862 18867 7ff7c0385b00 21 API calls 18858->18867 18860 7ff7c03858b1 18859->18860 18861 7ff7c038588f 18859->18861 18866 7ff7c03858d4 PeekNamedPipe 18860->18866 18881 7ff7c0385872 18860->18881 18863 7ff7c0385893 18861->18863 18864 7ff7c03858a2 GetLastError 18861->18864 18862->18864 18865 7ff7c038581f 18862->18865 18868 7ff7c0384f08 _get_daylight 11 API calls 18863->18868 18870 7ff7c0384e7c _fread_nolock 11 API calls 18864->18870 18869 7ff7c03859c4 51 API calls 18865->18869 18866->18881 18871 7ff7c03857e4 18867->18871 18868->18881 18872 7ff7c038582a 18869->18872 18870->18881 18871->18862 18871->18881 18921 7ff7c0385924 18872->18921 18873 7ff7c037c550 _log10_special 8 API calls 18874 7ff7c03856b4 18873->18874 18874->18847 18874->18848 18877 7ff7c0385924 10 API calls 18878 7ff7c0385849 18877->18878 18879 7ff7c0385924 10 API calls 18878->18879 18880 7ff7c038585a 18879->18880 18880->18881 18882 7ff7c0384f08 _get_daylight 11 API calls 18880->18882 18881->18873 18882->18881 18884 7ff7c0385c3a 18883->18884 18885 7ff7c0385cd2 __std_exception_destroy 18884->18885 18886 7ff7c0384f08 _get_daylight 11 API calls 18884->18886 18887 7ff7c037c550 _log10_special 8 API calls 18885->18887 18888 7ff7c0385c4c 18886->18888 18889 7ff7c03856e1 18887->18889 18890 7ff7c0384f08 _get_daylight 11 API calls 18888->18890 18889->18849 18889->18850 18891 7ff7c0385c54 18890->18891 18892 7ff7c0387e08 45 API calls 18891->18892 18893 7ff7c0385c69 18892->18893 18894 7ff7c0385c7b 18893->18894 18895 7ff7c0385c71 18893->18895 18897 7ff7c0384f08 _get_daylight 11 API calls 18894->18897 18896 7ff7c0384f08 _get_daylight 11 API calls 18895->18896 18902 7ff7c0385c76 18896->18902 18898 7ff7c0385c80 18897->18898 18898->18885 18899 7ff7c0384f08 _get_daylight 11 API calls 18898->18899 18900 7ff7c0385c8a 18899->18900 18901 7ff7c0387e08 45 API calls 18900->18901 18901->18902 18902->18885 18903 7ff7c0385cc4 GetDriveTypeW 18902->18903 18903->18885 18906 7ff7c03859ec 18904->18906 18905 7ff7c038571d 18914 7ff7c0385b00 18905->18914 18906->18905 18928 7ff7c038f724 18906->18928 18908 7ff7c0385a80 18908->18905 18909 7ff7c038f724 51 API calls 18908->18909 18910 7ff7c0385a93 18909->18910 18910->18905 18911 7ff7c038f724 51 API calls 18910->18911 18912 7ff7c0385aa6 18911->18912 18912->18905 18913 7ff7c038f724 51 API calls 18912->18913 18913->18905 18915 7ff7c0385b1a 18914->18915 18916 7ff7c0385b51 18915->18916 18917 7ff7c0385b2a 18915->18917 18918 7ff7c038f5b8 21 API calls 18916->18918 18919 7ff7c0384e7c _fread_nolock 11 API calls 18917->18919 18920 7ff7c0385b3a 18917->18920 18918->18920 18919->18920 18920->18856 18922 7ff7c038594d FileTimeToSystemTime 18921->18922 18923 7ff7c0385940 18921->18923 18924 7ff7c0385961 SystemTimeToTzSpecificLocalTime 18922->18924 18925 7ff7c0385948 18922->18925 18923->18922 18923->18925 18924->18925 18926 7ff7c037c550 _log10_special 8 API calls 18925->18926 18927 7ff7c0385839 18926->18927 18927->18877 18929 7ff7c038f731 18928->18929 18930 7ff7c038f755 18928->18930 18929->18930 18931 7ff7c038f736 18929->18931 18932 7ff7c038f78f 18930->18932 18935 7ff7c038f7ae 18930->18935 18933 7ff7c0384f08 _get_daylight 11 API calls 18931->18933 18934 7ff7c0384f08 _get_daylight 11 API calls 18932->18934 18936 7ff7c038f73b 18933->18936 18937 7ff7c038f794 18934->18937 18938 7ff7c0384f4c 45 API calls 18935->18938 18939 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 18936->18939 18940 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 18937->18940 18944 7ff7c038f7bb 18938->18944 18941 7ff7c038f746 18939->18941 18942 7ff7c038f79f 18940->18942 18941->18908 18942->18908 18943 7ff7c03904dc 51 API calls 18943->18944 18944->18942 18944->18943 16227 7ff7c037cc3c 16248 7ff7c037ce0c 16227->16248 16230 7ff7c037cd88 16402 7ff7c037d12c IsProcessorFeaturePresent 16230->16402 16231 7ff7c037cc58 __scrt_acquire_startup_lock 16233 7ff7c037cd92 16231->16233 16239 7ff7c037cc76 __scrt_release_startup_lock 16231->16239 16234 7ff7c037d12c 7 API calls 16233->16234 16236 7ff7c037cd9d __GetCurrentState 16234->16236 16235 7ff7c037cc9b 16237 7ff7c037cd21 16254 7ff7c037d274 16237->16254 16239->16235 16239->16237 16391 7ff7c0389b2c 16239->16391 16240 7ff7c037cd26 16257 7ff7c0371000 16240->16257 16245 7ff7c037cd49 16245->16236 16398 7ff7c037cf90 16245->16398 16249 7ff7c037ce14 16248->16249 16250 7ff7c037ce20 __scrt_dllmain_crt_thread_attach 16249->16250 16251 7ff7c037ce2d 16250->16251 16252 7ff7c037cc50 16250->16252 16251->16252 16409 7ff7c037d888 16251->16409 16252->16230 16252->16231 16436 7ff7c039a4d0 16254->16436 16258 7ff7c0371009 16257->16258 16438 7ff7c0385484 16258->16438 16260 7ff7c03737fb 16445 7ff7c03736b0 16260->16445 16264 7ff7c037c550 _log10_special 8 API calls 16266 7ff7c0373ca7 16264->16266 16396 7ff7c037d2b8 GetModuleHandleW 16266->16396 16267 7ff7c037391b 16614 7ff7c03745c0 16267->16614 16268 7ff7c037383c 16605 7ff7c0371c80 16268->16605 16272 7ff7c037385b 16517 7ff7c0378830 16272->16517 16273 7ff7c037396a 16637 7ff7c0372710 16273->16637 16277 7ff7c037388e 16284 7ff7c03738bb __std_exception_destroy 16277->16284 16609 7ff7c03789a0 16277->16609 16278 7ff7c037395d 16279 7ff7c0373984 16278->16279 16280 7ff7c0373962 16278->16280 16283 7ff7c0371c80 49 API calls 16279->16283 16633 7ff7c038004c 16280->16633 16285 7ff7c03739a3 16283->16285 16286 7ff7c0378830 14 API calls 16284->16286 16294 7ff7c03738de __std_exception_destroy 16284->16294 16289 7ff7c0371950 115 API calls 16285->16289 16286->16294 16288 7ff7c0373a0b 16290 7ff7c03789a0 40 API calls 16288->16290 16291 7ff7c03739ce 16289->16291 16292 7ff7c0373a17 16290->16292 16291->16272 16293 7ff7c03739de 16291->16293 16295 7ff7c03789a0 40 API calls 16292->16295 16296 7ff7c0372710 54 API calls 16293->16296 16299 7ff7c037390e __std_exception_destroy 16294->16299 16648 7ff7c0378940 16294->16648 16297 7ff7c0373a23 16295->16297 16381 7ff7c0373808 __std_exception_destroy 16296->16381 16298 7ff7c03789a0 40 API calls 16297->16298 16298->16299 16300 7ff7c0378830 14 API calls 16299->16300 16301 7ff7c0373a3b 16300->16301 16302 7ff7c0373b2f 16301->16302 16303 7ff7c0373a60 __std_exception_destroy 16301->16303 16304 7ff7c0372710 54 API calls 16302->16304 16305 7ff7c0378940 40 API calls 16303->16305 16310 7ff7c0373aab 16303->16310 16304->16381 16305->16310 16306 7ff7c0378830 14 API calls 16307 7ff7c0373bf4 __std_exception_destroy 16306->16307 16308 7ff7c0373c46 16307->16308 16309 7ff7c0373d41 16307->16309 16311 7ff7c0373cd4 16308->16311 16312 7ff7c0373c50 16308->16312 16655 7ff7c03744e0 16309->16655 16310->16306 16315 7ff7c0378830 14 API calls 16311->16315 16530 7ff7c03790e0 16312->16530 16318 7ff7c0373ce0 16315->16318 16316 7ff7c0373d4f 16319 7ff7c0373d65 16316->16319 16320 7ff7c0373d71 16316->16320 16322 7ff7c0373c61 16318->16322 16325 7ff7c0373ced 16318->16325 16658 7ff7c0374630 16319->16658 16321 7ff7c0371c80 49 API calls 16320->16321 16332 7ff7c0373cc8 __std_exception_destroy 16321->16332 16328 7ff7c0372710 54 API calls 16322->16328 16329 7ff7c0371c80 49 API calls 16325->16329 16326 7ff7c0373dc4 16580 7ff7c0379390 16326->16580 16328->16381 16330 7ff7c0373d0b 16329->16330 16330->16332 16333 7ff7c0373d12 16330->16333 16332->16326 16334 7ff7c0373da7 SetDllDirectoryW LoadLibraryExW 16332->16334 16336 7ff7c0372710 54 API calls 16333->16336 16334->16326 16335 7ff7c0373dd7 SetDllDirectoryW 16338 7ff7c0373e0a 16335->16338 16339 7ff7c0373e5a 16335->16339 16336->16381 16341 7ff7c0378830 14 API calls 16338->16341 16340 7ff7c0374008 16339->16340 16342 7ff7c0373f1b 16339->16342 16343 7ff7c0374035 16340->16343 16344 7ff7c0374012 PostMessageW GetMessageW 16340->16344 16347 7ff7c0373e16 __std_exception_destroy 16341->16347 16585 7ff7c03733c0 16342->16585 16735 7ff7c0373360 16343->16735 16344->16343 16350 7ff7c0373ef2 16347->16350 16354 7ff7c0373e4e 16347->16354 16353 7ff7c0378940 40 API calls 16350->16353 16353->16339 16354->16339 16661 7ff7c0376dc0 16354->16661 16360 7ff7c0376fc0 FreeLibrary 16362 7ff7c037405b 16360->16362 16369 7ff7c0373e81 16371 7ff7c0373ea2 16369->16371 16382 7ff7c0373e85 16369->16382 16682 7ff7c0376e00 16369->16682 16371->16382 16701 7ff7c03771b0 16371->16701 16381->16264 16382->16339 16717 7ff7c0372a50 16382->16717 16392 7ff7c0389b43 16391->16392 16393 7ff7c0389b64 16391->16393 16392->16237 16394 7ff7c038a3d8 45 API calls 16393->16394 16395 7ff7c0389b69 16394->16395 16397 7ff7c037d2c9 16396->16397 16397->16245 16399 7ff7c037cfa1 16398->16399 16400 7ff7c037cd60 16399->16400 16401 7ff7c037d888 7 API calls 16399->16401 16400->16235 16401->16400 16403 7ff7c037d152 _isindst memcpy_s 16402->16403 16404 7ff7c037d171 RtlCaptureContext RtlLookupFunctionEntry 16403->16404 16405 7ff7c037d19a RtlVirtualUnwind 16404->16405 16406 7ff7c037d1d6 memcpy_s 16404->16406 16405->16406 16407 7ff7c037d208 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16406->16407 16408 7ff7c037d256 _isindst 16407->16408 16408->16233 16410 7ff7c037d89a 16409->16410 16411 7ff7c037d890 16409->16411 16410->16252 16415 7ff7c037dc24 16411->16415 16416 7ff7c037dc33 16415->16416 16417 7ff7c037d895 16415->16417 16423 7ff7c037de60 16416->16423 16419 7ff7c037dc90 16417->16419 16420 7ff7c037dcbb 16419->16420 16421 7ff7c037dc9e DeleteCriticalSection 16420->16421 16422 7ff7c037dcbf 16420->16422 16421->16420 16422->16410 16427 7ff7c037dcc8 16423->16427 16428 7ff7c037ddb2 TlsFree 16427->16428 16434 7ff7c037dd0c __vcrt_InitializeCriticalSectionEx 16427->16434 16429 7ff7c037dd3a LoadLibraryExW 16431 7ff7c037dd5b GetLastError 16429->16431 16432 7ff7c037ddd9 16429->16432 16430 7ff7c037ddf9 GetProcAddress 16430->16428 16431->16434 16432->16430 16433 7ff7c037ddf0 FreeLibrary 16432->16433 16433->16430 16434->16428 16434->16429 16434->16430 16435 7ff7c037dd7d LoadLibraryExW 16434->16435 16435->16432 16435->16434 16437 7ff7c037d28b GetStartupInfoW 16436->16437 16437->16240 16441 7ff7c038f480 16438->16441 16439 7ff7c038f4d3 16440 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 16439->16440 16444 7ff7c038f4fc 16440->16444 16441->16439 16442 7ff7c038f526 16441->16442 16748 7ff7c038f358 16442->16748 16444->16260 16756 7ff7c037c850 16445->16756 16448 7ff7c03736eb GetLastError 16763 7ff7c0372c50 16448->16763 16449 7ff7c0373710 16758 7ff7c0379280 FindFirstFileExW 16449->16758 16452 7ff7c0373706 16457 7ff7c037c550 _log10_special 8 API calls 16452->16457 16454 7ff7c037377d 16789 7ff7c0379440 16454->16789 16455 7ff7c0373723 16778 7ff7c0379300 CreateFileW 16455->16778 16459 7ff7c03737b5 16457->16459 16459->16381 16467 7ff7c0371950 16459->16467 16461 7ff7c037378b 16461->16452 16465 7ff7c0372810 49 API calls 16461->16465 16462 7ff7c037374c __vcrt_InitializeCriticalSectionEx 16462->16454 16463 7ff7c0373734 16781 7ff7c0372810 16463->16781 16465->16452 16468 7ff7c03745c0 108 API calls 16467->16468 16469 7ff7c0371985 16468->16469 16470 7ff7c0371c43 16469->16470 16471 7ff7c0377f90 83 API calls 16469->16471 16472 7ff7c037c550 _log10_special 8 API calls 16470->16472 16473 7ff7c03719cb 16471->16473 16474 7ff7c0371c5e 16472->16474 16516 7ff7c0371a03 16473->16516 17169 7ff7c03806d4 16473->17169 16474->16267 16474->16268 16476 7ff7c038004c 74 API calls 16476->16470 16477 7ff7c03719e5 16478 7ff7c03719e9 16477->16478 16479 7ff7c0371a08 16477->16479 16480 7ff7c0384f08 _get_daylight 11 API calls 16478->16480 17173 7ff7c038039c 16479->17173 16482 7ff7c03719ee 16480->16482 17176 7ff7c0372910 16482->17176 16485 7ff7c0371a45 16490 7ff7c0371a7b 16485->16490 16491 7ff7c0371a5c 16485->16491 16486 7ff7c0371a26 16487 7ff7c0384f08 _get_daylight 11 API calls 16486->16487 16488 7ff7c0371a2b 16487->16488 16489 7ff7c0372910 54 API calls 16488->16489 16489->16516 16493 7ff7c0371c80 49 API calls 16490->16493 16492 7ff7c0384f08 _get_daylight 11 API calls 16491->16492 16494 7ff7c0371a61 16492->16494 16495 7ff7c0371a92 16493->16495 16496 7ff7c0372910 54 API calls 16494->16496 16497 7ff7c0371c80 49 API calls 16495->16497 16496->16516 16498 7ff7c0371add 16497->16498 16499 7ff7c03806d4 73 API calls 16498->16499 16500 7ff7c0371b01 16499->16500 16501 7ff7c0371b35 16500->16501 16502 7ff7c0371b16 16500->16502 16504 7ff7c038039c _fread_nolock 53 API calls 16501->16504 16503 7ff7c0384f08 _get_daylight 11 API calls 16502->16503 16505 7ff7c0371b1b 16503->16505 16506 7ff7c0371b4a 16504->16506 16507 7ff7c0372910 54 API calls 16505->16507 16508 7ff7c0371b6f 16506->16508 16509 7ff7c0371b50 16506->16509 16507->16516 17191 7ff7c0380110 16508->17191 16511 7ff7c0384f08 _get_daylight 11 API calls 16509->16511 16513 7ff7c0371b55 16511->16513 16514 7ff7c0372910 54 API calls 16513->16514 16514->16516 16515 7ff7c0372710 54 API calls 16515->16516 16516->16476 16518 7ff7c037883a 16517->16518 16519 7ff7c0379390 2 API calls 16518->16519 16520 7ff7c0378859 GetEnvironmentVariableW 16519->16520 16521 7ff7c0378876 ExpandEnvironmentStringsW 16520->16521 16522 7ff7c03788c2 16520->16522 16521->16522 16523 7ff7c0378898 16521->16523 16524 7ff7c037c550 _log10_special 8 API calls 16522->16524 16525 7ff7c0379440 2 API calls 16523->16525 16526 7ff7c03788d4 16524->16526 16527 7ff7c03788aa 16525->16527 16526->16277 16528 7ff7c037c550 _log10_special 8 API calls 16527->16528 16529 7ff7c03788ba 16528->16529 16529->16277 16531 7ff7c03790f5 16530->16531 17409 7ff7c0378570 GetCurrentProcess OpenProcessToken 16531->17409 16534 7ff7c0378570 7 API calls 16535 7ff7c0379121 16534->16535 16536 7ff7c037913a 16535->16536 16537 7ff7c0379154 16535->16537 16538 7ff7c03726b0 48 API calls 16536->16538 16539 7ff7c03726b0 48 API calls 16537->16539 16540 7ff7c0379152 16538->16540 16541 7ff7c0379167 LocalFree LocalFree 16539->16541 16540->16541 16542 7ff7c0379183 16541->16542 16544 7ff7c037918f 16541->16544 17419 7ff7c0372b50 16542->17419 16545 7ff7c037c550 _log10_special 8 API calls 16544->16545 16546 7ff7c0373c55 16545->16546 16546->16322 16547 7ff7c0378660 16546->16547 16548 7ff7c0378678 16547->16548 16549 7ff7c037869c 16548->16549 16550 7ff7c03786fa GetTempPathW GetCurrentProcessId 16548->16550 16552 7ff7c0378830 14 API calls 16549->16552 17428 7ff7c03725c0 16550->17428 16553 7ff7c03786a8 16552->16553 17435 7ff7c03781d0 16553->17435 16558 7ff7c03786e8 __std_exception_destroy 16578 7ff7c03787d4 __std_exception_destroy 16558->16578 16560 7ff7c0378728 __std_exception_destroy 16566 7ff7c0378765 __std_exception_destroy 16560->16566 17432 7ff7c0388b68 16560->17432 16562 7ff7c03786ce __std_exception_destroy 16562->16550 16568 7ff7c03786dc 16562->16568 16565 7ff7c037c550 _log10_special 8 API calls 16567 7ff7c0373cbb 16565->16567 16571 7ff7c0379390 2 API calls 16566->16571 16566->16578 16567->16322 16567->16332 16570 7ff7c0372810 49 API calls 16568->16570 16570->16558 16572 7ff7c03787b1 16571->16572 16573 7ff7c03787e9 16572->16573 16574 7ff7c03787b6 16572->16574 16576 7ff7c0388238 38 API calls 16573->16576 16575 7ff7c0379390 2 API calls 16574->16575 16577 7ff7c03787c6 16575->16577 16576->16578 16579 7ff7c0388238 38 API calls 16577->16579 16578->16565 16579->16578 16581 7ff7c03793b2 MultiByteToWideChar 16580->16581 16582 7ff7c03793d6 16580->16582 16581->16582 16584 7ff7c03793ec __std_exception_destroy 16581->16584 16583 7ff7c03793f3 MultiByteToWideChar 16582->16583 16582->16584 16583->16584 16584->16335 16586 7ff7c03733ce memcpy_s 16585->16586 16587 7ff7c03735c7 16586->16587 16591 7ff7c0371c80 49 API calls 16586->16591 16592 7ff7c03735e2 16586->16592 16597 7ff7c03735c9 16586->16597 16598 7ff7c0372a50 54 API calls 16586->16598 16602 7ff7c03735d0 16586->16602 17724 7ff7c0374560 16586->17724 17730 7ff7c0377e20 16586->17730 17741 7ff7c0371600 16586->17741 17789 7ff7c0377120 16586->17789 17793 7ff7c0374190 16586->17793 17837 7ff7c0374450 16586->17837 16588 7ff7c037c550 _log10_special 8 API calls 16587->16588 16589 7ff7c0373664 16588->16589 16589->16381 16604 7ff7c03790c0 LocalFree 16589->16604 16591->16586 16594 7ff7c0372710 54 API calls 16592->16594 16594->16587 16599 7ff7c0372710 54 API calls 16597->16599 16598->16586 16599->16587 16603 7ff7c0372710 54 API calls 16602->16603 16603->16587 16606 7ff7c0371ca5 16605->16606 16607 7ff7c0384984 49 API calls 16606->16607 16608 7ff7c0371cc8 16607->16608 16608->16272 16610 7ff7c0379390 2 API calls 16609->16610 16611 7ff7c03789b4 16610->16611 16612 7ff7c0388238 38 API calls 16611->16612 16613 7ff7c03789c6 __std_exception_destroy 16612->16613 16613->16284 16615 7ff7c03745cc 16614->16615 16616 7ff7c0379390 2 API calls 16615->16616 16617 7ff7c03745f4 16616->16617 16618 7ff7c0379390 2 API calls 16617->16618 16619 7ff7c0374607 16618->16619 18020 7ff7c0385f94 16619->18020 16622 7ff7c037c550 _log10_special 8 API calls 16623 7ff7c037392b 16622->16623 16623->16273 16624 7ff7c0377f90 16623->16624 16625 7ff7c0377fb4 16624->16625 16626 7ff7c03806d4 73 API calls 16625->16626 16631 7ff7c037808b __std_exception_destroy 16625->16631 16627 7ff7c0377fd0 16626->16627 16627->16631 18411 7ff7c03878c8 16627->18411 16629 7ff7c03806d4 73 API calls 16632 7ff7c0377fe5 16629->16632 16630 7ff7c038039c _fread_nolock 53 API calls 16630->16632 16631->16278 16632->16629 16632->16630 16632->16631 16634 7ff7c038007c 16633->16634 18426 7ff7c037fe28 16634->18426 16636 7ff7c0380095 16636->16273 16638 7ff7c037c850 16637->16638 16639 7ff7c0372734 GetCurrentProcessId 16638->16639 16640 7ff7c0371c80 49 API calls 16639->16640 16641 7ff7c0372787 16640->16641 16642 7ff7c0384984 49 API calls 16641->16642 16643 7ff7c03727cf 16642->16643 16644 7ff7c0372620 12 API calls 16643->16644 16645 7ff7c03727f1 16644->16645 16646 7ff7c037c550 _log10_special 8 API calls 16645->16646 16647 7ff7c0372801 16646->16647 16647->16381 16649 7ff7c0379390 2 API calls 16648->16649 16650 7ff7c037895c 16649->16650 16651 7ff7c0379390 2 API calls 16650->16651 16652 7ff7c037896c 16651->16652 16653 7ff7c0388238 38 API calls 16652->16653 16654 7ff7c037897a __std_exception_destroy 16653->16654 16654->16288 16656 7ff7c0371c80 49 API calls 16655->16656 16657 7ff7c03744fd 16656->16657 16657->16316 16659 7ff7c0371c80 49 API calls 16658->16659 16660 7ff7c0374660 16659->16660 16660->16332 16662 7ff7c0376dd5 16661->16662 16663 7ff7c0384f08 _get_daylight 11 API calls 16662->16663 16666 7ff7c0373e6c 16662->16666 16664 7ff7c0376de2 16663->16664 16665 7ff7c0372910 54 API calls 16664->16665 16665->16666 16667 7ff7c0377340 16666->16667 18437 7ff7c0371470 16667->18437 16669 7ff7c0377368 16670 7ff7c0374630 49 API calls 16669->16670 16680 7ff7c03774b9 __std_exception_destroy 16669->16680 16671 7ff7c037738a 16670->16671 16672 7ff7c037738f 16671->16672 16673 7ff7c0374630 49 API calls 16671->16673 16674 7ff7c0372a50 54 API calls 16672->16674 16675 7ff7c03773ae 16673->16675 16674->16680 16675->16672 16676 7ff7c0374630 49 API calls 16675->16676 16677 7ff7c03773ca 16676->16677 16677->16672 16678 7ff7c03773d3 16677->16678 16679 7ff7c0372710 54 API calls 16678->16679 16681 7ff7c0377443 __std_exception_destroy memcpy_s 16678->16681 16679->16680 16680->16369 16681->16369 16689 7ff7c0376e1c 16682->16689 16683 7ff7c037c550 _log10_special 8 API calls 16684 7ff7c0376f51 16683->16684 16684->16371 16685 7ff7c0371840 45 API calls 16685->16689 16686 7ff7c0376faa 16688 7ff7c0372710 54 API calls 16686->16688 16687 7ff7c0371c80 49 API calls 16687->16689 16698 7ff7c0376f3f 16688->16698 16689->16685 16689->16686 16689->16687 16690 7ff7c0376f97 16689->16690 16691 7ff7c0374560 10 API calls 16689->16691 16693 7ff7c0377e20 52 API calls 16689->16693 16694 7ff7c0372a50 54 API calls 16689->16694 16695 7ff7c0376f84 16689->16695 16697 7ff7c0371600 118 API calls 16689->16697 16689->16698 16699 7ff7c0376f6d 16689->16699 16692 7ff7c0372710 54 API calls 16690->16692 16691->16689 16692->16698 16693->16689 16694->16689 16696 7ff7c0372710 54 API calls 16695->16696 16696->16698 16697->16689 16698->16683 16700 7ff7c0372710 54 API calls 16699->16700 16700->16698 18467 7ff7c0378e80 16701->18467 16703 7ff7c03771c9 16704 7ff7c0378e80 3 API calls 16703->16704 16705 7ff7c03771dc 16704->16705 16706 7ff7c037720f 16705->16706 16707 7ff7c03771f4 16705->16707 16708 7ff7c0372710 54 API calls 16706->16708 18471 7ff7c03776c0 GetProcAddress 16707->18471 16710 7ff7c0373eb7 16708->16710 16710->16382 16718 7ff7c037c850 16717->16718 16719 7ff7c0372a74 GetCurrentProcessId 16718->16719 16720 7ff7c0371c80 49 API calls 16719->16720 16721 7ff7c0372ac7 16720->16721 16722 7ff7c0384984 49 API calls 16721->16722 16723 7ff7c0372b0f 16722->16723 16724 7ff7c0372620 12 API calls 16723->16724 16725 7ff7c0372b31 16724->16725 16726 7ff7c037c550 _log10_special 8 API calls 16725->16726 16727 7ff7c0372b41 16726->16727 18543 7ff7c0376360 16735->18543 16739 7ff7c0373381 16743 7ff7c0373399 16739->16743 18611 7ff7c0376050 16739->18611 16741 7ff7c037338d 16741->16743 18620 7ff7c03761e0 16741->18620 16744 7ff7c0373670 16743->16744 16746 7ff7c037367e 16744->16746 16745 7ff7c037368f 16745->16360 16746->16745 18831 7ff7c0378e60 FreeLibrary 16746->18831 16755 7ff7c038546c EnterCriticalSection 16748->16755 16757 7ff7c03736bc GetModuleFileNameW 16756->16757 16757->16448 16757->16449 16759 7ff7c03792d2 16758->16759 16760 7ff7c03792bf FindClose 16758->16760 16761 7ff7c037c550 _log10_special 8 API calls 16759->16761 16760->16759 16762 7ff7c037371a 16761->16762 16762->16454 16762->16455 16764 7ff7c037c850 16763->16764 16765 7ff7c0372c70 GetCurrentProcessId 16764->16765 16794 7ff7c03726b0 16765->16794 16767 7ff7c0372cb9 16798 7ff7c0384bd8 16767->16798 16770 7ff7c03726b0 48 API calls 16771 7ff7c0372d34 FormatMessageW 16770->16771 16773 7ff7c0372d6d 16771->16773 16774 7ff7c0372d7f MessageBoxW 16771->16774 16775 7ff7c03726b0 48 API calls 16773->16775 16776 7ff7c037c550 _log10_special 8 API calls 16774->16776 16775->16774 16777 7ff7c0372daf 16776->16777 16777->16452 16779 7ff7c0373730 16778->16779 16780 7ff7c0379340 GetFinalPathNameByHandleW CloseHandle 16778->16780 16779->16462 16779->16463 16780->16779 16782 7ff7c0372834 16781->16782 16783 7ff7c03726b0 48 API calls 16782->16783 16784 7ff7c0372887 16783->16784 16785 7ff7c0384bd8 48 API calls 16784->16785 16786 7ff7c03728d0 MessageBoxW 16785->16786 16787 7ff7c037c550 _log10_special 8 API calls 16786->16787 16788 7ff7c0372900 16787->16788 16788->16452 16790 7ff7c037946a WideCharToMultiByte 16789->16790 16793 7ff7c0379495 16789->16793 16791 7ff7c03794ab __std_exception_destroy 16790->16791 16790->16793 16791->16461 16792 7ff7c03794b2 WideCharToMultiByte 16792->16791 16793->16791 16793->16792 16795 7ff7c03726d5 16794->16795 16796 7ff7c0384bd8 48 API calls 16795->16796 16797 7ff7c03726f8 16796->16797 16797->16767 16801 7ff7c0384c32 16798->16801 16799 7ff7c0384c57 16800 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 16799->16800 16804 7ff7c0384c81 16800->16804 16801->16799 16802 7ff7c0384c93 16801->16802 16816 7ff7c0382f90 16802->16816 16806 7ff7c037c550 _log10_special 8 API calls 16804->16806 16805 7ff7c0384d74 16807 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16805->16807 16809 7ff7c0372d04 16806->16809 16807->16804 16809->16770 16810 7ff7c0384d9a 16810->16805 16812 7ff7c0384da4 16810->16812 16811 7ff7c0384d49 16813 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16811->16813 16815 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16812->16815 16813->16804 16814 7ff7c0384d40 16814->16805 16814->16811 16815->16804 16817 7ff7c0382fce 16816->16817 16818 7ff7c0382fbe 16816->16818 16819 7ff7c0382fd7 16817->16819 16824 7ff7c0383005 16817->16824 16820 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 16818->16820 16821 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 16819->16821 16822 7ff7c0382ffd 16820->16822 16821->16822 16822->16805 16822->16810 16822->16811 16822->16814 16824->16818 16824->16822 16827 7ff7c03839a4 16824->16827 16860 7ff7c03833f0 16824->16860 16897 7ff7c0382b80 16824->16897 16828 7ff7c0383a57 16827->16828 16829 7ff7c03839e6 16827->16829 16832 7ff7c0383a5c 16828->16832 16833 7ff7c0383ab0 16828->16833 16830 7ff7c03839ec 16829->16830 16831 7ff7c0383a81 16829->16831 16834 7ff7c03839f1 16830->16834 16835 7ff7c0383a20 16830->16835 16920 7ff7c0381d54 16831->16920 16836 7ff7c0383a5e 16832->16836 16837 7ff7c0383a91 16832->16837 16839 7ff7c0383ac7 16833->16839 16841 7ff7c0383aba 16833->16841 16845 7ff7c0383abf 16833->16845 16834->16839 16842 7ff7c03839f7 16834->16842 16835->16842 16835->16845 16840 7ff7c0383a00 16836->16840 16849 7ff7c0383a6d 16836->16849 16927 7ff7c0381944 16837->16927 16934 7ff7c03846ac 16839->16934 16858 7ff7c0383af0 16840->16858 16900 7ff7c0384158 16840->16900 16841->16831 16841->16845 16842->16840 16848 7ff7c0383a32 16842->16848 16856 7ff7c0383a1b 16842->16856 16845->16858 16938 7ff7c0382164 16845->16938 16848->16858 16910 7ff7c0384494 16848->16910 16849->16831 16851 7ff7c0383a72 16849->16851 16851->16858 16916 7ff7c0384558 16851->16916 16852 7ff7c037c550 _log10_special 8 API calls 16853 7ff7c0383dea 16852->16853 16853->16824 16856->16858 16859 7ff7c0383cdc 16856->16859 16945 7ff7c03847c0 16856->16945 16858->16852 16859->16858 16951 7ff7c038ea08 16859->16951 16861 7ff7c03833fe 16860->16861 16862 7ff7c0383414 16860->16862 16863 7ff7c0383454 16861->16863 16864 7ff7c0383a57 16861->16864 16865 7ff7c03839e6 16861->16865 16862->16863 16866 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 16862->16866 16863->16824 16869 7ff7c0383a5c 16864->16869 16870 7ff7c0383ab0 16864->16870 16867 7ff7c03839ec 16865->16867 16868 7ff7c0383a81 16865->16868 16866->16863 16871 7ff7c03839f1 16867->16871 16872 7ff7c0383a20 16867->16872 16876 7ff7c0381d54 38 API calls 16868->16876 16873 7ff7c0383a5e 16869->16873 16874 7ff7c0383a91 16869->16874 16875 7ff7c0383abf 16870->16875 16877 7ff7c0383ac7 16870->16877 16878 7ff7c0383aba 16870->16878 16871->16877 16879 7ff7c03839f7 16871->16879 16872->16875 16872->16879 16884 7ff7c0383a6d 16873->16884 16886 7ff7c0383a00 16873->16886 16880 7ff7c0381944 38 API calls 16874->16880 16883 7ff7c0382164 38 API calls 16875->16883 16895 7ff7c0383af0 16875->16895 16892 7ff7c0383a1b 16876->16892 16882 7ff7c03846ac 45 API calls 16877->16882 16878->16868 16878->16875 16885 7ff7c0383a32 16879->16885 16879->16886 16879->16892 16880->16892 16881 7ff7c0384158 47 API calls 16881->16892 16882->16892 16883->16892 16884->16868 16888 7ff7c0383a72 16884->16888 16887 7ff7c0384494 46 API calls 16885->16887 16885->16895 16886->16881 16886->16895 16887->16892 16890 7ff7c0384558 37 API calls 16888->16890 16888->16895 16889 7ff7c037c550 _log10_special 8 API calls 16891 7ff7c0383dea 16889->16891 16890->16892 16891->16824 16893 7ff7c03847c0 45 API calls 16892->16893 16892->16895 16896 7ff7c0383cdc 16892->16896 16893->16896 16894 7ff7c038ea08 46 API calls 16894->16896 16895->16889 16896->16894 16896->16895 17152 7ff7c0380fc8 16897->17152 16901 7ff7c038417e 16900->16901 16963 7ff7c0380b80 16901->16963 16906 7ff7c03847c0 45 API calls 16908 7ff7c03842c3 16906->16908 16907 7ff7c03847c0 45 API calls 16909 7ff7c0384351 16907->16909 16908->16907 16908->16908 16908->16909 16909->16856 16911 7ff7c03844c9 16910->16911 16912 7ff7c038450e 16911->16912 16913 7ff7c03844e7 16911->16913 16914 7ff7c03847c0 45 API calls 16911->16914 16912->16856 16915 7ff7c038ea08 46 API calls 16913->16915 16914->16913 16915->16912 16919 7ff7c0384579 16916->16919 16917 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 16918 7ff7c03845aa 16917->16918 16918->16856 16919->16917 16919->16918 16922 7ff7c0381d87 16920->16922 16921 7ff7c0381db6 16926 7ff7c0381df3 16921->16926 17106 7ff7c0380c28 16921->17106 16922->16921 16924 7ff7c0381e73 16922->16924 16925 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 16924->16925 16925->16926 16926->16856 16928 7ff7c0381977 16927->16928 16929 7ff7c03819a6 16928->16929 16931 7ff7c0381a63 16928->16931 16930 7ff7c0380c28 12 API calls 16929->16930 16933 7ff7c03819e3 16929->16933 16930->16933 16932 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 16931->16932 16932->16933 16933->16856 16935 7ff7c03846ef 16934->16935 16937 7ff7c03846f3 __crtLCMapStringW 16935->16937 17114 7ff7c0384748 16935->17114 16937->16856 16939 7ff7c0382197 16938->16939 16940 7ff7c03821c6 16939->16940 16942 7ff7c0382283 16939->16942 16941 7ff7c0380c28 12 API calls 16940->16941 16944 7ff7c0382203 16940->16944 16941->16944 16943 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 16942->16943 16943->16944 16944->16856 16946 7ff7c03847d7 16945->16946 17118 7ff7c038d9b8 16946->17118 16952 7ff7c038ea39 16951->16952 16961 7ff7c038ea47 16951->16961 16953 7ff7c038ea67 16952->16953 16956 7ff7c03847c0 45 API calls 16952->16956 16952->16961 16954 7ff7c038ea9f 16953->16954 16955 7ff7c038ea78 16953->16955 16958 7ff7c038eac9 16954->16958 16959 7ff7c038eb2a 16954->16959 16954->16961 17142 7ff7c03900a0 16955->17142 16956->16953 16958->16961 17145 7ff7c038f8a0 16958->17145 16960 7ff7c038f8a0 _fread_nolock MultiByteToWideChar 16959->16960 16960->16961 16961->16859 16964 7ff7c0380ba6 16963->16964 16965 7ff7c0380bb7 16963->16965 16971 7ff7c038e570 16964->16971 16965->16964 16993 7ff7c038d5fc 16965->16993 16968 7ff7c0380bf8 16970 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16968->16970 16969 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16969->16968 16970->16964 16972 7ff7c038e5c0 16971->16972 16973 7ff7c038e58d 16971->16973 16972->16973 16975 7ff7c038e5f2 16972->16975 16974 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 16973->16974 16984 7ff7c03842a1 16974->16984 16977 7ff7c038e705 16975->16977 16988 7ff7c038e63a 16975->16988 16976 7ff7c038e7f7 17033 7ff7c038da5c 16976->17033 16977->16976 16979 7ff7c038e7bd 16977->16979 16981 7ff7c038e78c 16977->16981 16983 7ff7c038e74f 16977->16983 16985 7ff7c038e745 16977->16985 17026 7ff7c038ddf4 16979->17026 17019 7ff7c038e0d4 16981->17019 17009 7ff7c038e304 16983->17009 16984->16906 16984->16908 16985->16979 16987 7ff7c038e74a 16985->16987 16987->16981 16987->16983 16988->16984 17000 7ff7c038a4a4 16988->17000 16991 7ff7c038a900 _isindst 17 API calls 16992 7ff7c038e854 16991->16992 16994 7ff7c038d647 16993->16994 16998 7ff7c038d60b _get_daylight 16993->16998 16995 7ff7c0384f08 _get_daylight 11 API calls 16994->16995 16997 7ff7c0380be4 16995->16997 16996 7ff7c038d62e HeapAlloc 16996->16997 16996->16998 16997->16968 16997->16969 16998->16994 16998->16996 16999 7ff7c0393590 _get_daylight 2 API calls 16998->16999 16999->16998 17001 7ff7c038a4b1 17000->17001 17002 7ff7c038a4bb 17000->17002 17001->17002 17007 7ff7c038a4d6 17001->17007 17003 7ff7c0384f08 _get_daylight 11 API calls 17002->17003 17004 7ff7c038a4c2 17003->17004 17005 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 17004->17005 17006 7ff7c038a4ce 17005->17006 17006->16984 17006->16991 17007->17006 17008 7ff7c0384f08 _get_daylight 11 API calls 17007->17008 17008->17004 17042 7ff7c03940ac 17009->17042 17013 7ff7c038e3ac 17014 7ff7c038e3b0 17013->17014 17015 7ff7c038e401 17013->17015 17017 7ff7c038e3cc 17013->17017 17014->16984 17095 7ff7c038def0 17015->17095 17091 7ff7c038e1ac 17017->17091 17020 7ff7c03940ac 38 API calls 17019->17020 17021 7ff7c038e11e 17020->17021 17022 7ff7c0393af4 37 API calls 17021->17022 17023 7ff7c038e16e 17022->17023 17024 7ff7c038e172 17023->17024 17025 7ff7c038e1ac 45 API calls 17023->17025 17024->16984 17025->17024 17027 7ff7c03940ac 38 API calls 17026->17027 17028 7ff7c038de3f 17027->17028 17029 7ff7c0393af4 37 API calls 17028->17029 17030 7ff7c038de97 17029->17030 17031 7ff7c038de9b 17030->17031 17032 7ff7c038def0 45 API calls 17030->17032 17031->16984 17032->17031 17034 7ff7c038daa1 17033->17034 17035 7ff7c038dad4 17033->17035 17037 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 17034->17037 17036 7ff7c038daec 17035->17036 17040 7ff7c038db6d 17035->17040 17038 7ff7c038ddf4 46 API calls 17036->17038 17039 7ff7c038dacd memcpy_s 17037->17039 17038->17039 17039->16984 17040->17039 17041 7ff7c03847c0 45 API calls 17040->17041 17041->17039 17043 7ff7c03940ff fegetenv 17042->17043 17044 7ff7c0397e2c 37 API calls 17043->17044 17050 7ff7c0394152 17044->17050 17045 7ff7c039417f 17049 7ff7c038a4a4 __std_exception_copy 37 API calls 17045->17049 17046 7ff7c0394242 17047 7ff7c0397e2c 37 API calls 17046->17047 17048 7ff7c039426c 17047->17048 17053 7ff7c0397e2c 37 API calls 17048->17053 17054 7ff7c03941fd 17049->17054 17050->17046 17051 7ff7c039416d 17050->17051 17052 7ff7c039421c 17050->17052 17051->17045 17051->17046 17057 7ff7c038a4a4 __std_exception_copy 37 API calls 17052->17057 17055 7ff7c039427d 17053->17055 17056 7ff7c0395324 17054->17056 17061 7ff7c0394205 17054->17061 17058 7ff7c0398020 20 API calls 17055->17058 17059 7ff7c038a900 _isindst 17 API calls 17056->17059 17057->17054 17064 7ff7c03942e6 memcpy_s 17058->17064 17060 7ff7c0395339 17059->17060 17062 7ff7c037c550 _log10_special 8 API calls 17061->17062 17063 7ff7c038e351 17062->17063 17087 7ff7c0393af4 17063->17087 17065 7ff7c0394327 memcpy_s 17064->17065 17066 7ff7c039468f memcpy_s 17064->17066 17071 7ff7c0384f08 _get_daylight 11 API calls 17064->17071 17082 7ff7c0394783 memcpy_s 17065->17082 17083 7ff7c0394c6b memcpy_s 17065->17083 17067 7ff7c03949cf 17068 7ff7c0393c10 37 API calls 17067->17068 17073 7ff7c03950e7 17068->17073 17069 7ff7c039497b 17069->17067 17070 7ff7c039533c memcpy_s 37 API calls 17069->17070 17070->17067 17072 7ff7c0394760 17071->17072 17074 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 17072->17074 17076 7ff7c039533c memcpy_s 37 API calls 17073->17076 17080 7ff7c0395142 17073->17080 17074->17065 17075 7ff7c03952c8 17079 7ff7c0397e2c 37 API calls 17075->17079 17076->17080 17077 7ff7c0384f08 11 API calls _get_daylight 17077->17083 17078 7ff7c0384f08 11 API calls _get_daylight 17078->17082 17079->17061 17080->17075 17081 7ff7c0393c10 37 API calls 17080->17081 17085 7ff7c039533c memcpy_s 37 API calls 17080->17085 17081->17080 17082->17069 17082->17078 17084 7ff7c038a8e0 37 API calls _invalid_parameter_noinfo 17082->17084 17083->17067 17083->17069 17083->17077 17086 7ff7c038a8e0 37 API calls _invalid_parameter_noinfo 17083->17086 17084->17082 17085->17080 17086->17083 17088 7ff7c0393b13 17087->17088 17089 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 17088->17089 17090 7ff7c0393b3e memcpy_s 17088->17090 17089->17090 17090->17013 17092 7ff7c038e1d8 memcpy_s 17091->17092 17093 7ff7c03847c0 45 API calls 17092->17093 17094 7ff7c038e292 memcpy_s 17092->17094 17093->17094 17094->17014 17096 7ff7c038df2b 17095->17096 17099 7ff7c038df78 memcpy_s 17095->17099 17097 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 17096->17097 17098 7ff7c038df57 17097->17098 17098->17014 17100 7ff7c038dfe3 17099->17100 17102 7ff7c03847c0 45 API calls 17099->17102 17101 7ff7c038a4a4 __std_exception_copy 37 API calls 17100->17101 17105 7ff7c038e025 memcpy_s 17101->17105 17102->17100 17103 7ff7c038a900 _isindst 17 API calls 17104 7ff7c038e0d0 17103->17104 17105->17103 17107 7ff7c0380c5f 17106->17107 17108 7ff7c0380c4e 17106->17108 17107->17108 17109 7ff7c038d5fc _fread_nolock 12 API calls 17107->17109 17108->16926 17110 7ff7c0380c90 17109->17110 17111 7ff7c0380ca4 17110->17111 17112 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17110->17112 17113 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17111->17113 17112->17111 17113->17108 17115 7ff7c0384766 17114->17115 17117 7ff7c038476e 17114->17117 17116 7ff7c03847c0 45 API calls 17115->17116 17116->17117 17117->16937 17119 7ff7c038d9d1 17118->17119 17120 7ff7c03847ff 17118->17120 17119->17120 17126 7ff7c0393304 17119->17126 17122 7ff7c038da24 17120->17122 17123 7ff7c038480f 17122->17123 17124 7ff7c038da3d 17122->17124 17123->16859 17124->17123 17139 7ff7c0392650 17124->17139 17127 7ff7c038b150 __GetCurrentState 45 API calls 17126->17127 17128 7ff7c0393313 17127->17128 17129 7ff7c039335e 17128->17129 17138 7ff7c03902d8 EnterCriticalSection 17128->17138 17129->17120 17140 7ff7c038b150 __GetCurrentState 45 API calls 17139->17140 17141 7ff7c0392659 17140->17141 17148 7ff7c0396d88 17142->17148 17147 7ff7c038f8a9 MultiByteToWideChar 17145->17147 17151 7ff7c0396dec 17148->17151 17149 7ff7c037c550 _log10_special 8 API calls 17150 7ff7c03900bd 17149->17150 17150->16961 17151->17149 17153 7ff7c0380ffd 17152->17153 17154 7ff7c038100f 17152->17154 17155 7ff7c0384f08 _get_daylight 11 API calls 17153->17155 17156 7ff7c0381059 17154->17156 17158 7ff7c038101d 17154->17158 17157 7ff7c0381002 17155->17157 17161 7ff7c03813d5 17156->17161 17163 7ff7c0384f08 _get_daylight 11 API calls 17156->17163 17159 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 17157->17159 17160 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 17158->17160 17168 7ff7c038100d 17159->17168 17160->17168 17162 7ff7c0384f08 _get_daylight 11 API calls 17161->17162 17161->17168 17164 7ff7c0381669 17162->17164 17165 7ff7c03813ca 17163->17165 17166 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 17164->17166 17167 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 17165->17167 17166->17168 17167->17161 17168->16824 17170 7ff7c0380704 17169->17170 17197 7ff7c0380464 17170->17197 17172 7ff7c038071d 17172->16477 17209 7ff7c03803bc 17173->17209 17177 7ff7c037c850 17176->17177 17178 7ff7c0372930 GetCurrentProcessId 17177->17178 17179 7ff7c0371c80 49 API calls 17178->17179 17180 7ff7c0372979 17179->17180 17223 7ff7c0384984 17180->17223 17185 7ff7c0371c80 49 API calls 17186 7ff7c03729ff 17185->17186 17253 7ff7c0372620 17186->17253 17189 7ff7c037c550 _log10_special 8 API calls 17190 7ff7c0372a31 17189->17190 17190->16516 17192 7ff7c0371b89 17191->17192 17193 7ff7c0380119 17191->17193 17192->16515 17192->16516 17194 7ff7c0384f08 _get_daylight 11 API calls 17193->17194 17195 7ff7c038011e 17194->17195 17196 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 17195->17196 17196->17192 17198 7ff7c03804ce 17197->17198 17199 7ff7c038048e 17197->17199 17198->17199 17201 7ff7c03804da 17198->17201 17200 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 17199->17200 17203 7ff7c03804b5 17200->17203 17208 7ff7c038546c EnterCriticalSection 17201->17208 17203->17172 17210 7ff7c03803e6 17209->17210 17221 7ff7c0371a20 17209->17221 17211 7ff7c03803f5 memcpy_s 17210->17211 17212 7ff7c0380432 17210->17212 17210->17221 17214 7ff7c0384f08 _get_daylight 11 API calls 17211->17214 17222 7ff7c038546c EnterCriticalSection 17212->17222 17216 7ff7c038040a 17214->17216 17219 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 17216->17219 17219->17221 17221->16485 17221->16486 17224 7ff7c03849de 17223->17224 17225 7ff7c0384a03 17224->17225 17227 7ff7c0384a3f 17224->17227 17226 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 17225->17226 17229 7ff7c0384a2d 17226->17229 17262 7ff7c0382c10 17227->17262 17231 7ff7c037c550 _log10_special 8 API calls 17229->17231 17230 7ff7c0384b1c 17232 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17230->17232 17233 7ff7c03729c3 17231->17233 17232->17229 17241 7ff7c0385160 17233->17241 17235 7ff7c0384af1 17238 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17235->17238 17236 7ff7c0384b40 17236->17230 17237 7ff7c0384b4a 17236->17237 17240 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17237->17240 17238->17229 17239 7ff7c0384ae8 17239->17230 17239->17235 17240->17229 17242 7ff7c038b2c8 _get_daylight 11 API calls 17241->17242 17243 7ff7c0385177 17242->17243 17244 7ff7c038eb98 _get_daylight 11 API calls 17243->17244 17245 7ff7c03851b7 17243->17245 17250 7ff7c03729e5 17243->17250 17246 7ff7c03851ac 17244->17246 17245->17250 17400 7ff7c038ec20 17245->17400 17247 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17246->17247 17247->17245 17250->17185 17251 7ff7c038a900 _isindst 17 API calls 17252 7ff7c03851fc 17251->17252 17254 7ff7c037262f 17253->17254 17255 7ff7c0379390 2 API calls 17254->17255 17256 7ff7c0372660 17255->17256 17257 7ff7c0372683 MessageBoxA 17256->17257 17258 7ff7c037266f MessageBoxW 17256->17258 17259 7ff7c0372690 17257->17259 17258->17259 17260 7ff7c037c550 _log10_special 8 API calls 17259->17260 17261 7ff7c03726a0 17260->17261 17261->17189 17263 7ff7c0382c4e 17262->17263 17264 7ff7c0382c3e 17262->17264 17265 7ff7c0382c57 17263->17265 17269 7ff7c0382c85 17263->17269 17266 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 17264->17266 17267 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 17265->17267 17268 7ff7c0382c7d 17266->17268 17267->17268 17268->17230 17268->17235 17268->17236 17268->17239 17269->17264 17269->17268 17270 7ff7c03847c0 45 API calls 17269->17270 17272 7ff7c0382f34 17269->17272 17276 7ff7c03835a0 17269->17276 17302 7ff7c0383268 17269->17302 17332 7ff7c0382af0 17269->17332 17270->17269 17274 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 17272->17274 17274->17264 17277 7ff7c0383655 17276->17277 17278 7ff7c03835e2 17276->17278 17281 7ff7c038365a 17277->17281 17282 7ff7c03836af 17277->17282 17279 7ff7c03835e8 17278->17279 17280 7ff7c038367f 17278->17280 17287 7ff7c03835ed 17279->17287 17290 7ff7c03836be 17279->17290 17349 7ff7c0381b50 17280->17349 17283 7ff7c038365c 17281->17283 17284 7ff7c038368f 17281->17284 17282->17280 17282->17290 17301 7ff7c0383618 17282->17301 17286 7ff7c03835fd 17283->17286 17293 7ff7c038366b 17283->17293 17356 7ff7c0381740 17284->17356 17299 7ff7c03836ed 17286->17299 17335 7ff7c0383f04 17286->17335 17287->17286 17291 7ff7c0383630 17287->17291 17287->17301 17290->17299 17363 7ff7c0381f60 17290->17363 17291->17299 17345 7ff7c03843c0 17291->17345 17293->17280 17294 7ff7c0383670 17293->17294 17297 7ff7c0384558 37 API calls 17294->17297 17294->17299 17296 7ff7c037c550 _log10_special 8 API calls 17298 7ff7c0383983 17296->17298 17297->17301 17298->17269 17299->17296 17301->17299 17370 7ff7c038e858 17301->17370 17303 7ff7c0383289 17302->17303 17304 7ff7c0383273 17302->17304 17305 7ff7c03832c7 17303->17305 17308 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 17303->17308 17304->17305 17306 7ff7c0383655 17304->17306 17307 7ff7c03835e2 17304->17307 17305->17269 17311 7ff7c038365a 17306->17311 17312 7ff7c03836af 17306->17312 17309 7ff7c03835e8 17307->17309 17310 7ff7c038367f 17307->17310 17308->17305 17319 7ff7c03835ed 17309->17319 17321 7ff7c03836be 17309->17321 17315 7ff7c0381b50 38 API calls 17310->17315 17313 7ff7c038365c 17311->17313 17314 7ff7c038368f 17311->17314 17312->17310 17312->17321 17330 7ff7c0383618 17312->17330 17316 7ff7c03835fd 17313->17316 17323 7ff7c038366b 17313->17323 17317 7ff7c0381740 38 API calls 17314->17317 17315->17330 17318 7ff7c0383f04 47 API calls 17316->17318 17331 7ff7c03836ed 17316->17331 17317->17330 17318->17330 17319->17316 17320 7ff7c0383630 17319->17320 17319->17330 17325 7ff7c03843c0 47 API calls 17320->17325 17320->17331 17322 7ff7c0381f60 38 API calls 17321->17322 17321->17331 17322->17330 17323->17310 17324 7ff7c0383670 17323->17324 17327 7ff7c0384558 37 API calls 17324->17327 17324->17331 17325->17330 17326 7ff7c037c550 _log10_special 8 API calls 17328 7ff7c0383983 17326->17328 17327->17330 17328->17269 17329 7ff7c038e858 47 API calls 17329->17330 17330->17329 17330->17331 17331->17326 17383 7ff7c0380d14 17332->17383 17336 7ff7c0383f26 17335->17336 17337 7ff7c0380b80 12 API calls 17336->17337 17338 7ff7c0383f6e 17337->17338 17339 7ff7c038e570 46 API calls 17338->17339 17341 7ff7c0384041 17339->17341 17340 7ff7c0384063 17342 7ff7c03840ec 17340->17342 17344 7ff7c03847c0 45 API calls 17340->17344 17341->17340 17343 7ff7c03847c0 45 API calls 17341->17343 17342->17301 17343->17340 17344->17342 17346 7ff7c0384440 17345->17346 17347 7ff7c03843d8 17345->17347 17346->17301 17347->17346 17348 7ff7c038e858 47 API calls 17347->17348 17348->17346 17350 7ff7c0381b83 17349->17350 17351 7ff7c0381bb2 17350->17351 17353 7ff7c0381c6f 17350->17353 17352 7ff7c0380b80 12 API calls 17351->17352 17355 7ff7c0381bef 17351->17355 17352->17355 17354 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 17353->17354 17354->17355 17355->17301 17357 7ff7c0381773 17356->17357 17358 7ff7c03817a2 17357->17358 17360 7ff7c038185f 17357->17360 17359 7ff7c0380b80 12 API calls 17358->17359 17362 7ff7c03817df 17358->17362 17359->17362 17361 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 17360->17361 17361->17362 17362->17301 17364 7ff7c0381f93 17363->17364 17365 7ff7c0381fc2 17364->17365 17367 7ff7c038207f 17364->17367 17366 7ff7c0380b80 12 API calls 17365->17366 17369 7ff7c0381fff 17365->17369 17366->17369 17368 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 17367->17368 17368->17369 17369->17301 17371 7ff7c038e880 17370->17371 17372 7ff7c038e8c5 17371->17372 17374 7ff7c03847c0 45 API calls 17371->17374 17376 7ff7c038e885 memcpy_s 17371->17376 17379 7ff7c038e8ae memcpy_s 17371->17379 17372->17376 17372->17379 17380 7ff7c03907e8 17372->17380 17373 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 17373->17376 17374->17372 17376->17301 17379->17373 17379->17376 17381 7ff7c039080c WideCharToMultiByte 17380->17381 17384 7ff7c0380d41 17383->17384 17386 7ff7c0380d53 17383->17386 17385 7ff7c0384f08 _get_daylight 11 API calls 17384->17385 17387 7ff7c0380d46 17385->17387 17388 7ff7c0380d60 17386->17388 17391 7ff7c0380d9d 17386->17391 17389 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 17387->17389 17390 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 17388->17390 17397 7ff7c0380d51 17389->17397 17390->17397 17392 7ff7c0380e46 17391->17392 17393 7ff7c0384f08 _get_daylight 11 API calls 17391->17393 17394 7ff7c0384f08 _get_daylight 11 API calls 17392->17394 17392->17397 17395 7ff7c0380e3b 17393->17395 17396 7ff7c0380ef0 17394->17396 17398 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 17395->17398 17399 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 17396->17399 17397->17269 17398->17392 17399->17397 17405 7ff7c038ec3d 17400->17405 17401 7ff7c038ec42 17402 7ff7c03851dd 17401->17402 17403 7ff7c0384f08 _get_daylight 11 API calls 17401->17403 17402->17250 17402->17251 17404 7ff7c038ec4c 17403->17404 17406 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 17404->17406 17405->17401 17405->17402 17407 7ff7c038ec8c 17405->17407 17406->17402 17407->17402 17408 7ff7c0384f08 _get_daylight 11 API calls 17407->17408 17408->17404 17410 7ff7c0378633 __std_exception_destroy 17409->17410 17411 7ff7c03785b1 GetTokenInformation 17409->17411 17414 7ff7c037864c 17410->17414 17415 7ff7c0378646 CloseHandle 17410->17415 17412 7ff7c03785dd 17411->17412 17413 7ff7c03785d2 GetLastError 17411->17413 17412->17410 17416 7ff7c03785f9 GetTokenInformation 17412->17416 17413->17410 17413->17412 17414->16534 17415->17414 17416->17410 17417 7ff7c037861c 17416->17417 17417->17410 17418 7ff7c0378626 ConvertSidToStringSidW 17417->17418 17418->17410 17420 7ff7c037c850 17419->17420 17421 7ff7c0372b74 GetCurrentProcessId 17420->17421 17422 7ff7c03726b0 48 API calls 17421->17422 17423 7ff7c0372bc7 17422->17423 17424 7ff7c0384bd8 48 API calls 17423->17424 17425 7ff7c0372c10 MessageBoxW 17424->17425 17426 7ff7c037c550 _log10_special 8 API calls 17425->17426 17427 7ff7c0372c40 17426->17427 17427->16544 17429 7ff7c03725e5 17428->17429 17430 7ff7c0384bd8 48 API calls 17429->17430 17431 7ff7c0372604 17430->17431 17431->16560 17477 7ff7c0388794 17432->17477 17436 7ff7c03781dc 17435->17436 17437 7ff7c0379390 2 API calls 17436->17437 17438 7ff7c03781fb 17437->17438 17439 7ff7c0378216 ExpandEnvironmentStringsW 17438->17439 17440 7ff7c0378203 17438->17440 17442 7ff7c037823c __std_exception_destroy 17439->17442 17441 7ff7c0372810 49 API calls 17440->17441 17466 7ff7c037820f __std_exception_destroy 17441->17466 17443 7ff7c0378253 17442->17443 17444 7ff7c0378240 17442->17444 17448 7ff7c0378261 GetDriveTypeW 17443->17448 17449 7ff7c03782bf 17443->17449 17445 7ff7c0372810 49 API calls 17444->17445 17445->17466 17446 7ff7c037c550 _log10_special 8 API calls 17447 7ff7c03783af 17446->17447 17447->16558 17467 7ff7c0388238 17447->17467 17453 7ff7c0378295 17448->17453 17454 7ff7c03782b0 17448->17454 17615 7ff7c0387e08 17449->17615 17452 7ff7c03782d1 17456 7ff7c03782d9 17452->17456 17460 7ff7c03782ec 17452->17460 17457 7ff7c0372810 49 API calls 17453->17457 17608 7ff7c038796c 17454->17608 17458 7ff7c0372810 49 API calls 17456->17458 17457->17466 17458->17466 17459 7ff7c037834e CreateDirectoryW 17461 7ff7c037835d GetLastError 17459->17461 17459->17466 17460->17459 17462 7ff7c03726b0 48 API calls 17460->17462 17463 7ff7c037836a GetLastError 17461->17463 17461->17466 17464 7ff7c0378328 CreateDirectoryW 17462->17464 17465 7ff7c0372c50 51 API calls 17463->17465 17464->17460 17465->17466 17466->17446 17468 7ff7c0388245 17467->17468 17469 7ff7c0388258 17467->17469 17471 7ff7c0384f08 _get_daylight 11 API calls 17468->17471 17716 7ff7c0387ebc 17469->17716 17472 7ff7c038824a 17471->17472 17474 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 17472->17474 17475 7ff7c0388256 17474->17475 17475->16562 17518 7ff7c0391558 17477->17518 17577 7ff7c03912d0 17518->17577 17598 7ff7c03902d8 EnterCriticalSection 17577->17598 17609 7ff7c038798a 17608->17609 17612 7ff7c03879bd 17608->17612 17609->17612 17627 7ff7c0390474 17609->17627 17612->17466 17613 7ff7c038a900 _isindst 17 API calls 17614 7ff7c03879ed 17613->17614 17616 7ff7c0387e24 17615->17616 17617 7ff7c0387e92 17615->17617 17616->17617 17618 7ff7c0387e29 17616->17618 17661 7ff7c03907c0 17617->17661 17620 7ff7c0387e5e 17618->17620 17621 7ff7c0387e41 17618->17621 17644 7ff7c0387c4c GetFullPathNameW 17620->17644 17636 7ff7c0387bd8 GetFullPathNameW 17621->17636 17622 7ff7c0387e56 __std_exception_destroy 17622->17452 17628 7ff7c0390481 17627->17628 17629 7ff7c039048b 17627->17629 17628->17629 17634 7ff7c03904a7 17628->17634 17630 7ff7c0384f08 _get_daylight 11 API calls 17629->17630 17631 7ff7c0390493 17630->17631 17633 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 17631->17633 17632 7ff7c03879b9 17632->17612 17632->17613 17633->17632 17634->17632 17635 7ff7c0384f08 _get_daylight 11 API calls 17634->17635 17635->17631 17637 7ff7c0387bfe GetLastError 17636->17637 17640 7ff7c0387c14 17636->17640 17638 7ff7c0384e7c _fread_nolock 11 API calls 17637->17638 17641 7ff7c0387c0b 17638->17641 17639 7ff7c0387c10 17639->17622 17640->17639 17642 7ff7c0384f08 _get_daylight 11 API calls 17640->17642 17643 7ff7c0384f08 _get_daylight 11 API calls 17641->17643 17642->17639 17643->17639 17645 7ff7c0387c7f GetLastError 17644->17645 17649 7ff7c0387c95 __std_exception_destroy 17644->17649 17646 7ff7c0384e7c _fread_nolock 11 API calls 17645->17646 17647 7ff7c0387c8c 17646->17647 17648 7ff7c0384f08 _get_daylight 11 API calls 17647->17648 17650 7ff7c0387c91 17648->17650 17649->17650 17651 7ff7c0387cef GetFullPathNameW 17649->17651 17652 7ff7c0387d24 17650->17652 17651->17645 17651->17650 17656 7ff7c0387d98 memcpy_s 17652->17656 17657 7ff7c0387d4d memcpy_s 17652->17657 17653 7ff7c0387d81 17654 7ff7c0384f08 _get_daylight 11 API calls 17653->17654 17655 7ff7c0387d86 17654->17655 17659 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 17655->17659 17656->17622 17657->17653 17657->17656 17658 7ff7c0387dba 17657->17658 17658->17656 17660 7ff7c0384f08 _get_daylight 11 API calls 17658->17660 17659->17656 17660->17655 17664 7ff7c03905d0 17661->17664 17665 7ff7c0390612 17664->17665 17666 7ff7c03905fb 17664->17666 17667 7ff7c0390616 17665->17667 17668 7ff7c0390637 17665->17668 17669 7ff7c0384f08 _get_daylight 11 API calls 17666->17669 17690 7ff7c039073c 17667->17690 17702 7ff7c038f5b8 17668->17702 17670 7ff7c0390600 17669->17670 17675 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 17670->17675 17674 7ff7c039063c 17678 7ff7c03906e1 17674->17678 17685 7ff7c0390663 17674->17685 17689 7ff7c039060b __std_exception_destroy 17675->17689 17676 7ff7c039061f 17677 7ff7c0384ee8 _fread_nolock 11 API calls 17676->17677 17679 7ff7c0390624 17677->17679 17678->17666 17680 7ff7c03906e9 17678->17680 17681 7ff7c037c550 _log10_special 8 API calls 17684 7ff7c0390731 17681->17684 17684->17622 17686 7ff7c0387c4c 14 API calls 17685->17686 17689->17681 17691 7ff7c0390786 17690->17691 17692 7ff7c0390756 17690->17692 17693 7ff7c0390791 GetDriveTypeW 17691->17693 17694 7ff7c0390771 17691->17694 17695 7ff7c0384ee8 _fread_nolock 11 API calls 17692->17695 17693->17694 17697 7ff7c037c550 _log10_special 8 API calls 17694->17697 17696 7ff7c039075b 17695->17696 17698 7ff7c0384f08 _get_daylight 11 API calls 17696->17698 17700 7ff7c039061b 17697->17700 17699 7ff7c0390766 17698->17699 17701 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 17699->17701 17700->17674 17700->17676 17701->17694 17703 7ff7c039a4d0 memcpy_s 17702->17703 17704 7ff7c038f5ee GetCurrentDirectoryW 17703->17704 17705 7ff7c038f62c 17704->17705 17706 7ff7c038f605 17704->17706 17707 7ff7c038eb98 _get_daylight 11 API calls 17705->17707 17708 7ff7c037c550 _log10_special 8 API calls 17706->17708 17709 7ff7c038f63b 17707->17709 17710 7ff7c038f699 17708->17710 17711 7ff7c038f654 17709->17711 17712 7ff7c038f645 GetCurrentDirectoryW 17709->17712 17710->17674 17714 7ff7c0384f08 _get_daylight 11 API calls 17711->17714 17712->17711 17713 7ff7c038f659 17712->17713 17714->17713 17723 7ff7c03902d8 EnterCriticalSection 17716->17723 17725 7ff7c037456a 17724->17725 17726 7ff7c0379390 2 API calls 17725->17726 17727 7ff7c037458f 17726->17727 17728 7ff7c037c550 _log10_special 8 API calls 17727->17728 17729 7ff7c03745b7 17728->17729 17729->16586 17731 7ff7c0377e2e 17730->17731 17732 7ff7c0377f52 17731->17732 17733 7ff7c0371c80 49 API calls 17731->17733 17734 7ff7c037c550 _log10_special 8 API calls 17732->17734 17738 7ff7c0377eb5 17733->17738 17735 7ff7c0377f83 17734->17735 17735->16586 17736 7ff7c0371c80 49 API calls 17736->17738 17737 7ff7c0374560 10 API calls 17737->17738 17738->17732 17738->17736 17738->17737 17739 7ff7c0379390 2 API calls 17738->17739 17740 7ff7c0377f23 CreateDirectoryW 17739->17740 17740->17732 17740->17738 17742 7ff7c0371637 17741->17742 17743 7ff7c0371613 17741->17743 17745 7ff7c03745c0 108 API calls 17742->17745 17862 7ff7c0371050 17743->17862 17747 7ff7c037164b 17745->17747 17746 7ff7c0371618 17748 7ff7c037162e 17746->17748 17751 7ff7c0372710 54 API calls 17746->17751 17749 7ff7c0371653 17747->17749 17750 7ff7c0371682 17747->17750 17748->16586 17752 7ff7c0384f08 _get_daylight 11 API calls 17749->17752 17753 7ff7c03745c0 108 API calls 17750->17753 17751->17748 17754 7ff7c0371658 17752->17754 17755 7ff7c0371696 17753->17755 17758 7ff7c0372910 54 API calls 17754->17758 17756 7ff7c037169e 17755->17756 17757 7ff7c03716b8 17755->17757 17759 7ff7c0372710 54 API calls 17756->17759 17760 7ff7c03806d4 73 API calls 17757->17760 17761 7ff7c0371671 17758->17761 17762 7ff7c03716ae 17759->17762 17763 7ff7c03716cd 17760->17763 17761->16586 17766 7ff7c038004c 74 API calls 17762->17766 17764 7ff7c03716f9 17763->17764 17765 7ff7c03716d1 17763->17765 17768 7ff7c0371717 17764->17768 17769 7ff7c03716ff 17764->17769 17767 7ff7c0384f08 _get_daylight 11 API calls 17765->17767 17770 7ff7c0371829 17766->17770 17771 7ff7c03716d6 17767->17771 17774 7ff7c0371739 17768->17774 17785 7ff7c0371761 17768->17785 17840 7ff7c0371210 17769->17840 17770->16586 17773 7ff7c0372910 54 API calls 17771->17773 17780 7ff7c03716ef __std_exception_destroy 17773->17780 17776 7ff7c0384f08 _get_daylight 11 API calls 17774->17776 17775 7ff7c038004c 74 API calls 17775->17762 17777 7ff7c037173e 17776->17777 17778 7ff7c0372910 54 API calls 17777->17778 17778->17780 17779 7ff7c038039c _fread_nolock 53 API calls 17779->17785 17780->17775 17781 7ff7c03717da 17782 7ff7c0384f08 _get_daylight 11 API calls 17781->17782 17784 7ff7c03717ca 17782->17784 17788 7ff7c0372910 54 API calls 17784->17788 17785->17779 17785->17780 17785->17781 17786 7ff7c03717c5 17785->17786 17893 7ff7c0380adc 17785->17893 17787 7ff7c0384f08 _get_daylight 11 API calls 17786->17787 17787->17784 17788->17780 17790 7ff7c037718b 17789->17790 17792 7ff7c0377144 17789->17792 17790->16586 17792->17790 17926 7ff7c0385024 17792->17926 17794 7ff7c03741a1 17793->17794 17795 7ff7c03744e0 49 API calls 17794->17795 17796 7ff7c03741db 17795->17796 17797 7ff7c03744e0 49 API calls 17796->17797 17798 7ff7c03741eb 17797->17798 17799 7ff7c037420d 17798->17799 17800 7ff7c037423c 17798->17800 17957 7ff7c0374110 17799->17957 17801 7ff7c0374110 51 API calls 17800->17801 17803 7ff7c037423a 17801->17803 17804 7ff7c037429c 17803->17804 17805 7ff7c0374267 17803->17805 17807 7ff7c0374110 51 API calls 17804->17807 17964 7ff7c0377cf0 17805->17964 17809 7ff7c03742c0 17807->17809 17813 7ff7c0374110 51 API calls 17809->17813 17818 7ff7c0374312 17809->17818 17810 7ff7c0374297 17815 7ff7c037c550 _log10_special 8 API calls 17810->17815 17811 7ff7c0374393 17814 7ff7c0371950 115 API calls 17811->17814 17812 7ff7c0372710 54 API calls 17812->17810 17816 7ff7c03742e9 17813->17816 17817 7ff7c037439d 17814->17817 17819 7ff7c0374435 17815->17819 17816->17818 17822 7ff7c0374110 51 API calls 17816->17822 17820 7ff7c03743fe 17817->17820 17821 7ff7c03743a5 17817->17821 17818->17811 17824 7ff7c037438c 17818->17824 17826 7ff7c0374317 17818->17826 17828 7ff7c037437b 17818->17828 17819->16586 17823 7ff7c0372710 54 API calls 17820->17823 17990 7ff7c0371840 17821->17990 17822->17818 17823->17826 17824->17821 17824->17826 17829 7ff7c0372710 54 API calls 17826->17829 17832 7ff7c0372710 54 API calls 17828->17832 17829->17810 17830 7ff7c03743bc 17833 7ff7c0372710 54 API calls 17830->17833 17831 7ff7c03743d2 17834 7ff7c0371600 118 API calls 17831->17834 17832->17826 17833->17810 17835 7ff7c03743e0 17834->17835 17835->17810 17836 7ff7c0372710 54 API calls 17835->17836 17836->17810 17838 7ff7c0371c80 49 API calls 17837->17838 17839 7ff7c0374474 17838->17839 17839->16586 17841 7ff7c0371268 17840->17841 17842 7ff7c037126f 17841->17842 17843 7ff7c0371297 17841->17843 17844 7ff7c0372710 54 API calls 17842->17844 17846 7ff7c03712d4 17843->17846 17847 7ff7c03712b1 17843->17847 17845 7ff7c0371282 17844->17845 17845->17780 17851 7ff7c03712e6 17846->17851 17860 7ff7c0371309 memcpy_s 17846->17860 17848 7ff7c0384f08 _get_daylight 11 API calls 17847->17848 17849 7ff7c03712b6 17848->17849 17850 7ff7c0372910 54 API calls 17849->17850 17856 7ff7c03712cf __std_exception_destroy 17850->17856 17852 7ff7c0384f08 _get_daylight 11 API calls 17851->17852 17854 7ff7c03712eb 17852->17854 17853 7ff7c038039c _fread_nolock 53 API calls 17853->17860 17855 7ff7c0372910 54 API calls 17854->17855 17855->17856 17856->17780 17857 7ff7c03713cf 17858 7ff7c0372710 54 API calls 17857->17858 17858->17856 17859 7ff7c0380adc 76 API calls 17859->17860 17860->17853 17860->17856 17860->17857 17860->17859 17861 7ff7c0380110 37 API calls 17860->17861 17861->17860 17863 7ff7c03745c0 108 API calls 17862->17863 17864 7ff7c037108c 17863->17864 17865 7ff7c03710a9 17864->17865 17866 7ff7c0371094 17864->17866 17868 7ff7c03806d4 73 API calls 17865->17868 17867 7ff7c0372710 54 API calls 17866->17867 17874 7ff7c03710a4 __std_exception_destroy 17867->17874 17869 7ff7c03710bf 17868->17869 17870 7ff7c03710e6 17869->17870 17871 7ff7c03710c3 17869->17871 17876 7ff7c03710f7 17870->17876 17877 7ff7c0371122 17870->17877 17872 7ff7c0384f08 _get_daylight 11 API calls 17871->17872 17873 7ff7c03710c8 17872->17873 17875 7ff7c0372910 54 API calls 17873->17875 17874->17746 17884 7ff7c03710e1 __std_exception_destroy 17875->17884 17879 7ff7c0384f08 _get_daylight 11 API calls 17876->17879 17878 7ff7c0371129 17877->17878 17887 7ff7c037113c 17877->17887 17881 7ff7c0371210 92 API calls 17878->17881 17880 7ff7c0371100 17879->17880 17882 7ff7c0372910 54 API calls 17880->17882 17881->17884 17882->17884 17883 7ff7c038004c 74 API calls 17885 7ff7c03711b4 17883->17885 17884->17883 17885->17874 17897 7ff7c03746f0 17885->17897 17886 7ff7c038039c _fread_nolock 53 API calls 17886->17887 17887->17884 17887->17886 17889 7ff7c03711ed 17887->17889 17890 7ff7c0384f08 _get_daylight 11 API calls 17889->17890 17891 7ff7c03711f2 17890->17891 17892 7ff7c0372910 54 API calls 17891->17892 17892->17884 17894 7ff7c0380b0c 17893->17894 17911 7ff7c038082c 17894->17911 17896 7ff7c0380b2a 17896->17785 17898 7ff7c0374700 17897->17898 17899 7ff7c0379390 2 API calls 17898->17899 17900 7ff7c037472b 17899->17900 17901 7ff7c037479e 17900->17901 17902 7ff7c0379390 2 API calls 17900->17902 17903 7ff7c037c550 _log10_special 8 API calls 17901->17903 17904 7ff7c0374746 17902->17904 17906 7ff7c03747b9 17903->17906 17904->17901 17905 7ff7c037474b CreateSymbolicLinkW 17904->17905 17905->17901 17907 7ff7c0374775 17905->17907 17906->17874 17907->17901 17908 7ff7c037477e GetLastError 17907->17908 17908->17901 17909 7ff7c0374789 17908->17909 17910 7ff7c03746f0 10 API calls 17909->17910 17910->17901 17912 7ff7c038084c 17911->17912 17913 7ff7c0380879 17911->17913 17912->17913 17914 7ff7c0380856 17912->17914 17915 7ff7c0380881 17912->17915 17913->17896 17916 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 17914->17916 17918 7ff7c038076c 17915->17918 17916->17913 17925 7ff7c038546c EnterCriticalSection 17918->17925 17927 7ff7c0385031 17926->17927 17928 7ff7c038505e 17926->17928 17929 7ff7c0384f08 _get_daylight 11 API calls 17927->17929 17937 7ff7c0384fe8 17927->17937 17930 7ff7c0385081 17928->17930 17931 7ff7c038509d 17928->17931 17932 7ff7c038503b 17929->17932 17933 7ff7c0384f08 _get_daylight 11 API calls 17930->17933 17941 7ff7c0384f4c 17931->17941 17936 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 17932->17936 17934 7ff7c0385086 17933->17934 17938 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 17934->17938 17939 7ff7c0385046 17936->17939 17937->17792 17940 7ff7c0385091 17938->17940 17939->17792 17940->17792 17942 7ff7c0384f70 17941->17942 17948 7ff7c0384f6b 17941->17948 17943 7ff7c038b150 __GetCurrentState 45 API calls 17942->17943 17942->17948 17944 7ff7c0384f8b 17943->17944 17949 7ff7c038d984 17944->17949 17948->17940 17950 7ff7c038d999 17949->17950 17952 7ff7c0384fae 17949->17952 17951 7ff7c0393304 45 API calls 17950->17951 17950->17952 17951->17952 17953 7ff7c038d9f0 17952->17953 17954 7ff7c038da05 17953->17954 17955 7ff7c038da18 17953->17955 17954->17955 17956 7ff7c0392650 45 API calls 17954->17956 17955->17948 17956->17955 17958 7ff7c0374136 17957->17958 17959 7ff7c0384984 49 API calls 17958->17959 17960 7ff7c037415c 17959->17960 17961 7ff7c037416d 17960->17961 17962 7ff7c0374560 10 API calls 17960->17962 17961->17803 17963 7ff7c037417f 17962->17963 17963->17803 17965 7ff7c0377d05 17964->17965 17966 7ff7c03745c0 108 API calls 17965->17966 17967 7ff7c0377d2b 17966->17967 17968 7ff7c0377d52 17967->17968 17969 7ff7c03745c0 108 API calls 17967->17969 17970 7ff7c037c550 _log10_special 8 API calls 17968->17970 17971 7ff7c0377d42 17969->17971 17972 7ff7c0374277 17970->17972 17973 7ff7c0377d4d 17971->17973 17974 7ff7c0377d5c 17971->17974 17972->17810 17972->17812 17975 7ff7c038004c 74 API calls 17973->17975 17994 7ff7c03800e4 17974->17994 17975->17968 17977 7ff7c0377dbf 17978 7ff7c038004c 74 API calls 17977->17978 17980 7ff7c0377de7 17978->17980 17979 7ff7c038039c _fread_nolock 53 API calls 17988 7ff7c0377d61 17979->17988 17981 7ff7c038004c 74 API calls 17980->17981 17981->17968 17982 7ff7c0377dc6 17983 7ff7c0380110 37 API calls 17982->17983 17985 7ff7c0377dc1 17983->17985 17984 7ff7c0380adc 76 API calls 17984->17988 17985->17977 18000 7ff7c0387318 17985->18000 17986 7ff7c0380110 37 API calls 17986->17988 17988->17977 17988->17979 17988->17982 17988->17984 17988->17985 17988->17986 17989 7ff7c03800e4 37 API calls 17988->17989 17989->17988 17992 7ff7c03718d5 17990->17992 17993 7ff7c0371865 17990->17993 17991 7ff7c0385024 45 API calls 17991->17993 17992->17830 17992->17831 17993->17991 17993->17992 17995 7ff7c03800ed 17994->17995 17996 7ff7c03800fd 17994->17996 17997 7ff7c0384f08 _get_daylight 11 API calls 17995->17997 17996->17988 17998 7ff7c03800f2 17997->17998 17999 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 17998->17999 17999->17996 18001 7ff7c0387320 18000->18001 18002 7ff7c038735d 18001->18002 18003 7ff7c038733c 18001->18003 18019 7ff7c038546c EnterCriticalSection 18002->18019 18004 7ff7c0384f08 _get_daylight 11 API calls 18003->18004 18021 7ff7c0385ec8 18020->18021 18022 7ff7c0385eee 18021->18022 18024 7ff7c0385f21 18021->18024 18023 7ff7c0384f08 _get_daylight 11 API calls 18022->18023 18025 7ff7c0385ef3 18023->18025 18026 7ff7c0385f27 18024->18026 18027 7ff7c0385f34 18024->18027 18028 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 18025->18028 18029 7ff7c0384f08 _get_daylight 11 API calls 18026->18029 18039 7ff7c038ac28 18027->18039 18031 7ff7c0374616 18028->18031 18029->18031 18031->16622 18052 7ff7c03902d8 EnterCriticalSection 18039->18052 18412 7ff7c03878f8 18411->18412 18415 7ff7c03873d4 18412->18415 18414 7ff7c0387911 18414->16632 18416 7ff7c038741e 18415->18416 18417 7ff7c03873ef 18415->18417 18425 7ff7c038546c EnterCriticalSection 18416->18425 18418 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 18417->18418 18420 7ff7c038740f 18418->18420 18420->18414 18427 7ff7c037fe43 18426->18427 18428 7ff7c037fe71 18426->18428 18429 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 18427->18429 18431 7ff7c037fe63 18428->18431 18436 7ff7c038546c EnterCriticalSection 18428->18436 18429->18431 18431->16636 18438 7ff7c03745c0 108 API calls 18437->18438 18439 7ff7c0371493 18438->18439 18440 7ff7c037149b 18439->18440 18441 7ff7c03714bc 18439->18441 18442 7ff7c0372710 54 API calls 18440->18442 18443 7ff7c03806d4 73 API calls 18441->18443 18444 7ff7c03714ab 18442->18444 18445 7ff7c03714d1 18443->18445 18444->16669 18446 7ff7c03714f8 18445->18446 18447 7ff7c03714d5 18445->18447 18450 7ff7c0371508 18446->18450 18451 7ff7c0371532 18446->18451 18448 7ff7c0384f08 _get_daylight 11 API calls 18447->18448 18449 7ff7c03714da 18448->18449 18452 7ff7c0372910 54 API calls 18449->18452 18453 7ff7c0384f08 _get_daylight 11 API calls 18450->18453 18454 7ff7c037154b 18451->18454 18455 7ff7c0371538 18451->18455 18466 7ff7c03714f3 __std_exception_destroy 18452->18466 18456 7ff7c0371510 18453->18456 18461 7ff7c038039c _fread_nolock 53 API calls 18454->18461 18462 7ff7c03715d6 18454->18462 18454->18466 18457 7ff7c0371210 92 API calls 18455->18457 18458 7ff7c0372910 54 API calls 18456->18458 18457->18466 18458->18466 18459 7ff7c038004c 74 API calls 18460 7ff7c03715c4 18459->18460 18460->16669 18461->18454 18463 7ff7c0384f08 _get_daylight 11 API calls 18462->18463 18464 7ff7c03715db 18463->18464 18465 7ff7c0372910 54 API calls 18464->18465 18465->18466 18466->18459 18468 7ff7c0379390 2 API calls 18467->18468 18469 7ff7c0378e94 LoadLibraryExW 18468->18469 18470 7ff7c0378eb3 __std_exception_destroy 18469->18470 18470->16703 18472 7ff7c037771b GetProcAddress 18471->18472 18473 7ff7c03776e9 GetLastError 18471->18473 18544 7ff7c0376375 18543->18544 18545 7ff7c0371c80 49 API calls 18544->18545 18546 7ff7c03763b1 18545->18546 18547 7ff7c03763dd 18546->18547 18548 7ff7c03763ba 18546->18548 18550 7ff7c0374630 49 API calls 18547->18550 18549 7ff7c0372710 54 API calls 18548->18549 18573 7ff7c03763d3 18549->18573 18551 7ff7c03763f5 18550->18551 18552 7ff7c0376413 18551->18552 18553 7ff7c0372710 54 API calls 18551->18553 18554 7ff7c0374560 10 API calls 18552->18554 18553->18552 18556 7ff7c037641d 18554->18556 18555 7ff7c037c550 _log10_special 8 API calls 18557 7ff7c037336e 18555->18557 18558 7ff7c037642b 18556->18558 18559 7ff7c0378e80 3 API calls 18556->18559 18557->16743 18574 7ff7c0376500 18557->18574 18560 7ff7c0374630 49 API calls 18558->18560 18559->18558 18561 7ff7c0376444 18560->18561 18562 7ff7c0376469 18561->18562 18563 7ff7c0376449 18561->18563 18565 7ff7c0378e80 3 API calls 18562->18565 18564 7ff7c0372710 54 API calls 18563->18564 18564->18573 18566 7ff7c0376476 18565->18566 18567 7ff7c03764c1 18566->18567 18568 7ff7c0376482 18566->18568 18633 7ff7c0375830 GetProcAddress 18567->18633 18569 7ff7c0379390 2 API calls 18568->18569 18571 7ff7c037649a GetLastError 18569->18571 18572 7ff7c0372c50 51 API calls 18571->18572 18572->18573 18573->18555 18723 7ff7c0375400 18574->18723 18576 7ff7c0376526 18577 7ff7c037652e 18576->18577 18578 7ff7c037653f 18576->18578 18579 7ff7c0372710 54 API calls 18577->18579 18730 7ff7c0374c90 18578->18730 18609 7ff7c037653a 18579->18609 18582 7ff7c037654b 18584 7ff7c0372710 54 API calls 18582->18584 18583 7ff7c037655c 18585 7ff7c037656c 18583->18585 18587 7ff7c037657d 18583->18587 18584->18609 18586 7ff7c0372710 54 API calls 18585->18586 18586->18609 18588 7ff7c03765ad 18587->18588 18589 7ff7c037659c 18587->18589 18591 7ff7c03765cd 18588->18591 18592 7ff7c03765bc 18588->18592 18590 7ff7c0372710 54 API calls 18589->18590 18590->18609 18734 7ff7c0374d50 18591->18734 18593 7ff7c0372710 54 API calls 18592->18593 18593->18609 18609->16739 18612 7ff7c0376070 18611->18612 18612->18612 18613 7ff7c0376099 18612->18613 18618 7ff7c03760b0 __std_exception_destroy 18612->18618 18614 7ff7c0372710 54 API calls 18613->18614 18615 7ff7c03760a5 18614->18615 18615->16741 18616 7ff7c0371470 116 API calls 18616->18618 18617 7ff7c0372710 54 API calls 18617->18618 18618->18616 18618->18617 18619 7ff7c03761bb 18618->18619 18619->16741 18634 7ff7c0375852 GetLastError 18633->18634 18635 7ff7c037587f GetProcAddress 18633->18635 18636 7ff7c037585f 18634->18636 18637 7ff7c037589b GetLastError 18635->18637 18638 7ff7c03758aa GetProcAddress 18635->18638 18639 7ff7c0372c50 51 API calls 18636->18639 18637->18636 18640 7ff7c03758d5 GetProcAddress 18638->18640 18641 7ff7c03758c6 GetLastError 18638->18641 18642 7ff7c0375874 18639->18642 18643 7ff7c0375903 GetProcAddress 18640->18643 18644 7ff7c03758f1 GetLastError 18640->18644 18641->18636 18642->18573 18645 7ff7c0375931 GetProcAddress 18643->18645 18646 7ff7c037591f GetLastError 18643->18646 18644->18636 18647 7ff7c037594d GetLastError 18645->18647 18648 7ff7c037595f GetProcAddress 18645->18648 18646->18636 18647->18636 18649 7ff7c037598d GetProcAddress 18648->18649 18650 7ff7c037597b GetLastError 18648->18650 18650->18649 18725 7ff7c037542c 18723->18725 18724 7ff7c0375434 18724->18576 18725->18724 18728 7ff7c03755d4 18725->18728 18754 7ff7c0386aa4 18725->18754 18726 7ff7c0375797 __std_exception_destroy 18726->18576 18727 7ff7c03747d0 47 API calls 18727->18728 18728->18726 18728->18727 18731 7ff7c0374cc0 18730->18731 18732 7ff7c037c550 _log10_special 8 API calls 18731->18732 18733 7ff7c0374d2a 18732->18733 18733->18582 18733->18583 18735 7ff7c0374d65 18734->18735 18755 7ff7c0386ad4 18754->18755 18758 7ff7c0385fa0 18755->18758 18757 7ff7c0386b04 18757->18725 18759 7ff7c0385fe3 18758->18759 18760 7ff7c0385fd1 18758->18760 18762 7ff7c038602d 18759->18762 18765 7ff7c0385ff0 18759->18765 18761 7ff7c0384f08 _get_daylight 11 API calls 18760->18761 18764 7ff7c0385fd6 18761->18764 18763 7ff7c0386048 18762->18763 18766 7ff7c03847c0 45 API calls 18762->18766 18770 7ff7c038606a 18763->18770 18779 7ff7c0386a2c 18763->18779 18768 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 18764->18768 18769 7ff7c038a814 _invalid_parameter_noinfo 37 API calls 18765->18769 18766->18763 18776 7ff7c0385fe1 18768->18776 18769->18776 18771 7ff7c038610b 18770->18771 18772 7ff7c0384f08 _get_daylight 11 API calls 18770->18772 18773 7ff7c0384f08 _get_daylight 11 API calls 18771->18773 18771->18776 18774 7ff7c0386100 18772->18774 18775 7ff7c03861b6 18773->18775 18777 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 18774->18777 18778 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 18775->18778 18776->18757 18777->18771 18778->18776 18780 7ff7c0386a66 18779->18780 18781 7ff7c0386a4f 18779->18781 18783 7ff7c0386a54 18780->18783 18790 7ff7c038ff98 18780->18790 18785 7ff7c038ff68 18781->18785 18783->18763 18786 7ff7c038b150 __GetCurrentState 45 API calls 18785->18786 18787 7ff7c038ff71 18786->18787 18788 7ff7c038d984 45 API calls 18787->18788 18789 7ff7c038ff8a 18788->18789 18789->18783 18791 7ff7c0384f4c 45 API calls 18790->18791 18793 7ff7c038ffd1 18791->18793 18792 7ff7c038ffdd 18794 7ff7c037c550 _log10_special 8 API calls 18792->18794 18793->18792 18797 7ff7c0392e40 18793->18797 18798 7ff7c0384f4c 45 API calls 18797->18798 18831->16745 19134 7ff7c0389d50 19137 7ff7c0389ccc 19134->19137 19144 7ff7c03902d8 EnterCriticalSection 19137->19144 19409 7ff7c038afd0 19410 7ff7c038afd5 19409->19410 19414 7ff7c038afea 19409->19414 19415 7ff7c038aff0 19410->19415 19416 7ff7c038b032 19415->19416 19417 7ff7c038b03a 19415->19417 19418 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19416->19418 19419 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19417->19419 19418->19417 19420 7ff7c038b047 19419->19420 19421 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19420->19421 19422 7ff7c038b054 19421->19422 19423 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19422->19423 19424 7ff7c038b061 19423->19424 19425 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19424->19425 19426 7ff7c038b06e 19425->19426 19427 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19426->19427 19428 7ff7c038b07b 19427->19428 19429 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19428->19429 19430 7ff7c038b088 19429->19430 19431 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19430->19431 19432 7ff7c038b095 19431->19432 19433 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19432->19433 19434 7ff7c038b0a5 19433->19434 19435 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19434->19435 19436 7ff7c038b0b5 19435->19436 19441 7ff7c038ae94 19436->19441 19455 7ff7c03902d8 EnterCriticalSection 19441->19455 19165 7ff7c037cb50 19166 7ff7c037cb60 19165->19166 19182 7ff7c0389ba8 19166->19182 19168 7ff7c037cb6c 19188 7ff7c037ce48 19168->19188 19170 7ff7c037cbd9 19171 7ff7c037d12c 7 API calls 19170->19171 19181 7ff7c037cbf5 19170->19181 19173 7ff7c037cc05 19171->19173 19172 7ff7c037cb84 _RTC_Initialize 19172->19170 19193 7ff7c037cff8 19172->19193 19175 7ff7c037cb99 19196 7ff7c0389014 19175->19196 19183 7ff7c0389bb9 19182->19183 19184 7ff7c0384f08 _get_daylight 11 API calls 19183->19184 19187 7ff7c0389bc1 19183->19187 19185 7ff7c0389bd0 19184->19185 19186 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 19185->19186 19186->19187 19187->19168 19189 7ff7c037ce59 19188->19189 19192 7ff7c037ce5e __scrt_release_startup_lock 19188->19192 19190 7ff7c037d12c 7 API calls 19189->19190 19189->19192 19191 7ff7c037ced2 19190->19191 19192->19172 19221 7ff7c037cfbc 19193->19221 19195 7ff7c037d001 19195->19175 19197 7ff7c037cba5 19196->19197 19198 7ff7c0389034 19196->19198 19197->19170 19220 7ff7c037d0cc InitializeSListHead 19197->19220 19199 7ff7c0389052 GetModuleFileNameW 19198->19199 19200 7ff7c038903c 19198->19200 19204 7ff7c038907d 19199->19204 19201 7ff7c0384f08 _get_daylight 11 API calls 19200->19201 19202 7ff7c0389041 19201->19202 19203 7ff7c038a8e0 _invalid_parameter_noinfo 37 API calls 19202->19203 19203->19197 19236 7ff7c0388fb4 19204->19236 19207 7ff7c03890c5 19208 7ff7c0384f08 _get_daylight 11 API calls 19207->19208 19209 7ff7c03890ca 19208->19209 19210 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19209->19210 19210->19197 19211 7ff7c03890ff 19213 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19211->19213 19212 7ff7c03890dd 19212->19211 19214 7ff7c0389144 19212->19214 19215 7ff7c038912b 19212->19215 19213->19197 19217 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19214->19217 19216 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19215->19216 19218 7ff7c0389134 19216->19218 19217->19211 19219 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19218->19219 19219->19197 19222 7ff7c037cfd6 19221->19222 19223 7ff7c037cfcf 19221->19223 19225 7ff7c038a1ec 19222->19225 19223->19195 19228 7ff7c0389e28 19225->19228 19235 7ff7c03902d8 EnterCriticalSection 19228->19235 19237 7ff7c0389004 19236->19237 19238 7ff7c0388fcc 19236->19238 19237->19207 19237->19212 19238->19237 19239 7ff7c038eb98 _get_daylight 11 API calls 19238->19239 19240 7ff7c0388ffa 19239->19240 19241 7ff7c038a948 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19240->19241 19241->19237

                                                                                                                                                                                                                                                Executed Functions

                                                                                                                                                                                                                                                Function 00007FF7C03789E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                control_flow_graph 0 7ff7c03789e0-7ff7c0378b26 call 7ff7c037c850 call 7ff7c0379390 SetConsoleCtrlHandler GetStartupInfoW call 7ff7c03853f0 call 7ff7c038a47c call 7ff7c038871c call 7ff7c03853f0 call 7ff7c038a47c call 7ff7c038871c call 7ff7c03853f0 call 7ff7c038a47c call 7ff7c038871c GetCommandLineW CreateProcessW 23 7ff7c0378b4d-7ff7c0378b89 RegisterClassW 0->23 24 7ff7c0378b28-7ff7c0378b48 GetLastError call 7ff7c0372c50 0->24 26 7ff7c0378b8b GetLastError 23->26 27 7ff7c0378b91-7ff7c0378be5 CreateWindowExW 23->27 31 7ff7c0378e39-7ff7c0378e5f call 7ff7c037c550 24->31 26->27 29 7ff7c0378be7-7ff7c0378bed GetLastError 27->29 30 7ff7c0378bef-7ff7c0378bf4 ShowWindow 27->30 32 7ff7c0378bfa-7ff7c0378c0a WaitForSingleObject 29->32 30->32 34 7ff7c0378c0c 32->34 35 7ff7c0378c88-7ff7c0378c8f 32->35 39 7ff7c0378c10-7ff7c0378c13 34->39 36 7ff7c0378cd2-7ff7c0378cd9 35->36 37 7ff7c0378c91-7ff7c0378ca1 WaitForSingleObject 35->37 42 7ff7c0378dc0-7ff7c0378dd9 GetMessageW 36->42 43 7ff7c0378cdf-7ff7c0378cf5 QueryPerformanceFrequency QueryPerformanceCounter 36->43 40 7ff7c0378df8-7ff7c0378e02 37->40 41 7ff7c0378ca7-7ff7c0378cb7 TerminateProcess 37->41 44 7ff7c0378c1b-7ff7c0378c22 39->44 45 7ff7c0378c15 GetLastError 39->45 48 7ff7c0378e04-7ff7c0378e0a DestroyWindow 40->48 49 7ff7c0378e11-7ff7c0378e35 GetExitCodeProcess CloseHandle * 2 40->49 50 7ff7c0378cb9 GetLastError 41->50 51 7ff7c0378cbf-7ff7c0378ccd WaitForSingleObject 41->51 46 7ff7c0378ddb-7ff7c0378de9 TranslateMessage DispatchMessageW 42->46 47 7ff7c0378def-7ff7c0378df6 42->47 52 7ff7c0378d00-7ff7c0378d38 MsgWaitForMultipleObjects PeekMessageW 43->52 44->37 53 7ff7c0378c24-7ff7c0378c41 PeekMessageW 44->53 45->44 46->47 47->40 47->42 48->49 49->31 50->51 51->40 54 7ff7c0378d3a 52->54 55 7ff7c0378d73-7ff7c0378d7a 52->55 56 7ff7c0378c76-7ff7c0378c86 WaitForSingleObject 53->56 57 7ff7c0378c43-7ff7c0378c74 TranslateMessage DispatchMessageW PeekMessageW 53->57 58 7ff7c0378d40-7ff7c0378d71 TranslateMessage DispatchMessageW PeekMessageW 54->58 55->42 59 7ff7c0378d7c-7ff7c0378da5 QueryPerformanceCounter 55->59 56->35 56->39 57->56 57->57 58->55 58->58 59->52 60 7ff7c0378dab-7ff7c0378db2 59->60 60->40 61 7ff7c0378db4-7ff7c0378db8 60->61 61->42
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                                                                                                                                                                                                • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                                                                                                                                                                                                • API String ID: 3832162212-3165540532
                                                                                                                                                                                                                                                • Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
                                                                                                                                                                                                                                                • Instruction ID: 716f4f8ad9cef6e4f9dcc5eef3d65a65263361a4544d9c4e8937d4a0a2a1e251
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 24D16531A18B8286EB10AF35E9542A9B760FF85B68F80023DDE5D83794DF3CE555C790
                                                                                                                                                                                                                                                Function 00007FF7C0371000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511COMMON
                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                control_flow_graph 62 7ff7c0371000-7ff7c0373806 call 7ff7c037fe18 call 7ff7c037fe20 call 7ff7c037c850 call 7ff7c03853f0 call 7ff7c0385484 call 7ff7c03736b0 76 7ff7c0373808-7ff7c037380f 62->76 77 7ff7c0373814-7ff7c0373836 call 7ff7c0371950 62->77 78 7ff7c0373c97-7ff7c0373cb2 call 7ff7c037c550 76->78 83 7ff7c037391b-7ff7c0373931 call 7ff7c03745c0 77->83 84 7ff7c037383c-7ff7c0373856 call 7ff7c0371c80 77->84 89 7ff7c037396a-7ff7c037397f call 7ff7c0372710 83->89 90 7ff7c0373933-7ff7c0373960 call 7ff7c0377f90 83->90 88 7ff7c037385b-7ff7c037389b call 7ff7c0378830 84->88 95 7ff7c037389d-7ff7c03738a3 88->95 96 7ff7c03738c1-7ff7c03738cc call 7ff7c0384f30 88->96 104 7ff7c0373c8f 89->104 102 7ff7c0373984-7ff7c03739a6 call 7ff7c0371c80 90->102 103 7ff7c0373962-7ff7c0373965 call 7ff7c038004c 90->103 99 7ff7c03738a5-7ff7c03738ad 95->99 100 7ff7c03738af-7ff7c03738bd call 7ff7c03789a0 95->100 110 7ff7c03739fc-7ff7c0373a2a call 7ff7c0378940 call 7ff7c03789a0 * 3 96->110 111 7ff7c03738d2-7ff7c03738e1 call 7ff7c0378830 96->111 99->100 100->96 113 7ff7c03739b0-7ff7c03739b9 102->113 103->89 104->78 138 7ff7c0373a2f-7ff7c0373a3e call 7ff7c0378830 110->138 120 7ff7c03738e7-7ff7c03738ed 111->120 121 7ff7c03739f4-7ff7c03739f7 call 7ff7c0384f30 111->121 113->113 116 7ff7c03739bb-7ff7c03739d8 call 7ff7c0371950 113->116 116->88 127 7ff7c03739de-7ff7c03739ef call 7ff7c0372710 116->127 125 7ff7c03738f0-7ff7c03738fc 120->125 121->110 128 7ff7c03738fe-7ff7c0373903 125->128 129 7ff7c0373905-7ff7c0373908 125->129 127->104 128->125 128->129 129->121 132 7ff7c037390e-7ff7c0373916 call 7ff7c0384f30 129->132 132->138 141 7ff7c0373b45-7ff7c0373b53 138->141 142 7ff7c0373a44-7ff7c0373a47 138->142 144 7ff7c0373b59-7ff7c0373b5d 141->144 145 7ff7c0373a67 141->145 142->141 143 7ff7c0373a4d-7ff7c0373a50 142->143 146 7ff7c0373a56-7ff7c0373a5a 143->146 147 7ff7c0373b14-7ff7c0373b17 143->147 148 7ff7c0373a6b-7ff7c0373a90 call 7ff7c0384f30 144->148 145->148 146->147 149 7ff7c0373a60 146->149 150 7ff7c0373b19-7ff7c0373b1d 147->150 151 7ff7c0373b2f-7ff7c0373b40 call 7ff7c0372710 147->151 157 7ff7c0373aab-7ff7c0373ac0 148->157 158 7ff7c0373a92-7ff7c0373aa6 call 7ff7c0378940 148->158 149->145 150->151 153 7ff7c0373b1f-7ff7c0373b2a 150->153 159 7ff7c0373c7f-7ff7c0373c87 151->159 153->148 161 7ff7c0373be8-7ff7c0373bfa call 7ff7c0378830 157->161 162 7ff7c0373ac6-7ff7c0373aca 157->162 158->157 159->104 169 7ff7c0373c2e 161->169 170 7ff7c0373bfc-7ff7c0373c02 161->170 163 7ff7c0373bcd-7ff7c0373be2 call 7ff7c0371940 162->163 164 7ff7c0373ad0-7ff7c0373ae8 call 7ff7c0385250 162->164 163->161 163->162 175 7ff7c0373aea-7ff7c0373b02 call 7ff7c0385250 164->175 176 7ff7c0373b62-7ff7c0373b7a call 7ff7c0385250 164->176 177 7ff7c0373c31-7ff7c0373c40 call 7ff7c0384f30 169->177 173 7ff7c0373c1e-7ff7c0373c2c 170->173 174 7ff7c0373c04-7ff7c0373c1c 170->174 173->177 174->177 175->163 186 7ff7c0373b08-7ff7c0373b0f 175->186 184 7ff7c0373b7c-7ff7c0373b80 176->184 185 7ff7c0373b87-7ff7c0373b9f call 7ff7c0385250 176->185 187 7ff7c0373c46-7ff7c0373c4a 177->187 188 7ff7c0373d41-7ff7c0373d63 call 7ff7c03744e0 177->188 184->185 197 7ff7c0373bac-7ff7c0373bc4 call 7ff7c0385250 185->197 198 7ff7c0373ba1-7ff7c0373ba5 185->198 186->163 190 7ff7c0373cd4-7ff7c0373ce6 call 7ff7c0378830 187->190 191 7ff7c0373c50-7ff7c0373c5f call 7ff7c03790e0 187->191 201 7ff7c0373d65-7ff7c0373d6f call 7ff7c0374630 188->201 202 7ff7c0373d71-7ff7c0373d82 call 7ff7c0371c80 188->202 207 7ff7c0373ce8-7ff7c0373ceb 190->207 208 7ff7c0373d35-7ff7c0373d3c 190->208 205 7ff7c0373cb3-7ff7c0373cb6 call 7ff7c0378660 191->205 206 7ff7c0373c61 191->206 197->163 219 7ff7c0373bc6 197->219 198->197 210 7ff7c0373d87-7ff7c0373d96 201->210 202->210 218 7ff7c0373cbb-7ff7c0373cbd 205->218 213 7ff7c0373c68 call 7ff7c0372710 206->213 207->208 214 7ff7c0373ced-7ff7c0373d10 call 7ff7c0371c80 207->214 208->213 216 7ff7c0373d98-7ff7c0373d9f 210->216 217 7ff7c0373dc4-7ff7c0373dda call 7ff7c0379390 210->217 227 7ff7c0373c6d-7ff7c0373c77 213->227 228 7ff7c0373d2b-7ff7c0373d33 call 7ff7c0384f30 214->228 229 7ff7c0373d12-7ff7c0373d26 call 7ff7c0372710 call 7ff7c0384f30 214->229 216->217 223 7ff7c0373da1-7ff7c0373da5 216->223 234 7ff7c0373ddc 217->234 235 7ff7c0373de8-7ff7c0373e04 SetDllDirectoryW 217->235 225 7ff7c0373cc8-7ff7c0373ccf 218->225 226 7ff7c0373cbf-7ff7c0373cc6 218->226 219->163 223->217 230 7ff7c0373da7-7ff7c0373dbe SetDllDirectoryW LoadLibraryExW 223->230 225->210 226->213 227->159 228->210 229->227 230->217 234->235 238 7ff7c0373e0a-7ff7c0373e19 call 7ff7c0378830 235->238 239 7ff7c0373f01-7ff7c0373f08 235->239 251 7ff7c0373e1b-7ff7c0373e21 238->251 252 7ff7c0373e32-7ff7c0373e3c call 7ff7c0384f30 238->252 241 7ff7c0373f0e-7ff7c0373f15 239->241 242 7ff7c0374008-7ff7c0374010 239->242 241->242 245 7ff7c0373f1b-7ff7c0373f25 call 7ff7c03733c0 241->245 246 7ff7c0374035-7ff7c0374067 call 7ff7c03736a0 call 7ff7c0373360 call 7ff7c0373670 call 7ff7c0376fc0 call 7ff7c0376d70 242->246 247 7ff7c0374012-7ff7c037402f PostMessageW GetMessageW 242->247 245->227 259 7ff7c0373f2b-7ff7c0373f3f call 7ff7c03790c0 245->259 247->246 253 7ff7c0373e2d-7ff7c0373e2f 251->253 254 7ff7c0373e23-7ff7c0373e2b 251->254 262 7ff7c0373ef2-7ff7c0373efc call 7ff7c0378940 252->262 263 7ff7c0373e42-7ff7c0373e48 252->263 253->252 254->253 272 7ff7c0373f64-7ff7c0373fa0 call 7ff7c0378940 call 7ff7c03789e0 call 7ff7c0376fc0 call 7ff7c0376d70 call 7ff7c03788e0 259->272 273 7ff7c0373f41-7ff7c0373f5e PostMessageW GetMessageW 259->273 262->239 263->262 267 7ff7c0373e4e-7ff7c0373e54 263->267 270 7ff7c0373e56-7ff7c0373e58 267->270 271 7ff7c0373e5f-7ff7c0373e61 267->271 276 7ff7c0373e5a 270->276 277 7ff7c0373e67-7ff7c0373e83 call 7ff7c0376dc0 call 7ff7c0377340 270->277 271->239 271->277 308 7ff7c0373fa5-7ff7c0373fa7 272->308 273->272 276->239 290 7ff7c0373e8e-7ff7c0373e95 277->290 291 7ff7c0373e85-7ff7c0373e8c 277->291 293 7ff7c0373e97-7ff7c0373ea4 call 7ff7c0376e00 290->293 294 7ff7c0373eaf-7ff7c0373eb9 call 7ff7c03771b0 290->294 292 7ff7c0373edb-7ff7c0373ef0 call 7ff7c0372a50 call 7ff7c0376fc0 call 7ff7c0376d70 291->292 292->239 293->294 305 7ff7c0373ea6-7ff7c0373ead 293->305 306 7ff7c0373ebb-7ff7c0373ec2 294->306 307 7ff7c0373ec4-7ff7c0373ed2 call 7ff7c03774f0 294->307 305->292 306->292 307->239 319 7ff7c0373ed4 307->319 311 7ff7c0373fa9-7ff7c0373fbf call 7ff7c0378ed0 call 7ff7c03788e0 308->311 312 7ff7c0373ff5-7ff7c0374003 call 7ff7c0371900 308->312 311->312 323 7ff7c0373fc1-7ff7c0373fd6 311->323 312->227 319->292 324 7ff7c0373fd8-7ff7c0373feb call 7ff7c0372710 call 7ff7c0371900 323->324 325 7ff7c0373ff0 call 7ff7c0372a50 323->325 324->227 325->312
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                                                                • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
                                                                                                                                                                                                                                                • API String ID: 2776309574-4232158417
                                                                                                                                                                                                                                                • Opcode ID: 9de477ae995940a39e23314e20718922418974b9c8241bfba060ee61ec72f349
                                                                                                                                                                                                                                                • Instruction ID: 289caeffebc70fe549101989efcc34e72d4b149bf9f2fae6bdcf49622f8da776
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9de477ae995940a39e23314e20718922418974b9c8241bfba060ee61ec72f349
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0532B221A1C68291FB15BF2996583B9E251AF467A0FC4403EDA4DC73D6EF2CF594C3A0
                                                                                                                                                                                                                                                Function 00007FF7C0395C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                control_flow_graph 479 7ff7c0395c00-7ff7c0395c3b call 7ff7c0395588 call 7ff7c0395590 call 7ff7c03955f8 486 7ff7c0395c41-7ff7c0395c4c call 7ff7c0395598 479->486 487 7ff7c0395e65-7ff7c0395eb1 call 7ff7c038a900 call 7ff7c0395588 call 7ff7c0395590 call 7ff7c03955f8 479->487 486->487 493 7ff7c0395c52-7ff7c0395c5c 486->493 513 7ff7c0395fef-7ff7c039605d call 7ff7c038a900 call 7ff7c0391578 487->513 514 7ff7c0395eb7-7ff7c0395ec2 call 7ff7c0395598 487->514 495 7ff7c0395c7e-7ff7c0395c82 493->495 496 7ff7c0395c5e-7ff7c0395c61 493->496 499 7ff7c0395c85-7ff7c0395c8d 495->499 498 7ff7c0395c64-7ff7c0395c6f 496->498 501 7ff7c0395c71-7ff7c0395c78 498->501 502 7ff7c0395c7a-7ff7c0395c7c 498->502 499->499 503 7ff7c0395c8f-7ff7c0395ca2 call 7ff7c038d5fc 499->503 501->498 501->502 502->495 505 7ff7c0395cab-7ff7c0395cb9 502->505 509 7ff7c0395ca4-7ff7c0395ca6 call 7ff7c038a948 503->509 510 7ff7c0395cba-7ff7c0395cc6 call 7ff7c038a948 503->510 509->505 519 7ff7c0395ccd-7ff7c0395cd5 510->519 533 7ff7c039605f-7ff7c0396066 513->533 534 7ff7c039606b-7ff7c039606e 513->534 514->513 524 7ff7c0395ec8-7ff7c0395ed3 call 7ff7c03955c8 514->524 519->519 522 7ff7c0395cd7-7ff7c0395ce8 call 7ff7c0390474 519->522 522->487 532 7ff7c0395cee-7ff7c0395d44 call 7ff7c039a4d0 * 4 call 7ff7c0395b1c 522->532 524->513 531 7ff7c0395ed9-7ff7c0395efc call 7ff7c038a948 GetTimeZoneInformation 524->531 547 7ff7c0395f02-7ff7c0395f23 531->547 548 7ff7c0395fc4-7ff7c0395fee call 7ff7c0395580 call 7ff7c0395570 call 7ff7c0395578 531->548 592 7ff7c0395d46-7ff7c0395d4a 532->592 537 7ff7c03960fb-7ff7c03960fe 533->537 538 7ff7c0396070 534->538 539 7ff7c03960a5-7ff7c03960b8 call 7ff7c038d5fc 534->539 540 7ff7c0396073 537->540 544 7ff7c0396104-7ff7c039610c call 7ff7c0395c00 537->544 538->540 554 7ff7c03960c3-7ff7c03960de call 7ff7c0391578 539->554 555 7ff7c03960ba 539->555 545 7ff7c0396078-7ff7c03960a4 call 7ff7c038a948 call 7ff7c037c550 540->545 546 7ff7c0396073 call 7ff7c0395e7c 540->546 544->545 546->545 552 7ff7c0395f25-7ff7c0395f2b 547->552 553 7ff7c0395f2e-7ff7c0395f35 547->553 552->553 560 7ff7c0395f37-7ff7c0395f3f 553->560 561 7ff7c0395f49 553->561 579 7ff7c03960e0-7ff7c03960e3 554->579 580 7ff7c03960e5-7ff7c03960f7 call 7ff7c038a948 554->580 562 7ff7c03960bc-7ff7c03960c1 call 7ff7c038a948 555->562 560->561 567 7ff7c0395f41-7ff7c0395f47 560->567 571 7ff7c0395f4b-7ff7c0395fbf call 7ff7c039a4d0 * 4 call 7ff7c0392b5c call 7ff7c0396114 * 2 561->571 562->538 567->571 571->548 579->562 580->537 593 7ff7c0395d50-7ff7c0395d54 592->593 594 7ff7c0395d4c 592->594 593->592 596 7ff7c0395d56-7ff7c0395d7b call 7ff7c0386b58 593->596 594->593 602 7ff7c0395d7e-7ff7c0395d82 596->602 604 7ff7c0395d91-7ff7c0395d95 602->604 605 7ff7c0395d84-7ff7c0395d8f 602->605 604->602 605->604 607 7ff7c0395d97-7ff7c0395d9b 605->607 610 7ff7c0395e1c-7ff7c0395e20 607->610 611 7ff7c0395d9d-7ff7c0395dc5 call 7ff7c0386b58 607->611 612 7ff7c0395e22-7ff7c0395e24 610->612 613 7ff7c0395e27-7ff7c0395e34 610->613 619 7ff7c0395de3-7ff7c0395de7 611->619 620 7ff7c0395dc7 611->620 612->613 615 7ff7c0395e4f-7ff7c0395e5e call 7ff7c0395580 call 7ff7c0395570 613->615 616 7ff7c0395e36-7ff7c0395e4c call 7ff7c0395b1c 613->616 615->487 616->615 619->610 622 7ff7c0395de9-7ff7c0395e07 call 7ff7c0386b58 619->622 624 7ff7c0395dca-7ff7c0395dd1 620->624 631 7ff7c0395e13-7ff7c0395e1a 622->631 624->619 627 7ff7c0395dd3-7ff7c0395de1 624->627 627->619 627->624 631->610 632 7ff7c0395e09-7ff7c0395e0d 631->632 632->610 633 7ff7c0395e0f 632->633 633->631
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • _get_daylight.LIBCMT ref: 00007FF7C0395C45
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0395598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C03955AC
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C038A948: RtlFreeHeap.NTDLL(?,?,?,00007FF7C0392D22,?,?,?,00007FF7C0392D5F,?,?,00000000,00007FF7C0393225,?,?,?,00007FF7C0393157), ref: 00007FF7C038A95E
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C038A948: GetLastError.KERNEL32(?,?,?,00007FF7C0392D22,?,?,?,00007FF7C0392D5F,?,?,00000000,00007FF7C0393225,?,?,?,00007FF7C0393157), ref: 00007FF7C038A968
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C038A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7C038A8DF,?,?,?,?,?,00007FF7C038A7CA), ref: 00007FF7C038A909
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C038A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7C038A8DF,?,?,?,?,?,00007FF7C038A7CA), ref: 00007FF7C038A92E
                                                                                                                                                                                                                                                • _get_daylight.LIBCMT ref: 00007FF7C0395C34
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C03955F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C039560C
                                                                                                                                                                                                                                                • _get_daylight.LIBCMT ref: 00007FF7C0395EAA
                                                                                                                                                                                                                                                • _get_daylight.LIBCMT ref: 00007FF7C0395EBB
                                                                                                                                                                                                                                                • _get_daylight.LIBCMT ref: 00007FF7C0395ECC
                                                                                                                                                                                                                                                • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7C039610C), ref: 00007FF7C0395EF3
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                                                • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                                • API String ID: 4070488512-239921721
                                                                                                                                                                                                                                                • Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
                                                                                                                                                                                                                                                • Instruction ID: 954f51068b13618256aac07ba1fce015dd31210547b6619477b0915adbc15ecf
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F3D1B126E0865286E720BF26D4511B9A751EF847A4FC5813EEA0EC7796DF3CF48187E0
                                                                                                                                                                                                                                                Function 00007FF7C0396964 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                control_flow_graph 693 7ff7c0396964-7ff7c03969d7 call 7ff7c0396698 696 7ff7c03969f1-7ff7c03969fb call 7ff7c0388520 693->696 697 7ff7c03969d9-7ff7c03969e2 call 7ff7c0384ee8 693->697 703 7ff7c0396a16-7ff7c0396a7f CreateFileW 696->703 704 7ff7c03969fd-7ff7c0396a14 call 7ff7c0384ee8 call 7ff7c0384f08 696->704 702 7ff7c03969e5-7ff7c03969ec call 7ff7c0384f08 697->702 720 7ff7c0396d32-7ff7c0396d52 702->720 705 7ff7c0396a81-7ff7c0396a87 703->705 706 7ff7c0396afc-7ff7c0396b07 GetFileType 703->706 704->702 709 7ff7c0396ac9-7ff7c0396af7 GetLastError call 7ff7c0384e7c 705->709 710 7ff7c0396a89-7ff7c0396a8d 705->710 712 7ff7c0396b09-7ff7c0396b44 GetLastError call 7ff7c0384e7c CloseHandle 706->712 713 7ff7c0396b5a-7ff7c0396b61 706->713 709->702 710->709 718 7ff7c0396a8f-7ff7c0396ac7 CreateFileW 710->718 712->702 728 7ff7c0396b4a-7ff7c0396b55 call 7ff7c0384f08 712->728 716 7ff7c0396b63-7ff7c0396b67 713->716 717 7ff7c0396b69-7ff7c0396b6c 713->717 723 7ff7c0396b72-7ff7c0396bc7 call 7ff7c0388438 716->723 717->723 724 7ff7c0396b6e 717->724 718->706 718->709 731 7ff7c0396be6-7ff7c0396c17 call 7ff7c0396418 723->731 732 7ff7c0396bc9-7ff7c0396bd5 call 7ff7c03968a0 723->732 724->723 728->702 738 7ff7c0396c19-7ff7c0396c1b 731->738 739 7ff7c0396c1d-7ff7c0396c5f 731->739 732->731 740 7ff7c0396bd7 732->740 741 7ff7c0396bd9-7ff7c0396be1 call 7ff7c038aac0 738->741 742 7ff7c0396c81-7ff7c0396c8c 739->742 743 7ff7c0396c61-7ff7c0396c65 739->743 740->741 741->720 745 7ff7c0396d30 742->745 746 7ff7c0396c92-7ff7c0396c96 742->746 743->742 744 7ff7c0396c67-7ff7c0396c7c 743->744 744->742 745->720 746->745 748 7ff7c0396c9c-7ff7c0396ce1 CloseHandle CreateFileW 746->748 750 7ff7c0396ce3-7ff7c0396d11 GetLastError call 7ff7c0384e7c call 7ff7c0388660 748->750 751 7ff7c0396d16-7ff7c0396d2b 748->751 750->751 751->745
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 1617910340-0
                                                                                                                                                                                                                                                • Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                                                                • Instruction ID: 5ef46ed1453432944081a107841bace9b130b886eace5442ce324e58faba2aac
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6CC1C133B29A4185EB10EF69C4906AC7765FB49BA8B81033DDE1E97794DF38E051C390
                                                                                                                                                                                                                                                Function 00007FF7C03783C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • FindFirstFileW.KERNELBASE(?,00007FF7C0378919,00007FF7C0373FA5), ref: 00007FF7C037842B
                                                                                                                                                                                                                                                • RemoveDirectoryW.KERNEL32(?,00007FF7C0378919,00007FF7C0373FA5), ref: 00007FF7C03784AE
                                                                                                                                                                                                                                                • DeleteFileW.KERNELBASE(?,00007FF7C0378919,00007FF7C0373FA5), ref: 00007FF7C03784CD
                                                                                                                                                                                                                                                • FindNextFileW.KERNELBASE(?,00007FF7C0378919,00007FF7C0373FA5), ref: 00007FF7C03784DB
                                                                                                                                                                                                                                                • FindClose.KERNEL32(?,00007FF7C0378919,00007FF7C0373FA5), ref: 00007FF7C03784EC
                                                                                                                                                                                                                                                • RemoveDirectoryW.KERNELBASE(?,00007FF7C0378919,00007FF7C0373FA5), ref: 00007FF7C03784F5
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                                                                                                                                                                                                • String ID: %s\*
                                                                                                                                                                                                                                                • API String ID: 1057558799-766152087
                                                                                                                                                                                                                                                • Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
                                                                                                                                                                                                                                                • Instruction ID: f2822c8864ef68aaf47668ac135d8e6e4e139a14042eb2a02e77096ef632eed8
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B7416421A1C54385EA20BF29E5581BAA360FB95774FC0023EDA5DC27D4DF7CF54587A0
                                                                                                                                                                                                                                                Function 00007FF7C0395E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                control_flow_graph 1014 7ff7c0395e7c-7ff7c0395eb1 call 7ff7c0395588 call 7ff7c0395590 call 7ff7c03955f8 1021 7ff7c0395fef-7ff7c039605d call 7ff7c038a900 call 7ff7c0391578 1014->1021 1022 7ff7c0395eb7-7ff7c0395ec2 call 7ff7c0395598 1014->1022 1034 7ff7c039605f-7ff7c0396066 1021->1034 1035 7ff7c039606b-7ff7c039606e 1021->1035 1022->1021 1028 7ff7c0395ec8-7ff7c0395ed3 call 7ff7c03955c8 1022->1028 1028->1021 1033 7ff7c0395ed9-7ff7c0395efc call 7ff7c038a948 GetTimeZoneInformation 1028->1033 1046 7ff7c0395f02-7ff7c0395f23 1033->1046 1047 7ff7c0395fc4-7ff7c0395fee call 7ff7c0395580 call 7ff7c0395570 call 7ff7c0395578 1033->1047 1037 7ff7c03960fb-7ff7c03960fe 1034->1037 1038 7ff7c0396070 1035->1038 1039 7ff7c03960a5-7ff7c03960b8 call 7ff7c038d5fc 1035->1039 1040 7ff7c0396073 1037->1040 1043 7ff7c0396104-7ff7c039610c call 7ff7c0395c00 1037->1043 1038->1040 1052 7ff7c03960c3-7ff7c03960de call 7ff7c0391578 1039->1052 1053 7ff7c03960ba 1039->1053 1044 7ff7c0396078-7ff7c03960a4 call 7ff7c038a948 call 7ff7c037c550 1040->1044 1045 7ff7c0396073 call 7ff7c0395e7c 1040->1045 1043->1044 1045->1044 1050 7ff7c0395f25-7ff7c0395f2b 1046->1050 1051 7ff7c0395f2e-7ff7c0395f35 1046->1051 1050->1051 1057 7ff7c0395f37-7ff7c0395f3f 1051->1057 1058 7ff7c0395f49 1051->1058 1073 7ff7c03960e0-7ff7c03960e3 1052->1073 1074 7ff7c03960e5-7ff7c03960f7 call 7ff7c038a948 1052->1074 1059 7ff7c03960bc-7ff7c03960c1 call 7ff7c038a948 1053->1059 1057->1058 1063 7ff7c0395f41-7ff7c0395f47 1057->1063 1066 7ff7c0395f4b-7ff7c0395fbf call 7ff7c039a4d0 * 4 call 7ff7c0392b5c call 7ff7c0396114 * 2 1058->1066 1059->1038 1063->1066 1066->1047 1073->1059 1074->1037
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • _get_daylight.LIBCMT ref: 00007FF7C0395EAA
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C03955F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C039560C
                                                                                                                                                                                                                                                • _get_daylight.LIBCMT ref: 00007FF7C0395EBB
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0395598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C03955AC
                                                                                                                                                                                                                                                • _get_daylight.LIBCMT ref: 00007FF7C0395ECC
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C03955C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C03955DC
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C038A948: RtlFreeHeap.NTDLL(?,?,?,00007FF7C0392D22,?,?,?,00007FF7C0392D5F,?,?,00000000,00007FF7C0393225,?,?,?,00007FF7C0393157), ref: 00007FF7C038A95E
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C038A948: GetLastError.KERNEL32(?,?,?,00007FF7C0392D22,?,?,?,00007FF7C0392D5F,?,?,00000000,00007FF7C0393225,?,?,?,00007FF7C0393157), ref: 00007FF7C038A968
                                                                                                                                                                                                                                                • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7C039610C), ref: 00007FF7C0395EF3
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                                                • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                                • API String ID: 3458911817-239921721
                                                                                                                                                                                                                                                • Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
                                                                                                                                                                                                                                                • Instruction ID: a2d64d1829176579f41c184fdb621a743b3ab1ad177aa25af6f948c1edb371ab
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 70515E22A0C65286E710FF26D8815A9B761BB487A4FC1413DEA4EC7796DF3CF44187A0
                                                                                                                                                                                                                                                Function 00007FF7C0379280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 2295610775-0
                                                                                                                                                                                                                                                • Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                                                                • Instruction ID: 6a4ddc1cce73cada2ba6b0229e757b04ae827de8bc7b79e2f4cdd7af1b3abca0
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: DBF0C822A1874586F760AF64B59C766B350AB85774F84073ED96D427D5DF3CF048CB40
                                                                                                                                                                                                                                                Function 00007FF7C0371950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                control_flow_graph 331 7ff7c0371950-7ff7c037198b call 7ff7c03745c0 334 7ff7c0371c4e-7ff7c0371c72 call 7ff7c037c550 331->334 335 7ff7c0371991-7ff7c03719d1 call 7ff7c0377f90 331->335 340 7ff7c0371c3b-7ff7c0371c3e call 7ff7c038004c 335->340 341 7ff7c03719d7-7ff7c03719e7 call 7ff7c03806d4 335->341 345 7ff7c0371c43-7ff7c0371c4b 340->345 346 7ff7c03719e9-7ff7c0371a03 call 7ff7c0384f08 call 7ff7c0372910 341->346 347 7ff7c0371a08-7ff7c0371a24 call 7ff7c038039c 341->347 345->334 346->340 353 7ff7c0371a45-7ff7c0371a5a call 7ff7c0384f28 347->353 354 7ff7c0371a26-7ff7c0371a40 call 7ff7c0384f08 call 7ff7c0372910 347->354 361 7ff7c0371a7b-7ff7c0371b05 call 7ff7c0371c80 * 2 call 7ff7c03806d4 call 7ff7c0384f44 353->361 362 7ff7c0371a5c-7ff7c0371a76 call 7ff7c0384f08 call 7ff7c0372910 353->362 354->340 375 7ff7c0371b0a-7ff7c0371b14 361->375 362->340 376 7ff7c0371b35-7ff7c0371b4e call 7ff7c038039c 375->376 377 7ff7c0371b16-7ff7c0371b30 call 7ff7c0384f08 call 7ff7c0372910 375->377 383 7ff7c0371b6f-7ff7c0371b8b call 7ff7c0380110 376->383 384 7ff7c0371b50-7ff7c0371b6a call 7ff7c0384f08 call 7ff7c0372910 376->384 377->340 390 7ff7c0371b8d-7ff7c0371b99 call 7ff7c0372710 383->390 391 7ff7c0371b9e-7ff7c0371bac 383->391 384->340 390->340 391->340 394 7ff7c0371bb2-7ff7c0371bb9 391->394 397 7ff7c0371bc1-7ff7c0371bc7 394->397 398 7ff7c0371bc9-7ff7c0371bd6 397->398 399 7ff7c0371be0-7ff7c0371bef 397->399 400 7ff7c0371bf1-7ff7c0371bfa 398->400 399->399 399->400 401 7ff7c0371bfc-7ff7c0371bff 400->401 402 7ff7c0371c0f 400->402 401->402 404 7ff7c0371c01-7ff7c0371c04 401->404 403 7ff7c0371c11-7ff7c0371c24 402->403 405 7ff7c0371c2d-7ff7c0371c39 403->405 406 7ff7c0371c26 403->406 404->402 407 7ff7c0371c06-7ff7c0371c09 404->407 405->340 405->397 406->405 407->402 408 7ff7c0371c0b-7ff7c0371c0d 407->408 408->403
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0377F90: _fread_nolock.LIBCMT ref: 00007FF7C037803A
                                                                                                                                                                                                                                                • _fread_nolock.LIBCMT ref: 00007FF7C0371A1B
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0372910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7C0371B6A), ref: 00007FF7C037295E
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _fread_nolock$CurrentProcess
                                                                                                                                                                                                                                                • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                                                                • API String ID: 2397952137-3497178890
                                                                                                                                                                                                                                                • Opcode ID: ed5d37bd12c92faad5b6bf746ee66ab535d4fcd70a2e81ebf99a2f5a44e873f3
                                                                                                                                                                                                                                                • Instruction ID: 63b417c2bddcb61920d0358effc70d14c0873268fa000deb21626af92dbc5a1c
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ed5d37bd12c92faad5b6bf746ee66ab535d4fcd70a2e81ebf99a2f5a44e873f3
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: BD81A372A0C68686EB60EF18D1442B9A390EF4AB64FC4453DDA8DC7785DF3CF5458BA0
                                                                                                                                                                                                                                                Function 00007FF7C0371600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                control_flow_graph 409 7ff7c0371600-7ff7c0371611 410 7ff7c0371637-7ff7c0371651 call 7ff7c03745c0 409->410 411 7ff7c0371613-7ff7c037161c call 7ff7c0371050 409->411 418 7ff7c0371653-7ff7c0371681 call 7ff7c0384f08 call 7ff7c0372910 410->418 419 7ff7c0371682-7ff7c037169c call 7ff7c03745c0 410->419 416 7ff7c037162e-7ff7c0371636 411->416 417 7ff7c037161e-7ff7c0371629 call 7ff7c0372710 411->417 417->416 425 7ff7c037169e-7ff7c03716b3 call 7ff7c0372710 419->425 426 7ff7c03716b8-7ff7c03716cf call 7ff7c03806d4 419->426 433 7ff7c0371821-7ff7c0371824 call 7ff7c038004c 425->433 434 7ff7c03716f9-7ff7c03716fd 426->434 435 7ff7c03716d1-7ff7c03716f4 call 7ff7c0384f08 call 7ff7c0372910 426->435 441 7ff7c0371829-7ff7c037183b 433->441 438 7ff7c0371717-7ff7c0371737 call 7ff7c0384f44 434->438 439 7ff7c03716ff-7ff7c037170b call 7ff7c0371210 434->439 450 7ff7c0371819-7ff7c037181c call 7ff7c038004c 435->450 447 7ff7c0371739-7ff7c037175c call 7ff7c0384f08 call 7ff7c0372910 438->447 448 7ff7c0371761-7ff7c037176c 438->448 446 7ff7c0371710-7ff7c0371712 439->446 446->450 463 7ff7c037180f-7ff7c0371814 447->463 453 7ff7c0371802-7ff7c037180a call 7ff7c0384f30 448->453 454 7ff7c0371772-7ff7c0371777 448->454 450->433 453->463 456 7ff7c0371780-7ff7c03717a2 call 7ff7c038039c 454->456 464 7ff7c03717da-7ff7c03717e6 call 7ff7c0384f08 456->464 465 7ff7c03717a4-7ff7c03717bc call 7ff7c0380adc 456->465 463->450 470 7ff7c03717ed-7ff7c03717f8 call 7ff7c0372910 464->470 471 7ff7c03717be-7ff7c03717c1 465->471 472 7ff7c03717c5-7ff7c03717d8 call 7ff7c0384f08 465->472 476 7ff7c03717fd 470->476 471->456 473 7ff7c03717c3 471->473 472->470 473->476 476->453
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: CurrentProcess
                                                                                                                                                                                                                                                • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                                                • API String ID: 2050909247-1550345328
                                                                                                                                                                                                                                                • Opcode ID: 20e17bd6c553c2d1bb16f42c1bd2daa45422ba949397fd2f79efb246dcdc4b64
                                                                                                                                                                                                                                                • Instruction ID: d74e86651c9658f1a35e73544e7c2c134cf2795a8e9287f18b0046bda380fb1e
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 20e17bd6c553c2d1bb16f42c1bd2daa45422ba949397fd2f79efb246dcdc4b64
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F351A122B1864392EA14BF1996041A9A390BF46BB4FC4453EEE0C87796DF3CF55587A0
                                                                                                                                                                                                                                                Function 00007FF7C0378660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • GetTempPathW.KERNEL32(?,?,00000000,00007FF7C0373CBB), ref: 00007FF7C0378704
                                                                                                                                                                                                                                                • GetCurrentProcessId.KERNEL32(?,00000000,00007FF7C0373CBB), ref: 00007FF7C037870A
                                                                                                                                                                                                                                                • CreateDirectoryW.KERNELBASE(?,00000000,00007FF7C0373CBB), ref: 00007FF7C037874C
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0378830: GetEnvironmentVariableW.KERNEL32(00007FF7C037388E), ref: 00007FF7C0378867
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0378830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7C0378889
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0388238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0388251
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0372810: MessageBoxW.USER32 ref: 00007FF7C03728EA
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                                                                                                                                • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                                                                                                                                • API String ID: 3563477958-1339014028
                                                                                                                                                                                                                                                • Opcode ID: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
                                                                                                                                                                                                                                                • Instruction ID: 2b662fe044f3fc6eddd7939c2a38c82303faa53aa045fd73652f5719382b615f
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 15419221A1964254FA14BF6996592B99390AF867F0FC0413EDE0DC77DAEF3CF50183A0
                                                                                                                                                                                                                                                Function 00007FF7C0371210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                control_flow_graph 756 7ff7c0371210-7ff7c037126d call 7ff7c037bd80 759 7ff7c0371297-7ff7c03712af call 7ff7c0384f44 756->759 760 7ff7c037126f-7ff7c0371296 call 7ff7c0372710 756->760 765 7ff7c03712d4-7ff7c03712e4 call 7ff7c0384f44 759->765 766 7ff7c03712b1-7ff7c03712cf call 7ff7c0384f08 call 7ff7c0372910 759->766 772 7ff7c0371309-7ff7c037131b 765->772 773 7ff7c03712e6-7ff7c0371304 call 7ff7c0384f08 call 7ff7c0372910 765->773 778 7ff7c0371439-7ff7c037144e call 7ff7c037ba60 call 7ff7c0384f30 * 2 766->778 774 7ff7c0371320-7ff7c0371345 call 7ff7c038039c 772->774 773->778 784 7ff7c037134b-7ff7c0371355 call 7ff7c0380110 774->784 785 7ff7c0371431 774->785 793 7ff7c0371453-7ff7c037146d 778->793 784->785 792 7ff7c037135b-7ff7c0371367 784->792 785->778 794 7ff7c0371370-7ff7c0371398 call 7ff7c037a1c0 792->794 797 7ff7c037139a-7ff7c037139d 794->797 798 7ff7c0371416-7ff7c037142c call 7ff7c0372710 794->798 799 7ff7c0371411 797->799 800 7ff7c037139f-7ff7c03713a9 797->800 798->785 799->798 802 7ff7c03713ab-7ff7c03713b9 call 7ff7c0380adc 800->802 803 7ff7c03713d4-7ff7c03713d7 800->803 809 7ff7c03713be-7ff7c03713c1 802->809 804 7ff7c03713d9-7ff7c03713e7 call 7ff7c0399e30 803->804 805 7ff7c03713ea-7ff7c03713ef 803->805 804->805 805->794 808 7ff7c03713f5-7ff7c03713f8 805->808 813 7ff7c037140c-7ff7c037140f 808->813 814 7ff7c03713fa-7ff7c03713fd 808->814 810 7ff7c03713c3-7ff7c03713cd call 7ff7c0380110 809->810 811 7ff7c03713cf-7ff7c03713d2 809->811 810->805 810->811 811->798 813->785 814->798 816 7ff7c03713ff-7ff7c0371407 814->816 816->774
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: CurrentProcess
                                                                                                                                                                                                                                                • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                                                • API String ID: 2050909247-2813020118
                                                                                                                                                                                                                                                • Opcode ID: ef842027a1d970694cc0f789b50cc720652ec9763b74026d17365e7fd9a410f4
                                                                                                                                                                                                                                                • Instruction ID: 0ec42ebe78128160ad5f259dc519219f1a8ee7989902a985a9de45c504829daa
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ef842027a1d970694cc0f789b50cc720652ec9763b74026d17365e7fd9a410f4
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1951B522A0864245E660BF1AA5443BAA291FF86BA4FC4423DEE4DC77D5EF3CF505C790
                                                                                                                                                                                                                                                Function 00007FF7C038ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • FreeLibrary.KERNEL32(?,?,?,00007FF7C038F0AA,?,?,-00000018,00007FF7C038AD53,?,?,?,00007FF7C038AC4A,?,?,?,00007FF7C0385F3E), ref: 00007FF7C038EE8C
                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,?,?,00007FF7C038F0AA,?,?,-00000018,00007FF7C038AD53,?,?,?,00007FF7C038AC4A,?,?,?,00007FF7C0385F3E), ref: 00007FF7C038EE98
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                                                • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                                • API String ID: 3013587201-537541572
                                                                                                                                                                                                                                                • Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
                                                                                                                                                                                                                                                • Instruction ID: 55b1e4e9ccf4d9d70b4b228e48810b8544534068c0c40c8f23a7960c86888ad9
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: DC41E222B19A1281FA15EF169904675A291BF49BB0FC8463EDD1DCB7C4EF3CF44983A0
                                                                                                                                                                                                                                                Function 00007FF7C03736B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(?,00007FF7C0373804), ref: 00007FF7C03736E1
                                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,00007FF7C0373804), ref: 00007FF7C03736EB
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0372C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7C0373706,?,00007FF7C0373804), ref: 00007FF7C0372C9E
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0372C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7C0373706,?,00007FF7C0373804), ref: 00007FF7C0372D63
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0372C50: MessageBoxW.USER32 ref: 00007FF7C0372D99
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
                                                                                                                                                                                                                                                • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                                                                • API String ID: 3187769757-2863816727
                                                                                                                                                                                                                                                • Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                                                                • Instruction ID: 4c2c0d7321d214b6fc621f90120bf08cd7085589a0a9544ed6dec71f25902bc4
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 902182A1B1C64251FA24BF29E9583B6A250BF85364FC0423ED65DC67D5EF2CF104C7A0
                                                                                                                                                                                                                                                Function 00007FF7C038BA5C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                control_flow_graph 901 7ff7c038ba5c-7ff7c038ba82 902 7ff7c038ba84-7ff7c038ba98 call 7ff7c0384ee8 call 7ff7c0384f08 901->902 903 7ff7c038ba9d-7ff7c038baa1 901->903 921 7ff7c038be8e 902->921 905 7ff7c038be77-7ff7c038be83 call 7ff7c0384ee8 call 7ff7c0384f08 903->905 906 7ff7c038baa7-7ff7c038baae 903->906 923 7ff7c038be89 call 7ff7c038a8e0 905->923 906->905 908 7ff7c038bab4-7ff7c038bae2 906->908 908->905 912 7ff7c038bae8-7ff7c038baef 908->912 913 7ff7c038baf1-7ff7c038bb03 call 7ff7c0384ee8 call 7ff7c0384f08 912->913 914 7ff7c038bb08-7ff7c038bb0b 912->914 913->923 919 7ff7c038bb11-7ff7c038bb17 914->919 920 7ff7c038be73-7ff7c038be75 914->920 919->920 925 7ff7c038bb1d-7ff7c038bb20 919->925 924 7ff7c038be91-7ff7c038bea8 920->924 921->924 923->921 925->913 928 7ff7c038bb22-7ff7c038bb47 925->928 930 7ff7c038bb49-7ff7c038bb4b 928->930 931 7ff7c038bb7a-7ff7c038bb81 928->931 934 7ff7c038bb72-7ff7c038bb78 930->934 935 7ff7c038bb4d-7ff7c038bb54 930->935 932 7ff7c038bb83-7ff7c038bbab call 7ff7c038d5fc call 7ff7c038a948 * 2 931->932 933 7ff7c038bb56-7ff7c038bb6d call 7ff7c0384ee8 call 7ff7c0384f08 call 7ff7c038a8e0 931->933 964 7ff7c038bbc8-7ff7c038bbf3 call 7ff7c038c284 932->964 965 7ff7c038bbad-7ff7c038bbc3 call 7ff7c0384f08 call 7ff7c0384ee8 932->965 962 7ff7c038bd00 933->962 936 7ff7c038bbf8-7ff7c038bc0f 934->936 935->933 935->934 939 7ff7c038bc11-7ff7c038bc19 936->939 940 7ff7c038bc8a-7ff7c038bc94 call 7ff7c039391c 936->940 939->940 943 7ff7c038bc1b-7ff7c038bc1d 939->943 951 7ff7c038bc9a-7ff7c038bcaf 940->951 952 7ff7c038bd1e 940->952 943->940 947 7ff7c038bc1f-7ff7c038bc35 943->947 947->940 954 7ff7c038bc37-7ff7c038bc43 947->954 951->952 956 7ff7c038bcb1-7ff7c038bcc3 GetConsoleMode 951->956 960 7ff7c038bd23-7ff7c038bd43 ReadFile 952->960 954->940 958 7ff7c038bc45-7ff7c038bc47 954->958 956->952 961 7ff7c038bcc5-7ff7c038bccd 956->961 958->940 963 7ff7c038bc49-7ff7c038bc61 958->963 966 7ff7c038bd49-7ff7c038bd51 960->966 967 7ff7c038be3d-7ff7c038be46 GetLastError 960->967 961->960 969 7ff7c038bccf-7ff7c038bcf1 ReadConsoleW 961->969 972 7ff7c038bd03-7ff7c038bd0d call 7ff7c038a948 962->972 963->940 973 7ff7c038bc63-7ff7c038bc6f 963->973 964->936 965->962 966->967 975 7ff7c038bd57 966->975 970 7ff7c038be63-7ff7c038be66 967->970 971 7ff7c038be48-7ff7c038be5e call 7ff7c0384f08 call 7ff7c0384ee8 967->971 978 7ff7c038bd12-7ff7c038bd1c 969->978 979 7ff7c038bcf3 GetLastError 969->979 983 7ff7c038bcf9-7ff7c038bcfb call 7ff7c0384e7c 970->983 984 7ff7c038be6c-7ff7c038be6e 970->984 971->962 972->924 973->940 982 7ff7c038bc71-7ff7c038bc73 973->982 976 7ff7c038bd5e-7ff7c038bd73 975->976 976->972 986 7ff7c038bd75-7ff7c038bd80 976->986 978->976 979->983 982->940 990 7ff7c038bc75-7ff7c038bc85 982->990 983->962 984->972 992 7ff7c038bd82-7ff7c038bd9b call 7ff7c038b674 986->992 993 7ff7c038bda7-7ff7c038bdaf 986->993 990->940 1001 7ff7c038bda0-7ff7c038bda2 992->1001 997 7ff7c038bdb1-7ff7c038bdc3 993->997 998 7ff7c038be2b-7ff7c038be38 call 7ff7c038b4b4 993->998 1002 7ff7c038bdc5 997->1002 1003 7ff7c038be1e-7ff7c038be26 997->1003 998->1001 1001->972 1005 7ff7c038bdca-7ff7c038bdd1 1002->1005 1003->972 1006 7ff7c038bdd3-7ff7c038bdd7 1005->1006 1007 7ff7c038be0d-7ff7c038be18 1005->1007 1008 7ff7c038bdf3 1006->1008 1009 7ff7c038bdd9-7ff7c038bde0 1006->1009 1007->1003 1011 7ff7c038bdf9-7ff7c038be09 1008->1011 1009->1008 1010 7ff7c038bde2-7ff7c038bde6 1009->1010 1010->1008 1012 7ff7c038bde8-7ff7c038bdf1 1010->1012 1011->1005 1013 7ff7c038be0b 1011->1013 1012->1011 1013->1003
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 3215553584-0
                                                                                                                                                                                                                                                • Opcode ID: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
                                                                                                                                                                                                                                                • Instruction ID: cc8322f74432ea6e43307126f84683d15a5f5942e9aabd779c1838bd06d40b1c
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: FDC1A42290C68792E761AF1594402BDBB54FB81BA0FD5427EEA4D83791CF7CF445CBA0
                                                                                                                                                                                                                                                Function 00007FF7C0378570 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 995526605-0
                                                                                                                                                                                                                                                • Opcode ID: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
                                                                                                                                                                                                                                                • Instruction ID: fc16d1fe377aa7c77207fac39f2d3bcfc3696bbb68d4a08bde3bb7cbb9e6b7d2
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4E212531A0C64241EB50AF59B65422AE3A0EF857B0F90023DEA6D83BD4DF7CE4458B50
                                                                                                                                                                                                                                                Function 00007FF7C03790E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0378570: GetCurrentProcess.KERNEL32 ref: 00007FF7C0378590
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0378570: OpenProcessToken.ADVAPI32 ref: 00007FF7C03785A3
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0378570: GetTokenInformation.KERNELBASE ref: 00007FF7C03785C8
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0378570: GetLastError.KERNEL32 ref: 00007FF7C03785D2
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0378570: GetTokenInformation.KERNELBASE ref: 00007FF7C0378612
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0378570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7C037862E
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0378570: CloseHandle.KERNEL32 ref: 00007FF7C0378646
                                                                                                                                                                                                                                                • LocalFree.KERNEL32(?,00007FF7C0373C55), ref: 00007FF7C037916C
                                                                                                                                                                                                                                                • LocalFree.KERNEL32(?,00007FF7C0373C55), ref: 00007FF7C0379175
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                                • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                                                                                                                                • API String ID: 6828938-1529539262
                                                                                                                                                                                                                                                • Opcode ID: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
                                                                                                                                                                                                                                                • Instruction ID: a7ef8f43500d0151ec4cf888378217cff993366872ef00642384ae283d7444b2
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B7214F21A1864241E610BF15EA192EAA261EF857A0FC5413EEA4D83796DF3CF80587E0
                                                                                                                                                                                                                                                Function 00007FF7C0377E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • CreateDirectoryW.KERNELBASE(00000000,?,00007FF7C037352C,?,00000000,00007FF7C0373F23), ref: 00007FF7C0377F32
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: CreateDirectory
                                                                                                                                                                                                                                                • String ID: %.*s$%s%c$\
                                                                                                                                                                                                                                                • API String ID: 4241100979-1685191245
                                                                                                                                                                                                                                                • Opcode ID: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
                                                                                                                                                                                                                                                • Instruction ID: 2f69c3ea33ebc8692950a9f3ab9a4d0d0afc1972a713d8493ec4507c20dbc302
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: D131D821619AC145FB21AF15E5183AAA354EB85BF4F80023DEA6D877C5DF3CF6018790
                                                                                                                                                                                                                                                Function 00007FF7C038CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C038CF4B), ref: 00007FF7C038D07C
                                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C038CF4B), ref: 00007FF7C038D107
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 953036326-0
                                                                                                                                                                                                                                                • Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
                                                                                                                                                                                                                                                • Instruction ID: 39b7fb510d1591a380612531c4ccde43394d7d7a8e003fdca088b493a09e938f
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A7910872E1865185FB51AF65944027DABA0BF40BA8F94427EDE0E97B84CF3CF442C7A0
                                                                                                                                                                                                                                                Function 00007FF7C038F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 4170891091-0
                                                                                                                                                                                                                                                • Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
                                                                                                                                                                                                                                                • Instruction ID: 932d8862fcfa8c08ab36794e5bbc5062e7516e9364b48c25d03da3253fe1cc95
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4A51D672F042218AEB14EF64DD556BCA765AB44378F90037EDD1E92BE5DB3CB4028790
                                                                                                                                                                                                                                                Function 00007FF7C038577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 2780335769-0
                                                                                                                                                                                                                                                • Opcode ID: 6aefb500db5e0848cb3e1a230f039049599ff649377a7022c72adab745f1037c
                                                                                                                                                                                                                                                • Instruction ID: a2c44bef897ff27ff7bb205a659bbc0cd591e8719aec6788deddf4b9ddd07c3d
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6aefb500db5e0848cb3e1a230f039049599ff649377a7022c72adab745f1037c
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3A518F22F186418AFB10EF71D4503BDB7A1AB48B68F90463EDE0D87789DF38E44087A0
                                                                                                                                                                                                                                                Function 00007FF7C0385628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 1279662727-0
                                                                                                                                                                                                                                                • Opcode ID: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
                                                                                                                                                                                                                                                • Instruction ID: d916bd9f0bbf2ada435bbac0d70f0293760f84e4d091be4e2373f6d399cfcb27
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: CC418322D1878183E750AF209510369A760FB947B8F90937EE65C83BD1EF7CB5E087A0
                                                                                                                                                                                                                                                Function 00007FF7C037CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 3251591375-0
                                                                                                                                                                                                                                                • Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                                                                • Instruction ID: 850545c8e3d4ab25771f95e8bb1a5a358a299b81596156b5f99a2f1baf2dd684
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 39313A21E2810741FA65BF6996293B99291AF827A4FC5413DDA0EC73D3DF2CB80583F0
                                                                                                                                                                                                                                                Function 00007FF7C0389A30 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 1703294689-0
                                                                                                                                                                                                                                                • Opcode ID: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
                                                                                                                                                                                                                                                • Instruction ID: 8f743153bc6be4d88e8c3f91e23e66652bf9d48cb291981867852a1acbd8f2e3
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 73D09214B2870642EB187F705DA907892656F88B21F9825BEC80F96393EF2CB84947A0
                                                                                                                                                                                                                                                Function 00007FF7C038013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 3215553584-0
                                                                                                                                                                                                                                                • Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                                                                                                                                • Instruction ID: 294a788fe149b768eb53f7abd05619cfa80bfbb6d3bfb586defe8fb5959ef1af
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F9511625B0964186FBA8BE25940467AE290AF84BB4F98477EDD6D837C5CF7CF40087A0
                                                                                                                                                                                                                                                Function 00007FF7C038C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 2976181284-0
                                                                                                                                                                                                                                                • Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                                                                • Instruction ID: 307903fa4e3a6329a441073c89306cdde3cc74ad8a414fe3feb3adf5c6af2bd0
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3011C861618A4181DA109F15A854169F361BB85FF4F94433EEE7D877D9CF3CE0118780
                                                                                                                                                                                                                                                Function 00007FF7C0385924 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C0385839), ref: 00007FF7C0385957
                                                                                                                                                                                                                                                • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C0385839), ref: 00007FF7C038596D
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 1707611234-0
                                                                                                                                                                                                                                                • Opcode ID: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
                                                                                                                                                                                                                                                • Instruction ID: e0e2209a4563e23fe8f7bb5f18838bf87ddcab0d43d9f93a910ea00698ae14dc
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 01118F2260C612C2EA54AF15A45103AF760EB857B5FA0037EF699C1AD8EF6CE014DB60
                                                                                                                                                                                                                                                Function 00007FF7C038A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • RtlFreeHeap.NTDLL(?,?,?,00007FF7C0392D22,?,?,?,00007FF7C0392D5F,?,?,00000000,00007FF7C0393225,?,?,?,00007FF7C0393157), ref: 00007FF7C038A95E
                                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,00007FF7C0392D22,?,?,?,00007FF7C0392D5F,?,?,00000000,00007FF7C0393225,?,?,?,00007FF7C0393157), ref: 00007FF7C038A968
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 485612231-0
                                                                                                                                                                                                                                                • Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
                                                                                                                                                                                                                                                • Instruction ID: d4a40592446a43f215f1da0fb6012eceec6faa834f958a03bcb44524d3d876cd
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 26E04610E1D60682FF09BFB2A88513992906F88B60FC4027EC90DC63A1EF2C788187B0
                                                                                                                                                                                                                                                Function 00007FF7C038AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • CloseHandle.KERNELBASE(?,?,?,00007FF7C038A9D5,?,?,00000000,00007FF7C038AA8A), ref: 00007FF7C038ABC6
                                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,00007FF7C038A9D5,?,?,00000000,00007FF7C038AA8A), ref: 00007FF7C038ABD0
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 918212764-0
                                                                                                                                                                                                                                                • Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                                                                • Instruction ID: f1911fdb664f30210f1144899761859e163fb294ca1254b8cced49fd661869c4
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A321C611B18B8241FA91BF519450379A2929F847B4F9843BEEE2EC77D1DF6CF44183A0
                                                                                                                                                                                                                                                Function 00007FF7C038BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 3215553584-0
                                                                                                                                                                                                                                                • Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
                                                                                                                                                                                                                                                • Instruction ID: fe60ff4bc816d23a4bafb00b861297ab9ade6eb84ce5f4fd33e17ad05adb55d3
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9A41853291864687EA24AF19A540279B7A0EB557A1F94037ED78EC37D1CF6CF402CFA1
                                                                                                                                                                                                                                                Function 00007FF7C0377F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _fread_nolock
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 840049012-0
                                                                                                                                                                                                                                                • Opcode ID: aaa7b9ff11bb4346a21cc87fb8eff4a238e48d36b47c5124ab7cd44ae98a1b97
                                                                                                                                                                                                                                                • Instruction ID: d8550a2b73b7741b5142ddb2083c0fc04e021ab77eb7e9e5cb08e1ea560db823
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: aaa7b9ff11bb4346a21cc87fb8eff4a238e48d36b47c5124ab7cd44ae98a1b97
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: E221A221B5865156EA50BF2666083BAD641BF46BE4FC8443DEE0C87786DF7DF04AC390
                                                                                                                                                                                                                                                Function 00007FF7C038B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 3215553584-0
                                                                                                                                                                                                                                                • Opcode ID: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
                                                                                                                                                                                                                                                • Instruction ID: 31f9a20844f537fb1fa129b16c362e66b8b84ecf699518fcc3d97d56490027b7
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 89314D22A1860286E7117F55884137CAA90AB80BB4FD103BEEA1D877D2CF7CB441CBB5
                                                                                                                                                                                                                                                Function 00007FF7C0389961 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 3947729631-0
                                                                                                                                                                                                                                                • Opcode ID: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
                                                                                                                                                                                                                                                • Instruction ID: 0cacc0a439f78b4089ad710d6b7db4a30e42b241ef1b2c832a0df8afa8ecea01
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6A216D72A1474689EB24AF64C4802AC73A0EB44728F88467FD75D86BD5DF38E544C790
                                                                                                                                                                                                                                                Function 00007FF7C0385F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 3215553584-0
                                                                                                                                                                                                                                                • Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                                • Instruction ID: e086d744520b8af479a1ebc0abf782e0e64667e774aa8882d09a587a5467f1f8
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 47115721A1C64181EA60BF1194001BDE664AF85BA8FC4467FEB4CD7B95CF3DF54087B0
                                                                                                                                                                                                                                                Function 00007FF7C0396354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 3215553584-0
                                                                                                                                                                                                                                                • Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                                                                • Instruction ID: 68a31882d77d2ab769cc2adb47a37bfe648d276a32580d09d60660166b6aed4e
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 38218332718A4186EB61AF19D480379B6A0BB84B64F94423CEB5D877D5DF3CE4118B50
                                                                                                                                                                                                                                                Function 00007FF7C03803BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 3215553584-0
                                                                                                                                                                                                                                                • Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                                • Instruction ID: 32d9492c7c09f4e64677c64c9029aa4c206f5fa63d3bc0dcb8447c94b718043d
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9F018E21A4874580EA44AF639900069E691AF85FF0F89477EEE5C93BD6CF3CF4018760
                                                                                                                                                                                                                                                Function 00007FF7C038EB98 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • HeapAlloc.KERNEL32(?,?,00000000,00007FF7C038B32A,?,?,?,00007FF7C0384F11,?,?,?,?,00007FF7C038A48A), ref: 00007FF7C038EBED
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: AllocHeap
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 4292702814-0
                                                                                                                                                                                                                                                • Opcode ID: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
                                                                                                                                                                                                                                                • Instruction ID: 25a5faeeed9d1f9b34bba8eb03532ba95753bf626328ab59e181f6a68f84b765
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: E3F04954B0D21281FE5A7EA598512B492905F88BA0FCC467ECD0FCA3C1EF1CF88183B0
                                                                                                                                                                                                                                                Function 00007FF7C038D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • HeapAlloc.KERNEL32(?,?,?,00007FF7C0380C90,?,?,?,00007FF7C03822FA,?,?,?,?,?,00007FF7C0383AE9), ref: 00007FF7C038D63A
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: AllocHeap
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 4292702814-0
                                                                                                                                                                                                                                                • Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                                                                • Instruction ID: 02d623624230bd6b4f64cbeb72a72adcde21e377c0925f7ae92dcf9958e74a12
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B2F0DA50A1924A85FE567F71594167593915F847B0FC8077EDD2EC53C1EF2CB48087B0

                                                                                                                                                                                                                                                Non-executed Functions

                                                                                                                                                                                                                                                Function 00007FF7C03776C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                                • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                                                • API String ID: 199729137-3427451314
                                                                                                                                                                                                                                                • Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
                                                                                                                                                                                                                                                • Instruction ID: 7129e72c747f9a53fce79cb74b0f354d6cdf356600d389e65e498bf99d77286e
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3502C524A19B07D0FE15BF19AA59175A360AF45B7AFC0013DC82E82364EF3CB159C6F1
                                                                                                                                                                                                                                                Function 00007FF7C03940AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                                                                                                                                • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                                                                • API String ID: 808467561-2761157908
                                                                                                                                                                                                                                                • Opcode ID: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
                                                                                                                                                                                                                                                • Instruction ID: 041bcd8cec7c5ee2afa93e4cc19c20d627f616c3a71051b22ec2093c29f30f2d
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2CB2C272E182828BE7659F69D540BFDB7A1FB54398F80513DDA0D97B84DB38B900CB90
                                                                                                                                                                                                                                                Function 00007FF7C037ACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
                                                                                                                                                                                                                                                • API String ID: 0-2665694366
                                                                                                                                                                                                                                                • Opcode ID: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
                                                                                                                                                                                                                                                • Instruction ID: ee2b521304c54fd19a2b5f9d403443790bfca1c148f20f41c83dd53b1466a3dd
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 79520672A146A68BD7A49F18C55CB7E7BA9FB85350F41413DE64AC3780DB3CE844CB90
                                                                                                                                                                                                                                                Function 00007FF7C037D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 3140674995-0
                                                                                                                                                                                                                                                • Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
                                                                                                                                                                                                                                                • Instruction ID: f7ff448288430b3a34b75892f92ec06bc3ebf6b00d94aa95a0f64692cf838e33
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 47316272618B8186EB60AF64E8443ED73B0FB85714F84443EDA4E87B94DF78E548C750
                                                                                                                                                                                                                                                Function 00007FF7C038A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 1239891234-0
                                                                                                                                                                                                                                                • Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
                                                                                                                                                                                                                                                • Instruction ID: 09f77f97bcd5144eaca548c982bdff35553a1d6d604c2cfe6a8d84b54f98a358
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4731CA32618F8185EB60DF25E8442AEB3A4FB85764F94013EEA8D83B54DF3CE145CB50
                                                                                                                                                                                                                                                Function 00007FF7C0391874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 2227656907-0
                                                                                                                                                                                                                                                • Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
                                                                                                                                                                                                                                                • Instruction ID: 5bd071a430ad2f818ba55e15a7f6b6eb64a34f9b4a3736c8211a89bb18ebfd77
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C6B1D522B1968641EA61BF2695101B9E391EB44FF4F84413EDA4DA7BC5EF3CF841C790
                                                                                                                                                                                                                                                Function 00007FF7C037D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 2933794660-0
                                                                                                                                                                                                                                                • Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
                                                                                                                                                                                                                                                • Instruction ID: 70ea791b863eedc65649e1996558730511449fc519a0379b8e18c0d284813744
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: D7115122B14F058AEB00DF61E8542B973B4F759768F440E39DA5D867A4DF7CE1548390
                                                                                                                                                                                                                                                Function 00007FF7C0393C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: memcpy_s
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 1502251526-0
                                                                                                                                                                                                                                                • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                                                • Instruction ID: 4864de6db00f601a3c936b220e76b635f6029f5441b81cb1a5e1605b6bfeeeb7
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: D0C1D5B2B1D68687E724DF19A044A6AF7A1F794B94F84813DDB4A87744DB3DF801CB80
                                                                                                                                                                                                                                                Function 00007FF7C037A474 Relevance: 4.1, Strings: 3, Instructions: 398COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                • String ID: $header crc mismatch$unknown header flags set
                                                                                                                                                                                                                                                • API String ID: 0-1127688429
                                                                                                                                                                                                                                                • Opcode ID: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
                                                                                                                                                                                                                                                • Instruction ID: 17e8041f271d7531d89592f0a743943744701466e032899df356cdb23dbcf7a2
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 25F18372A087D54AE7A5AF18C18CB3ABAA9EF86760F45453CDA49D7390CB38F440C790
                                                                                                                                                                                                                                                Function 00007FF7C0399728 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: ExceptionRaise_clrfp
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 15204871-0
                                                                                                                                                                                                                                                • Opcode ID: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
                                                                                                                                                                                                                                                • Instruction ID: e0b2c2cc508aeb33e5d5d483d1c0411be8742950f69b5834803daeba3c8c4ed5
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C7B18D73A04B898BEB15CF2DC84636C7BE0F744B58F15882ADA5D837A4CB39E451C750
                                                                                                                                                                                                                                                Function 00007FF7C03839A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                • String ID: $
                                                                                                                                                                                                                                                • API String ID: 0-227171996
                                                                                                                                                                                                                                                • Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
                                                                                                                                                                                                                                                • Instruction ID: 40ff68066030394c4df12564e5d707fd6a2d1512dc254d664887346765cc3826
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: ABE1B572A0C64286EB68AE25805013DB3A0FF45B68F94537FDA4E8B794DF2DF851C790
                                                                                                                                                                                                                                                Function 00007FF7C037A2DB Relevance: 2.7, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                • String ID: incorrect header check$invalid window size
                                                                                                                                                                                                                                                • API String ID: 0-900081337
                                                                                                                                                                                                                                                • Opcode ID: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
                                                                                                                                                                                                                                                • Instruction ID: e6a6c30ad0bac9735b81d8d1dabb3c499d70e44c361eebe6bd405a68dbf4cb93
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C191A472A186C687E7A49F18C54CB3EBAA9FB46360F51413DDB5AC6780CB38F540CB91
                                                                                                                                                                                                                                                Function 00007FF7C038DEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                • String ID: e+000$gfff
                                                                                                                                                                                                                                                • API String ID: 0-3030954782
                                                                                                                                                                                                                                                • Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
                                                                                                                                                                                                                                                • Instruction ID: 1367bee8e33ff9d01e57f3c1a652fca49fd92e291c326ae6fa6e711acbde0988
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 84516862B182C186E7259E369801769EB91E744BA4F88837EDB988BBC5CF7DE440C750
                                                                                                                                                                                                                                                Function 00007FF7C03908C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 1010374628-0
                                                                                                                                                                                                                                                • Opcode ID: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
                                                                                                                                                                                                                                                • Instruction ID: cb074af132471bb842cb2cc8797eb4da3b97f0b03a7e0ea1192084240cd764d7
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8B02BF22A1EB4649FA65BF159404279A680AF45BB4FC5463DEE6DC63D2DF3EF40083A0
                                                                                                                                                                                                                                                Function 00007FF7C038DA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                • String ID: gfffffff
                                                                                                                                                                                                                                                • API String ID: 0-1523873471
                                                                                                                                                                                                                                                • Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                                                                                                                                • Instruction ID: 8b06251df0ea0e92102b87866dd6882bd03a2efc17f4d0178b26fa2cca9e5feb
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F5A16762A087C986EF22DF25A0007ADBBA0EB50BA4F41827ADE4D87785DF3DE405C750
                                                                                                                                                                                                                                                Function 00007FF7C0388794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                • String ID: TMP
                                                                                                                                                                                                                                                • API String ID: 3215553584-3125297090
                                                                                                                                                                                                                                                • Opcode ID: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
                                                                                                                                                                                                                                                • Instruction ID: 5b0d23d0d16d88670e8e101f3667286d6eca4bd57b0abe55f5230f6576e4d929
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 09519911B0960641FA64BF26590117AD290AF85BF4FC946BEDE0ED7796EF3CF44283A0
                                                                                                                                                                                                                                                Function 00007FF7C0393480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: HeapProcess
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 54951025-0
                                                                                                                                                                                                                                                • Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
                                                                                                                                                                                                                                                • Instruction ID: ee8c822437a28b7d6e7f1c5c7e0dfedafbd3badb29770adac51167a36656ae94
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F9B09220E1BA02C2EA093F21AC8221862A4BF48720FD8053CC44C88330DF2C34E55B60
                                                                                                                                                                                                                                                Function 00007FF7C03835A0 Relevance: .3, Instructions: 327COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                • Opcode ID: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
                                                                                                                                                                                                                                                • Instruction ID: 65e6955bf716f3774149bdcd5635d434f688a50921bef9ee9f42d836a13ad273
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 24D1E862A0C64285EB68AE29805027DA790FF45B68F94037EDE0D8B7D5DF3DF845C7A0
                                                                                                                                                                                                                                                Function 00007FF7C0379800 Relevance: .3, Instructions: 287COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                • Opcode ID: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
                                                                                                                                                                                                                                                • Instruction ID: 78ae460ddbd2c320518156e5bf433e1a58d4199f04fbef8387f65a4eff097823
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A3C19D762181E08BD28AEB29E46947A73E1F78A30DBD5406FEF8747785C73CA414DB60
                                                                                                                                                                                                                                                Function 00007FF7C0382C10 Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                • Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
                                                                                                                                                                                                                                                • Instruction ID: d1507e9f4dcf6e9bd7789fc27f230083084097675a20ffc9a5d53cdc622b8eb9
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 93B1607290874585EB659F29C05013CBBB0E749B68FA5427ECB4E87396CF39F441C7A8
                                                                                                                                                                                                                                                Function 00007FF7C038E570 Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                • Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
                                                                                                                                                                                                                                                • Instruction ID: 69d2d2daf35006a4ace1eca633706b790dcc779c510df1d889f42b0f1819a12e
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3D81F472A0C78146EB74DF19944036AAA91FB957A4F90437EDA8D8BBC9DF3CF4008B50
                                                                                                                                                                                                                                                Function 00007FF7C0396418 Relevance: .2, Instructions: 183COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 3215553584-0
                                                                                                                                                                                                                                                • Opcode ID: 403f67b08c5d8b9127b9d27d37b93e2a1e0a746a19683c5483168a42cc689f1f
                                                                                                                                                                                                                                                • Instruction ID: e104f862e1790b7d03a702df835b03c10c93bb12c0beb750449cbcf76b561ead
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 403f67b08c5d8b9127b9d27d37b93e2a1e0a746a19683c5483168a42cc689f1f
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8D610332F1A29246FB64BE69941063DE688AF41774F95023EDA1DC2BC5DF7DF80087A0
                                                                                                                                                                                                                                                Function 00007FF7C0382164 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                • Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                                                                • Instruction ID: 148a5db5c6819ffb87cf06a4b67bb7259e05f627f78707c8f01187661330b9d0
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C951B236A1865186E7649F29C454238B3A0EB54B78F74427ECF4C87796CB3AF843C794
                                                                                                                                                                                                                                                Function 00007FF7C0381944 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                • Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                                                                • Instruction ID: 4dcae122b39da9226ec86a4e2a0dbddb1d99994221dafab7b6808a5668bfc9ba
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: EF519036A1965186E7249F29C050238B7A4EB45F78F64427ECE8D977A4CB3AF843C7D0
                                                                                                                                                                                                                                                Function 00007FF7C0381D54 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                • Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                                                                • Instruction ID: d03a054cd98affa986bb6fe29ee8b63f7595a8ff41cc88ddbbb4682a34cc178c
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 21517D76A18A5182E7249F29C040338B3A4EB45F78F64437EDE4D87794CB3AF852C790
                                                                                                                                                                                                                                                Function 00007FF7C0381B50 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                • Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                                                                • Instruction ID: 98dc3287bcf2b66777430394f59922daad96c22dfa605fc738e9e9291cca6991
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: BF51B176A1865182E7259F29C040338A7A4EB44F68FA4427ECE4D97794DB3AF842C790
                                                                                                                                                                                                                                                Function 00007FF7C0381F60 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                • Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                                                                • Instruction ID: b73b1f81629b9d21c3bcc79c1a50d580620c47187bfa9420ff44f09389d405f3
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: FA51A476A1865186E7249F29C044238A7A1EB44F68F64427ECF4C97796CB3AF843C794
                                                                                                                                                                                                                                                Function 00007FF7C0381740 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                • Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                                                                • Instruction ID: 8dbc72ec649471017aa7572d0b92f9ab9be197054404fa925308802bc60e2a49
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7651BF36A1865186E7249F29C040639B7A5EB44F68FA4427EDE4C97798CF3AF843C7D0
                                                                                                                                                                                                                                                Function 00007FF7C0385D30 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                                                • Instruction ID: fe4d22a8fcab45c1c24f95b03cc180afe4805a3c9720afc614731b43a6eb6b36
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2D41C86280E78A05E9999D1809086B4AA809F127B8DD853FEDD9DD73C3CF0D7A4AC371
                                                                                                                                                                                                                                                Function 00007FF7C0389EA0 Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 485612231-0
                                                                                                                                                                                                                                                • Opcode ID: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
                                                                                                                                                                                                                                                • Instruction ID: 573d78e5f5e787936baf24772d0d52d638022f16157ebe19331204dab82c3eed
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: EF41D363714A5582EF08DF6AD924169B3A1BB48FE0B89913BEE0DD7B54DF3DE0428340
                                                                                                                                                                                                                                                Function 00007FF7C03880E4 Relevance: .1, Instructions: 98COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                • Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
                                                                                                                                                                                                                                                • Instruction ID: a20c6cc4516288bfef4c0492ed5355a87812f0d0c7361549bd0d46441065f731
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: DB31B232B09B4241E764AF25684012EAAD5AB84BF0F94423DEE5D93BD6DF3CE0028754
                                                                                                                                                                                                                                                Function 00007FF7C0399570 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                • Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
                                                                                                                                                                                                                                                • Instruction ID: 6b95853edc4facb9074026c71d133efc9600ccd7475b40908dd9e1f8f20e0fff
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C7F044717182A58ADB989F69A40262A77D0F708394FC4803DD58DC7B04DB3C90518F54
                                                                                                                                                                                                                                                Function 00007FF7C037D30C Relevance: .0, Instructions: 2COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                • Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
                                                                                                                                                                                                                                                • Instruction ID: a48d1668029dfc6eb40f18b1ccdb53df04fb20f85ea456a3569adb42f380575a
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 86A00225D1CC0AD0FA45BF04EA94035A370FB55720BC0043EE04DE52B49F3CB404D7A1
                                                                                                                                                                                                                                                Function 00007FF7C0375830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,00007FF7C03764CF,?,00007FF7C037336E), ref: 00007FF7C0375840
                                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,00007FF7C03764CF,?,00007FF7C037336E), ref: 00007FF7C0375852
                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,00007FF7C03764CF,?,00007FF7C037336E), ref: 00007FF7C0375889
                                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,00007FF7C03764CF,?,00007FF7C037336E), ref: 00007FF7C037589B
                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,00007FF7C03764CF,?,00007FF7C037336E), ref: 00007FF7C03758B4
                                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,00007FF7C03764CF,?,00007FF7C037336E), ref: 00007FF7C03758C6
                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,00007FF7C03764CF,?,00007FF7C037336E), ref: 00007FF7C03758DF
                                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,00007FF7C03764CF,?,00007FF7C037336E), ref: 00007FF7C03758F1
                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,00007FF7C03764CF,?,00007FF7C037336E), ref: 00007FF7C037590D
                                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,00007FF7C03764CF,?,00007FF7C037336E), ref: 00007FF7C037591F
                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,00007FF7C03764CF,?,00007FF7C037336E), ref: 00007FF7C037593B
                                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,00007FF7C03764CF,?,00007FF7C037336E), ref: 00007FF7C037594D
                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,00007FF7C03764CF,?,00007FF7C037336E), ref: 00007FF7C0375969
                                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,00007FF7C03764CF,?,00007FF7C037336E), ref: 00007FF7C037597B
                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,00007FF7C03764CF,?,00007FF7C037336E), ref: 00007FF7C0375997
                                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,00007FF7C03764CF,?,00007FF7C037336E), ref: 00007FF7C03759A9
                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,00007FF7C03764CF,?,00007FF7C037336E), ref: 00007FF7C03759C5
                                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,00007FF7C03764CF,?,00007FF7C037336E), ref: 00007FF7C03759D7
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                                • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                                                                • API String ID: 199729137-653951865
                                                                                                                                                                                                                                                • Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
                                                                                                                                                                                                                                                • Instruction ID: a126493ae537a613462850dddf223cb20ea7adbd8c2e4d67faec0291365f0eb5
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: CA22C960A1DB0792FA19BF55AA145B5A3A0AF45BB4FC4103DC81E82360FF7CB559C6F0
                                                                                                                                                                                                                                                Function 00007FF7C03781D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0379390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7C03745F4,00000000,00007FF7C0371985), ref: 00007FF7C03793C9
                                                                                                                                                                                                                                                • ExpandEnvironmentStringsW.KERNEL32(?,00007FF7C03786B7,?,?,00000000,00007FF7C0373CBB), ref: 00007FF7C037822C
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0372810: MessageBoxW.USER32 ref: 00007FF7C03728EA
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                                                                • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                                                                                                                                • API String ID: 1662231829-930877121
                                                                                                                                                                                                                                                • Opcode ID: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
                                                                                                                                                                                                                                                • Instruction ID: 3e0c53a5392c5cc9c6a4db66185cf050ca9e2d95e0f15f7f9baa454fbf4a0eaf
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7551C425A2C64241FA11BF29DA592BAE250EF857A0FC4043EDA0EC27D5EF2CF00587E0
                                                                                                                                                                                                                                                Function 00007FF7C0372180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                                                • String ID: P%
                                                                                                                                                                                                                                                • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                                                • Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                                • Instruction ID: 3e5a1ec4db0742d15e45d63f0d9584e4866f379154a4aeddeb84e7a07c08a772
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3D510726614BA186D634AF26E4181BAF7A1F798B61F004129EFDE83795DF3CE045DB20
                                                                                                                                                                                                                                                Function 00007FF7C03780C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                                                                                                                                                                                                • String ID: Needs to remove its temporary files.
                                                                                                                                                                                                                                                • API String ID: 3975851968-2863640275
                                                                                                                                                                                                                                                • Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
                                                                                                                                                                                                                                                • Instruction ID: 24a48ea8375a31f2d5ff1b1279336ae5f536a236f8ef85c2c8405780dd9a83fc
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1D219621B18A4282EB41AF7EAA58179A250EF85FB0FC8413DDE1DC3395DF2CF5518661
                                                                                                                                                                                                                                                Function 00007FF7C0386290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                • String ID: -$:$f$p$p
                                                                                                                                                                                                                                                • API String ID: 3215553584-2013873522
                                                                                                                                                                                                                                                • Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                                • Instruction ID: d49b7e4856e299e8322dde9416bcec045193c06c472ac1d1beb2807328966238
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C8128F61F0C28386FB206E15D154679F699EB40764FC442BFE69A86BC4DF3CF5808BA0
                                                                                                                                                                                                                                                Function 00007FF7C0380FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                • String ID: f$f$p$p$f
                                                                                                                                                                                                                                                • API String ID: 3215553584-1325933183
                                                                                                                                                                                                                                                • Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                                                • Instruction ID: 9ffee4e9ee640ae745ba3402409eb13d7ec13c2a4ae9352dfe8d197736196c89
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6F128566E1C14386FB606E15D044679F6A9FB80B60FD4427FD69A86BC4DB7CF4808BA0
                                                                                                                                                                                                                                                Function 00007FF7C0371050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: CurrentProcess
                                                                                                                                                                                                                                                • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                                • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                                • Opcode ID: b86492fec82845683ed30ee17fa4372ac3c9e67344e1de42683d38f875b626aa
                                                                                                                                                                                                                                                • Instruction ID: 66b7ded14fc34e36b7db7d4b77db2d0ff2e856e52bf6432d90602a1809b07ff8
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b86492fec82845683ed30ee17fa4372ac3c9e67344e1de42683d38f875b626aa
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 25418222A1865282EA10FF199A446B9E394FF46BE4FD4453EEE0C87785DF3CF50587A0
                                                                                                                                                                                                                                                Function 00007FF7C0371470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: CurrentProcess
                                                                                                                                                                                                                                                • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                                • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                                • Opcode ID: 0668517533cd0d68b5080e8717ca13fde84679c12f5f15204a3f6509b4669e23
                                                                                                                                                                                                                                                • Instruction ID: 5e14fefaa12733853478580ee38a7cce6f24786f88bc524161c7756d29cee415
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0668517533cd0d68b5080e8717ca13fde84679c12f5f15204a3f6509b4669e23
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: DE418322A1854285EB10EF2996441B9E390EF86BB4FC4453EEE4D87B95DF3CF501CBA4
                                                                                                                                                                                                                                                Function 00007FF7C037EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                                                • String ID: csm$csm$csm
                                                                                                                                                                                                                                                • API String ID: 849930591-393685449
                                                                                                                                                                                                                                                • Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
                                                                                                                                                                                                                                                • Instruction ID: 0cdaba1442fdefca617b3971ce9e3e2045d38963ee0e6973c8b74075e85e742d
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 73D172329087418AEB20AF69D5483ADB7A0FB4A7A8F90053DDE4D97B95DF38F450C790
                                                                                                                                                                                                                                                Function 00007FF7C0372C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7C0373706,?,00007FF7C0373804), ref: 00007FF7C0372C9E
                                                                                                                                                                                                                                                • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7C0373706,?,00007FF7C0373804), ref: 00007FF7C0372D63
                                                                                                                                                                                                                                                • MessageBoxW.USER32 ref: 00007FF7C0372D99
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: Message$CurrentFormatProcess
                                                                                                                                                                                                                                                • String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
                                                                                                                                                                                                                                                • API String ID: 3940978338-251083826
                                                                                                                                                                                                                                                • Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
                                                                                                                                                                                                                                                • Instruction ID: 614738b5dba7f8356fc5f589ab949fe46ee76480368be725847970cfaeaad973
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5431F832708A4142E720BF25B9146ABA695BF85BA8F81013EEF4DD3759DF3CE506C750
                                                                                                                                                                                                                                                Function 00007FF7C037DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • LoadLibraryExW.KERNEL32(?,?,?,00007FF7C037DF7A,?,?,?,00007FF7C037DC6C,?,?,?,00007FF7C037D869), ref: 00007FF7C037DD4D
                                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,00007FF7C037DF7A,?,?,?,00007FF7C037DC6C,?,?,?,00007FF7C037D869), ref: 00007FF7C037DD5B
                                                                                                                                                                                                                                                • LoadLibraryExW.KERNEL32(?,?,?,00007FF7C037DF7A,?,?,?,00007FF7C037DC6C,?,?,?,00007FF7C037D869), ref: 00007FF7C037DD85
                                                                                                                                                                                                                                                • FreeLibrary.KERNEL32(?,?,?,00007FF7C037DF7A,?,?,?,00007FF7C037DC6C,?,?,?,00007FF7C037D869), ref: 00007FF7C037DDF3
                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,?,?,00007FF7C037DF7A,?,?,?,00007FF7C037DC6C,?,?,?,00007FF7C037D869), ref: 00007FF7C037DDFF
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                                                • String ID: api-ms-
                                                                                                                                                                                                                                                • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                                                • Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
                                                                                                                                                                                                                                                • Instruction ID: 0b07134bae03bd65c6c3ddc239215a86b31ef13a276c896e12b0269e0d8341ba
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: BF318121B1A642D1EE22AF0A96046B5A3E4FF49BB4FD9453DDD1D86384EF3CF44487A0
                                                                                                                                                                                                                                                Function 00007FF7C0376360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: CurrentProcess
                                                                                                                                                                                                                                                • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                                                                                                                                • API String ID: 2050909247-2434346643
                                                                                                                                                                                                                                                • Opcode ID: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
                                                                                                                                                                                                                                                • Instruction ID: acb13be3b17e992d914242ebb6133cf15f9c423b9d001fc309a2e2822c046303
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7B418F21B18A8691EA15FF29E6182E9A355FB85364FC0013EDA5C83796EF3CF505C7E0
                                                                                                                                                                                                                                                Function 00007FF7C0372A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF7C037351A,?,00000000,00007FF7C0373F23), ref: 00007FF7C0372AA0
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: CurrentProcess
                                                                                                                                                                                                                                                • String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                                • API String ID: 2050909247-2900015858
                                                                                                                                                                                                                                                • Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
                                                                                                                                                                                                                                                • Instruction ID: d2af9e0523a017649448ffba559c6091b39c7b940887bf25ec26a89851869684
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: D621A332A1878142E720AF55B5457E6A394FB887A4F80013EEE8C93759DF7CE1458B90
                                                                                                                                                                                                                                                Function 00007FF7C038B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: Value$ErrorLast
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 2506987500-0
                                                                                                                                                                                                                                                • Opcode ID: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
                                                                                                                                                                                                                                                • Instruction ID: d7d3a8a8afc814dfb8415ad5fb7b3ccdd96c8864e95217e0cad5176089d0e66f
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B2217F20B0C65386F9647F619A65139E1425F447F0F84477ED83ECABC6DF2CB40087A1
                                                                                                                                                                                                                                                Function 00007FF7C0397D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                                                • String ID: CONOUT$
                                                                                                                                                                                                                                                • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                                                • Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
                                                                                                                                                                                                                                                • Instruction ID: e8eb518653d6b013a811cb066d3d3bcb7146ec3ff2e7da67c0f8f1f2abc63512
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 31117221A18A4186E750AF52B854329A2A0FB88BF4F44023CD95DC7794DF7CE5148790
                                                                                                                                                                                                                                                Function 00007FF7C0378ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF7C0373FB1), ref: 00007FF7C0378EFD
                                                                                                                                                                                                                                                • K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF7C0373FB1), ref: 00007FF7C0378F5A
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C0379390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7C03745F4,00000000,00007FF7C0371985), ref: 00007FF7C03793C9
                                                                                                                                                                                                                                                • K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF7C0373FB1), ref: 00007FF7C0378FE5
                                                                                                                                                                                                                                                • K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF7C0373FB1), ref: 00007FF7C0379044
                                                                                                                                                                                                                                                • FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF7C0373FB1), ref: 00007FF7C0379055
                                                                                                                                                                                                                                                • FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF7C0373FB1), ref: 00007FF7C037906A
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 3462794448-0
                                                                                                                                                                                                                                                • Opcode ID: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
                                                                                                                                                                                                                                                • Instruction ID: 1f60674bf5883fd8c1266dec84e8f8e3b3b45056df39552608c217f04c7b2deb
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4C41AC6162968181EA30AF16A6542BAB394FF86BE4F85023DDF4D97785DF3CF500C750
                                                                                                                                                                                                                                                Function 00007FF7C038B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,00007FF7C0384F11,?,?,?,?,00007FF7C038A48A,?,?,?,?,00007FF7C038718F), ref: 00007FF7C038B2D7
                                                                                                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF7C0384F11,?,?,?,?,00007FF7C038A48A,?,?,?,?,00007FF7C038718F), ref: 00007FF7C038B30D
                                                                                                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF7C0384F11,?,?,?,?,00007FF7C038A48A,?,?,?,?,00007FF7C038718F), ref: 00007FF7C038B33A
                                                                                                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF7C0384F11,?,?,?,?,00007FF7C038A48A,?,?,?,?,00007FF7C038718F), ref: 00007FF7C038B34B
                                                                                                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF7C0384F11,?,?,?,?,00007FF7C038A48A,?,?,?,?,00007FF7C038718F), ref: 00007FF7C038B35C
                                                                                                                                                                                                                                                • SetLastError.KERNEL32(?,?,?,00007FF7C0384F11,?,?,?,?,00007FF7C038A48A,?,?,?,?,00007FF7C038718F), ref: 00007FF7C038B377
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: Value$ErrorLast
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 2506987500-0
                                                                                                                                                                                                                                                • Opcode ID: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
                                                                                                                                                                                                                                                • Instruction ID: 3f6bab02c357ce392259ec42ea814dd0c287c36723385f4aca23a2625150a4a6
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 56114A24B0C75386FA587F619A9113DE2429F44BB0F84477EE82EC67D6DF6CB4018BA1
                                                                                                                                                                                                                                                Function 00007FF7C0372910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7C0371B6A), ref: 00007FF7C037295E
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: CurrentProcess
                                                                                                                                                                                                                                                • String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
                                                                                                                                                                                                                                                • API String ID: 2050909247-2962405886
                                                                                                                                                                                                                                                • Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
                                                                                                                                                                                                                                                • Instruction ID: 71dbab9b0e0840a5eef068dc8789805997199f109f1111aa5dc0a9cfd0751400
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: DB31E723B1868152E710BF69A9402E6A294BF857E4F80013EEE8DC3745EF7CE14687A0
                                                                                                                                                                                                                                                Function 00007FF7C0372390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                                                                • String ID: Unhandled exception in script
                                                                                                                                                                                                                                                • API String ID: 3081866767-2699770090
                                                                                                                                                                                                                                                • Opcode ID: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
                                                                                                                                                                                                                                                • Instruction ID: 7701449a9f9c364c9426b8476ef1c21089ceb1b015b5bf1e760778a19337952b
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7B31A732619A8285EB20FF61E9552F9A360FF897A4F84013DEA4D87B49DF3CE144C750
                                                                                                                                                                                                                                                Function 00007FF7C0372B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF7C037918F,?,00007FF7C0373C55), ref: 00007FF7C0372BA0
                                                                                                                                                                                                                                                • MessageBoxW.USER32 ref: 00007FF7C0372C2A
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: CurrentMessageProcess
                                                                                                                                                                                                                                                • String ID: WARNING$Warning$[PYI-%d:%ls]
                                                                                                                                                                                                                                                • API String ID: 1672936522-3797743490
                                                                                                                                                                                                                                                • Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
                                                                                                                                                                                                                                                • Instruction ID: f3d2a813a1c40ca9e70bb5dc21137511afba5323a2a6b3fcaa396d9647cca9d0
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3E21A162718B4152E710AF59F9447AAB3A4FB88790F80013EEE8D97756DF3CE245C790
                                                                                                                                                                                                                                                Function 00007FF7C0372710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF7C0371B99), ref: 00007FF7C0372760
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: CurrentProcess
                                                                                                                                                                                                                                                • String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                                • API String ID: 2050909247-1591803126
                                                                                                                                                                                                                                                • Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
                                                                                                                                                                                                                                                • Instruction ID: f6330b79ccfc2075e6a67662a4f8539ed2b6bec9ffa1e4b77270b8cbf12c1140
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9C219532A1878152E720EF55B5857E6A394FB887A4F80013EFE8C93759DF7CE1458790
                                                                                                                                                                                                                                                Function 00007FF7C0389A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                                • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                                • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                                • Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
                                                                                                                                                                                                                                                • Instruction ID: c7ec474150c8a5c7e9abcf4987853bb8e00fc51e59d87eb39e41b6a7dceaf44e
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C3F04F61B1960681EA14AF24A49537AA360AF45771F98023ED66E867E4DF2CF444C7A0
                                                                                                                                                                                                                                                Function 00007FF7C0399368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _set_statfp
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 1156100317-0
                                                                                                                                                                                                                                                • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                                • Instruction ID: 1551b3265fc61f64943046ade502d8c9066c64f126158ca5f5128a7f04b1bcae
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A611983AD5CA0341F6543D5EE4D13799250AF59370E84063EFA6ED67D6CF6C788141A0
                                                                                                                                                                                                                                                Function 00007FF7C038B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • FlsGetValue.KERNEL32(?,?,?,00007FF7C038A5A3,?,?,00000000,00007FF7C038A83E,?,?,?,?,?,00007FF7C038A7CA), ref: 00007FF7C038B3AF
                                                                                                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF7C038A5A3,?,?,00000000,00007FF7C038A83E,?,?,?,?,?,00007FF7C038A7CA), ref: 00007FF7C038B3CE
                                                                                                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF7C038A5A3,?,?,00000000,00007FF7C038A83E,?,?,?,?,?,00007FF7C038A7CA), ref: 00007FF7C038B3F6
                                                                                                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF7C038A5A3,?,?,00000000,00007FF7C038A83E,?,?,?,?,?,00007FF7C038A7CA), ref: 00007FF7C038B407
                                                                                                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF7C038A5A3,?,?,00000000,00007FF7C038A83E,?,?,?,?,?,00007FF7C038A7CA), ref: 00007FF7C038B418
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: Value
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 3702945584-0
                                                                                                                                                                                                                                                • Opcode ID: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
                                                                                                                                                                                                                                                • Instruction ID: 24086050554faf1a5c6f6bb874b8d00aa7d5e226aabde5bcb6fb9f0da58bca1d
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6F115C60B0C61345FA58BB669951139A1415F847B0FC843BEE82EC67C7DF2CB40287A1
                                                                                                                                                                                                                                                Function 00007FF7C038B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: Value
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 3702945584-0
                                                                                                                                                                                                                                                • Opcode ID: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
                                                                                                                                                                                                                                                • Instruction ID: e684fefcf4b70d4651308768c283f2bc85084341cc287e399842ba4f49ea4fc9
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6D110360A0920785F9687BA1885117AA1424F45370F984BBED93ECA7D3DF2CB45087B1
                                                                                                                                                                                                                                                Function 00007FF7C0385FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                • String ID: verbose
                                                                                                                                                                                                                                                • API String ID: 3215553584-579935070
                                                                                                                                                                                                                                                • Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                                • Instruction ID: cdbc0755fabd98290c7328d3abef6942a1e06adcc9007a879bea32316495a9ae
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: CC91DF22B08A4681E761AE24D45477DB6A9AB40B64FC443BFDA5E873C6DF3CF40583A1
                                                                                                                                                                                                                                                Function 00007FF7C038FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                                                • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                                                • Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
                                                                                                                                                                                                                                                • Instruction ID: 92a0d99f90b5a2b91daafbb32dbaa90b621e3770f95154279654e31e0e23e499
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: AF81C472E082638DF7647F258940278B6A0AB11B64FD542BFCB09D7399CF2DF90583A1
                                                                                                                                                                                                                                                Function 00007FF7C037D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                                                • String ID: csm
                                                                                                                                                                                                                                                • API String ID: 2395640692-1018135373
                                                                                                                                                                                                                                                • Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
                                                                                                                                                                                                                                                • Instruction ID: dc0d24fb653ffb2019a5749bdbf84b09705ecec10d725143d4937afc86d2c159
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: CF51A132A196428ADF19AF19D548A38B3E1FB45BA8F90413DDA4D87744DF7CF841C790
                                                                                                                                                                                                                                                Function 00007FF7C037F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                                                                • String ID: csm$csm
                                                                                                                                                                                                                                                • API String ID: 3896166516-3733052814
                                                                                                                                                                                                                                                • Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
                                                                                                                                                                                                                                                • Instruction ID: caf1000a975e6c8ee4d9c0dbf5147c1bbbb690eb8f82ca500ae0b13c9a9ca6fa
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1251C6366083528AEB70AF2A9A48369B790FB56BA4F94413DDA5C837C5CF3CF450C791
                                                                                                                                                                                                                                                Function 00007FF7C037EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                                                • String ID: MOC$RCC
                                                                                                                                                                                                                                                • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                                                • Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
                                                                                                                                                                                                                                                • Instruction ID: f5ecb59b5e8c989b76fbfeddfc897f8505234073f5477af59a46b2ade4ef98f8
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: D8619532908BC585DB209F19E5443A9F7A0FB89794F44422DEB9C47B95CF7CE190CB50
                                                                                                                                                                                                                                                Function 00007FF7C0372810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: Message
                                                                                                                                                                                                                                                • String ID: ERROR$Error$[PYI-%d:%ls]
                                                                                                                                                                                                                                                • API String ID: 2030045667-255084403
                                                                                                                                                                                                                                                • Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
                                                                                                                                                                                                                                                • Instruction ID: 7697d0e1621d67f3d88eab7b23039c12022f71a49d3c56b0a55a861eed4059e0
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5A219162718B4191E710AF59B5447AAA364EB88794F80013EEA8D93756DF3CE245C790
                                                                                                                                                                                                                                                Function 00007FF7C038C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 2718003287-0
                                                                                                                                                                                                                                                • Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
                                                                                                                                                                                                                                                • Instruction ID: 900a499b5a881b9389d633ff7b9c0d87e3079d3a31bc689fb00bfa5bdc3d27c7
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 57D1F172B28A4089E710DF65D4402ACB7A1FB947A8F84427EDE4DD7B89DF38E006C790
                                                                                                                                                                                                                                                Function 00007FF7C03720C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 1956198572-0
                                                                                                                                                                                                                                                • Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                                • Instruction ID: 13bd472ea99d4ce9dec20fd0520b8d31041534965fce09022e6eec4a345bc753
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9011EC21A1C14282F654AF6EE7482799291FB897A0FC4403CDB4947B8ACF2DF4959664
                                                                                                                                                                                                                                                Function 00007FF7C0395B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                                                • String ID: ?
                                                                                                                                                                                                                                                • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                                                • Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
                                                                                                                                                                                                                                                • Instruction ID: a51c0e27f50d5bda0e2291872f6ba08e0d93e933c643e78a6bc334522bf7c416
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 70410812A0838246FB64AF25D401379E750EB81BB4F94423DEE5D86BD5DF3CF4818B60
                                                                                                                                                                                                                                                Function 00007FF7C0389014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                • _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0389046
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C038A948: RtlFreeHeap.NTDLL(?,?,?,00007FF7C0392D22,?,?,?,00007FF7C0392D5F,?,?,00000000,00007FF7C0393225,?,?,?,00007FF7C0393157), ref: 00007FF7C038A95E
                                                                                                                                                                                                                                                  • Part of subcall function 00007FF7C038A948: GetLastError.KERNEL32(?,?,?,00007FF7C0392D22,?,?,?,00007FF7C0392D5F,?,?,00000000,00007FF7C0393225,?,?,?,00007FF7C0393157), ref: 00007FF7C038A968
                                                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7C037CBA5), ref: 00007FF7C0389064
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                                                • String ID: C:\Users\user\Desktop\WTvNL75dCr.exe
                                                                                                                                                                                                                                                • API String ID: 3580290477-3687880834
                                                                                                                                                                                                                                                • Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
                                                                                                                                                                                                                                                • Instruction ID: d9513df4ad867ea710fbddc399bdfc22b88c8fa43fdbabada21dda71a84ef255
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0F415E36A08B1285EB15AF25D8410BDA794EB457E4B99427FEE4D83B85DF3CF48183A0
                                                                                                                                                                                                                                                Function 00007FF7C038CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                                • String ID: U
                                                                                                                                                                                                                                                • API String ID: 442123175-4171548499
                                                                                                                                                                                                                                                • Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
                                                                                                                                                                                                                                                • Instruction ID: 3638605de012c327094becc929a2bdc7caa5f6f2cfe192735a80c9e714363c5f
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9741B332628A4181DB20AF25E4443AAA760FB887A4F80413EEE4DC7794EF3CE405C790
                                                                                                                                                                                                                                                Function 00007FF7C038F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: CurrentDirectory
                                                                                                                                                                                                                                                • String ID: :
                                                                                                                                                                                                                                                • API String ID: 1611563598-336475711
                                                                                                                                                                                                                                                • Opcode ID: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
                                                                                                                                                                                                                                                • Instruction ID: 5e2e5b3eb58d5457bf32f86c08e5816e805516df909b496c47f30e20b51860d6
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1221F562A1864185EB20AF11D44426DB3A1FB88B54FC6433ED64D83784EF7CF5448BE0
                                                                                                                                                                                                                                                Function 00007FF7C037FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                                                • String ID: csm
                                                                                                                                                                                                                                                • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                                                • Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
                                                                                                                                                                                                                                                • Instruction ID: 3d7aff6d3866d1bbc0d0afcd16bd60d153ab7fb1a11bb8d612f92ac674100717
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: D9115E32618B8182EB219F19E944259B7E4FB88B94F584238DBCD47768DF3CD551CB40
                                                                                                                                                                                                                                                Function 00007FF7C039073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2542885274.00007FF7C0371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C0370000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2542762243.00007FF7C0370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543121501.00007FF7C039B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543255766.00007FF7C03B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000000.00000002.2543441872.00007FF7C03B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ff7c0370000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                                                                • String ID: :
                                                                                                                                                                                                                                                • API String ID: 2595371189-336475711
                                                                                                                                                                                                                                                • Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
                                                                                                                                                                                                                                                • Instruction ID: 33fce0ba99668f07338649934758411a2b0e42e7633cc4cff2c1be4e87082908
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B201842291860285F720BFA4946527EA3A0EF45774FC0013ED54DC2791DF3DF5048B74

                                                                                                                                                                                                                                                Non-executed Functions

                                                                                                                                                                                                                                                Function 00007FF8A744C9AC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                • Source File: 00000002.00000002.2526607808.00007FF8A7181000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A7180000, based on PE: true
                                                                                                                                                                                                                                                • Associated: 00000002.00000002.2526587681.00007FF8A7180000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000002.00000002.2526828967.00007FF8A744E000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000002.00000002.2526939055.00007FF8A759B000.00000008.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000002.00000002.2526972074.00007FF8A75AB000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000002.00000002.2526994666.00007FF8A75B1000.00000008.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000002.00000002.2527059539.00007FF8A75B6000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000002.00000002.2527098367.00007FF8A75C5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000002.00000002.2527134503.00007FF8A75CC000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000002.00000002.2527169031.00007FF8A75CD000.00000008.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000002.00000002.2527202140.00007FF8A75CE000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000002.00000002.2527238250.00007FF8A75CF000.00000008.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000002.00000002.2527277331.00007FF8A75E8000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000002.00000002.2527313137.00007FF8A75F7000.00000008.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000002.00000002.2527339429.00007FF8A7607000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000002.00000002.2527361581.00007FF8A7608000.00000008.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000002.00000002.2527382190.00007FF8A7609000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000002.00000002.2527403679.00007FF8A760A000.00000008.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000002.00000002.2527426476.00007FF8A760D000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                • Associated: 00000002.00000002.2527448814.00007FF8A760F000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                • Snapshot File: hcaresult_2_2_7ff8a7180000_WTvNL75dCr.jbxd
                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                • API String ID: 2933794660-0
                                                                                                                                                                                                                                                • Opcode ID: 19a014122a8329d598b8a719417dcd6d526a9fad5fd2adc0fdb65de44e15e28a
                                                                                                                                                                                                                                                • Instruction ID: 50a0e1c24f22c447df19176f3b1084bd0e14a9f542c139aa0bf067b499dc3563
                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 19a014122a8329d598b8a719417dcd6d526a9fad5fd2adc0fdb65de44e15e28a
                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4B117C22B16F119AEB00CF60E8452BC33A4FB19798F081E31EA2D427A4DF7CD558D340